Give each person the least access their job needs: Author for staff who post, Editor for whoever manages content, and Administrator only for the owner and the person who maintains the site. Delete everyone else.

Everyone has the keys

Open the Users screen of almost any small business WordPress site and count the administrators. There are often five or six.

The owner, two staff who post news, a photographer who uploaded a gallery years ago, the developer who built the site, and an account called admin that nobody can explain.

Each got full access because it was the easiest choice at the time, and nobody has removed any of them since.

Every one of those accounts can do anything to the site, including things the person behind it would never mean to do.

What each role allows

The third is the one most staff need. Someone who posts the week's news can do it as an Author, without touching pages they did not write or the settings that keep the site running.

One detail catches people out: Authors can publish posts but not pages, so whoever updates pages such as services or opening hours needs to be an Editor.

What an administrator can do

An administrator account can install plugins, which means running any code at all on the server. It can edit theme files, change the site's address so nothing loads, and create or delete users.

It also sees every update prompt for plugins and themes, and can run them all with one click on a Friday afternoon.

So each administrator account is a door into the whole site, only as secure as the password habits of the person holding it.

How sites collect administrators

Developers often make every account an administrator to avoid calls that begin with I cannot see the menu, and owners ask for full access for staff because anything less sounds like distrust.

Shared logins make it worse: one account used by three people cannot be removed when one of them leaves. And nobody owns the user list, so the site keeps everyone.

Reviewing the user list

On the Users screen, the links above the list filter accounts by role. Start with Administrator.

For each account, ask who it is, whether they still work with the business, and what they actually do on the site. Then give them the least role that lets them do it.

Administrator stays with two accounts: the owner's, using a business email address, and one for whoever maintains the site now.

A worked example

A vinyl record store sells online through WordPress and posts new arrivals and in-store listening events most weeks. Its site had nine user accounts, seven of them administrators.

They belonged to the owner, two current staff, a former employee, the photographer who shot the shop for the about page, the original developer and an account called admin.

One Saturday a staff member posting new arrivals saw a prompt to update plugins and clicked update all. The updated payment plugin clashed with the theme, and checkout stopped working until Monday.

Nobody was careless. The prompt appeared because the account was an administrator.

Both staff became Authors, the manager who edits the events page became an Editor, and the person handling orders got the Shop Manager role that WooCommerce, the shop plugin, adds.

The other accounts were deleted, with their posts attributed to the owner. The developer who maintains the site now has an administrator account in her own name.

Removing people without losing their posts

Deleting a user who wrote posts brings up a choice: delete all their content, or attribute it to another user. Choose attribute, or every post that person wrote goes with them.

Usernames cannot be changed from the dashboard, which matters for an account called admin, the first name automated login guessing tries.

To retire it, create a new administrator with a proper name, sign in as it, and delete the old account, attributing its content.

The developer's account

Whoever maintains the site does need administrator access, in an account of their own, so it can be removed cleanly if the work moves elsewhere. Developers from earlier years do not.

The business should always hold an administrator account itself, with an email address it controls. That one account makes every later change possible.

Settings that hand out accounts

Under Settings, then General, there is an option labelled Anyone can register, with a default role for new users beside it.

On most business sites it should be off, and if it is on, the default should be Subscriber. Compromised sites are sometimes left with Administrator as the default, so anyone can sign up with full access.

Passwords for the accounts that remain

Each remaining person needs their own account and a strong password, never a login shared around the office.

For the two administrators, a two-step login plugin adds a code from a phone at sign-in, a small inconvenience for the accounts that can do the most damage.

And when someone leaves, their WordPress account goes on the same list as their keys and their email.

The counter-case

A business where the owner is the only person who signs in has little to restructure: delete old developer accounts and check the registration setting.

Some plugins need an administrator to change their settings, and a small team may find an Editor cannot reach something. Grant access for the task and take it back afterwards.

A site under a maintenance plan may already have someone reviewing users. Ask to see the list.

Otherwise, give each person the least access their work needs, and keep administrator for two.

This afternoon

  1. Filter the Users screen by Administrator.
  2. Name the person behind every account.
  3. Delete departed users, attributing their posts to someone.
  4. Move staff who post to Author or Editor.
  5. Keep two administrators: the owner and the maintainer.
  6. Check that open registration is switched off.
  7. Review the list whenever someone leaves.

Step three is the one to slow down for. The delete screen offers to remove everything the person wrote, and one wrong choice can take years of posts with it.

Why the business needs its own way in is covered in the site only the original developer can edit.

Frequently asked questions

Which role should staff who post news have?

Author. They can write, publish and edit their own posts and upload images, without touching pages, settings, plugins or anyone else's work.

Why not make everyone an administrator?

Because every administrator can install plugins, edit code, change the site's address and delete users. Each account is a door into everything, guarded by one person's password habits.

Who should keep administrator access?

Two accounts: the owner, using an email address the business controls, and whoever maintains the site now, in an account of their own rather than a shared one.

What happens to posts when I delete a user?

WordPress asks whether to delete them or attribute them to another user. Choose attribute and pick a current account, or every post that person wrote disappears.

How do I get rid of an account called admin?

Make a new administrator with a proper username and sign in as that user. Remove the old account, giving its posts to the new one, since usernames cannot be edited.

What is the Anyone can register setting?

An option under Settings that lets anyone create an account. Most business sites should have it off; if it is on, the default role must be Subscriber.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Seven administrators on a small site?

Send us a screenshot of your Users screen. We will suggest the right role for each account.

Start a Conversation