The day someone leaves is the wrong day to discover which accounts they had. Deleting their WordPress user feels like the job is done, but the website is only one of the doors. The person may also hold the hosting login, be the owner of your Google Analytics property, receive every contact form enquiry, and know the one password the whole office has used for years.
This is a checklist for that moment: how to remove access when an employee leaves, in a sensible order, without locking yourself out or losing anything you need. It works just as well for a freelancer or agency at the end of a contract. Set aside proper time for it rather than squeezing it between other jobs.
Before the last day: list what they can reach
If you have notice, use it. Sit down with the person and write a list of everything they log in to for the business. People forget accounts they set up years ago, so prompt them: domain, hosting, website, email, Google tools, social media, payment services, plugin shops, anything with a monthly bill.
For each one, note two things:
- Is it their own account or a shared login? Their own account can be removed. A shared login needs its password changed.
- Are they the owner, or just a user? This is the one that causes real trouble. If the domain, the hosting account or a Google property is registered in their name, removing them could remove the business’s control too. Ownership must be transferred to you first, while they are still cooperative.
If you do not have notice, or the person left on bad terms, skip the conversation and start with the most powerful access straight away.
The order that keeps you safe
Work from the accounts that can do the most damage down to the least. Someone with the domain registrar login can move your whole online presence; someone with a forgotten blog account can edit a post. A rough order:
- Domain registrar and DNS (including any service such as Cloudflare that controls DNS).
- Hosting account, file access and databases.
- Business email administration.
- WordPress administrator accounts.
- Google Analytics, Search Console, Google Business Profile, ad accounts and social pages.
- Everything else: plugin shops, form services, payment dashboards, newsletters.
Remove access when an employee leaves: the full checklist
| Where | What to do | Easy to miss |
|---|---|---|
| Domain registrar | Remove their user, or change the password if they knew the main login | The domain itself registered under their personal account |
| Hosting | Remove their panel access, SFTP or SSH users and keys | Database users or FTP accounts created just for them |
| Business email | Suspend the mailbox, set up forwarding or an auto-reply | A forwarding rule copying company mail to their private address |
| WordPress | Downgrade or delete the account, end sessions, revoke app passwords | Content still attributed to them, their address in plugin settings |
| Google tools | Remove them from each property’s user or access settings | Being listed as an owner rather than a user |
| Forms and notifications | Change recipients on every form and shop email | Enquiries quietly going to an inbox nobody reads |
| Shared passwords | Change every password they knew | Passwords saved in their browser or a personal password manager |
| Plugin and theme licences | Move the vendor account to a business email | Renewal reminders going to them, then the licence lapsing |
The WordPress account itself
Go to Users → All Users and find the person. You have two choices.
Downgrade it if you want the account kept for a short time, for instance while you check what they published. The lowest choice in the role dropdown, “No role for this site”, leaves them unable to reach the dashboard; Subscriber is the next step up. Give the account a new password at the same time, so they cannot sign back in at all.
Delete the account when you are sure. WordPress will ask what to do with their posts and pages; choose to give them to another user unless you really want them gone. The details of that screen, and what else the user may have owned, are in our guide to deleting a user while keeping their content.
Before you delete, deal with two things that can outlive a role change:
- Active logins. On their profile, the Sessions section lets you sign them out of every device at once. Our post on ending WordPress logins on other devices covers this, including how to sign out everyone if a shared login was involved.
- Application passwords. If they connected an app or service to the site with an application password, it is listed on their profile and can be revoked there. See what WordPress application passwords are for.
Then look for their email address outside the Users screen: Settings → General for the site admin email, your SMTP plugin’s sender settings, backup and security plugin alerts, and WooCommerce’s order notification recipients if you run a shop.
Hosting, domain and email
Many hosts and registrars let the account owner add other users with their own logins. If the person had one of those, remove it. If instead they knew the main password, change it, and turn on two-step login for the account if the provider offers it.
In the hosting panel, look for FTP or SFTP accounts, SSH keys and database users that were created for them. These work independently of WordPress, so deleting a WordPress user does nothing to them.
For their mailbox, do not delete it on day one. Suspend it or change its password, set an auto-reply pointing customers to a current colleague, and forward incoming mail to someone who will act on it. You may need old messages later. Check too for rules they set up themselves, such as forwarding a copy of everything to a personal address.
Google tools, social pages and paid services
Each Google product keeps its own list of people with access, so check them one at a time: Google Analytics, Search Console, Google Business Profile, Tag Manager and any Google Ads account. In each, find the access or user management settings and remove the person.
Pay attention to ownership. In Search Console, someone who verified the site themselves is an owner, and their verification method may need removing as well as their name. In Google Business Profile, make sure the primary owner is a business account before they go. The same applies to Facebook and Instagram business pages, LinkedIn pages and any ad accounts.
Then the smaller services: payment gateway dashboards, newsletter tools, booking systems, review platforms. If a plugin licence or premium theme was bought under their email, ask the vendor how to move the account to a business address. Otherwise you may find out only when updates stop.
Passwords they knew
Anything shared has to change, even if you trust the person completely. Their old laptop or phone might still be signed in, or a saved password might sit in a browser profile you cannot see. Start with the most powerful logins from the list above.
If your team shares logins through a password manager, remove them from the shared vault, then change the passwords it contained. Better still, move to one account per person wherever a service allows it. The approach agencies use, described in sharing logins safely, works just as well inside a small business.
Keep the list for next time
Save the finished list somewhere safe, with the date and what you changed. The next departure will take half the time, and it becomes the start of a proper record of who has access to what. That record is the heart of good WordPress user management, and one of the habits covered across our WordPress site owner’s handbook.
Frequently asked questions
How soon should access be removed after someone leaves?
For accounts with real power, such as hosting, domain and WordPress administrator logins, on their last working day or before they walk out. Lower-level accounts can follow within a few days. If the departure is sudden or unfriendly, remove the most powerful access first, even before you tell the person.
What if the person who left set up the website and owns the hosting?
Then the business does not fully control its own website yet. Ask them, politely and in writing, to transfer the hosting and domain accounts to you or add you as owner before anything else. If they will not cooperate, the host or registrar may have a formal ownership transfer process, which usually needs proof that you own the business.
Do I need to tell the person what I have removed?
You do not have to, but on good terms it helps. A short note saying their website and email access has ended avoids confusion when a login stops working, and invites them to mention any account you might have missed. If they left on bad terms, remove the access first and keep any message brief and factual.
How do I handle a freelancer or agency at the end of a project?
Use the same checklist, with one change of emphasis. Outside developers are more likely to have hosting, SFTP and database access, and to have installed plugins under their own licences. Ask for a handover list of what they set up, then remove their accounts and change any shared passwords on the day the work ends.
Hosting panels and old FTP users are where a checklist like this most often stalls. Our WordPress support team can go through the site and hosting accounts with you and help tidy up what is left.
