Admin access hygiene: two-factor, roles and offboarding

When we audit a website or web application, the first file we export is the user list. It is rarely short. On a recent onboarding for a mid-sized nonprofit, the WordPress install had 23 administrator accounts. Four belonged to current staff. The rest included two previous agencies, several freelancers from a 2019 redesign, a generic "webmaster" account whose password nobody could trace, and one account with no email address at all. None had two-factor authentication. This is typical, and it matters, because compromised credentials are consistently among the most common entry points in the incidents we handle. Fixing access is cheap compared with almost any other control. Here is the process we use.

Start with an inventory

You cannot tighten access you cannot see. The inventory covers every system that can change the site or its data, not just the CMS:

• CMS or application admin accounts, with role and last login date.
• Hosting control panel, SSH and SFTP users, and any deployed SSH keys.
• Domain registrar and DNS provider accounts.
• CDN, firewall and email delivery services.
• Code repositories, CI/CD systems and their stored secrets.
• Payment gateway, analytics and tag manager accounts.

For each entry, record who owns it, why they need it and when it was last used. Accounts nobody can explain go on a list for removal, after confirming they are not used by an integration.

Two-factor authentication, with no exceptions for publishers

Every account that can publish content, install code or change configuration should require a second factor. For editors and authors this is sometimes contested, because it adds friction. The argument we make is that editors can usually embed scripts or upload files, so an editor account is often one step from full compromise.

Practical points that make rollout smoother:

1. Prefer authenticator apps or hardware keys over SMS. SMS is better than nothing but vulnerable to SIM swapping.
2. Enforce it, do not merely offer it. Optional two-factor authentication reaches about a third of users in our experience.
3. Give a short grace period. Seven days with reminders works better than a hard cutoff on day one.
4. Plan recovery. Decide in advance how someone who loses their phone gets back in, and make sure that process cannot be socially engineered by a convincing email.
5. Use single sign-on where it exists. If the organization already enforces strong authentication through an identity provider, connecting the site to it centralizes both enforcement and offboarding.

Least privilege that people will actually follow

Most platforms ship with roles that are either too coarse or ignored. Our rule of thumb is that administrator access should belong to one or two named people, plus the maintenance team, and everyone else should have the lowest role that lets them do their job.

Common adjustments

• Marketing staff who only edit pages become editors, not administrators.
• Contributors who draft posts become authors or contributors and submit for review.
• Shop managers on WooCommerce get the store role, not full site control.
• Custom roles are created for narrow needs, such as someone who only manages events or forms.

Expect pushback, usually from someone who has had administrator access for years and occasionally installs a plugin. The fix is a clear route for requests: a ticket to the maintenance team, handled within a working day. When the route is fast, people stop missing their old permissions within a couple of weeks.

Every shared login is an account you cannot offboard. The day someone leaves, you either change a password that five other people depend on, or you do nothing.

Eliminate shared accounts

Shared logins such as "marketing@" or "admin" break accountability and make offboarding impossible without disruption. Replace them with individual accounts. Where a tool charges per seat and a shared account seems cheaper, weigh the cost of the seat against the cost of an untraceable change or an ex-employee who still knows the password. For service integrations, use dedicated API keys or application passwords scoped to the integration, never a person's login.

Offboarding within a day

Offboarding is where most access policies quietly fail. People change roles, contracts end and agencies are replaced, and nobody remembers the DNS account. We keep a simple checklist tied to the inventory above:

1. Disable or delete the person's accounts on every system in the inventory on their last day.
2. Reassign authored content before deleting CMS users, so posts are not lost or orphaned.
3. Remove their SSH keys and rotate any shared secrets they had access to.
4. Transfer ownership of registrar, DNS and third-party accounts they were the primary contact for.
5. Record the date and who completed each step.

For agency or freelancer access, we go further: access is granted with an expiry date at the start of the engagement. If the work runs longer, the date is extended deliberately rather than forgotten.

Review quarterly

A quarterly access review takes under an hour for a typical site once the inventory exists. Export users, compare against the inventory, flag anyone who has not logged in for 90 days, and confirm two-factor enrollment is still at 100 percent. Anything unexplained is investigated before it becomes an incident.

Access reviews are included in our monthly care plans. If you want the initial inventory and cleanup done for you, it is part of every security audit and our WordPress security hardening engagements.

Clean up who can reach your site

Most access cleanups take two to four days, including the inventory, two-factor rollout and role changes. Ask us for a fixed-price quote and we will start with a free look at your current user list.