Quick answer
Use individual access with appropriate permissions so each person or integration can perform its role without unnecessary control. Review website, hosting, domain, email, analytics, and external-service access separately.
Before you begin
Identify the business owner for each account and the tasks users must perform. Keep an emergency recovery route before removing administrative access.
What to do
- Inventory named users, collaborators, application passwords, API connections, and temporary supplier access. Do not copy secret values into the inventory.
- Compare permissions with current responsibilities. Content editors, developers, billing contacts, and reporting integrations may need different access.
- Remove obsolete access through the service’s normal process after confirming it is no longer required. Revoke related integration credentials where appropriate.
- Enable available account protections such as multifactor authentication using an approved recovery arrangement. Keep recovery codes in protected storage.
- Record the review date, responsible owner, and next review trigger, such as staff departure, supplier change, or completion of a project.
How to check the result
Confirm authorized users can still perform necessary work and that removed access no longer works. A user-list cleanup is not a complete security audit of the website or hosting environment.
If you need help
If the only owner is unavailable or ownership is disputed, use the provider’s documented recovery process. Do not share an administrator password with everyone as a temporary convenience or remove the last verified recovery route without a plan.
Related help
- Revoke an AI tool or contractor's SSH access
- Use a WordPress application password for an approved integration
- Give a Shopify developer the right collaborator access
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
