How do I give my web designer or staff access safely?
The short answer
Invite them as a user on each account, with their own login, instead of sharing your password. Give only the access they need, keep yourself as the account owner, and remove their access when the work is finished. Registrars, hosts, website builders and email providers all support this.
Sharing one password means you can’t tell who changed what, you can’t remove one person without locking everyone out, and two-factor codes end up being passed around by text message.
- In each account, find Users, Team, Contributors or Delegate access.
- Invite the person by email and choose the smallest role that lets them do the job.
- Keep the account itself (the owner, and the email it’s registered to) in your name, on an email address you control.
- When the work ends, remove them and check they no longer appear as a user.
Words used here
- Personal login
- The account is registered to a personal email (like Gmail). If that inbox is lost, so is the account. Use a business address such as ops@yourdomain.
- Two-factor authentication (2FA)
- A second check when you log in — usually a code from your phone. It stops most account takeovers. Turn it on for every provider.
- Login service (auth provider)
- A ready-made sign-in system for your site: log in, sign up, reset password and two-factor codes. Examples: Clerk, Auth0.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.