Website Collaborator Limits: Wix, Squarespace, WordPress

Name: Web60
Address: Block B, Maynooth Business Campus, Straffan Rd, Maynooth, Co. Kildare, W23 W5X7, IE
Price range: €60/year

The fees table for next summer's courses had changed, and nobody in the office had changed it. The director of a small Gaeltacht summer college in Donegal found it on a grey November afternoon while looking over the site before bookings opened. Last year's prices were back. A paragraph about bus pick-ups was gone. And the website's activity history showed that every edit for three summers had been made by one person: her. Except she had not made most of them.

That college is a composite. I have stitched it together from the kind of sites that land on our desk when owners ask us to move them, and the details are invented, but the shape is a pattern we see again and again. A small team. A website plan that lets two or three people log in. More people than that who need to. So everybody uses the owner's login, the password lives on a sticky note beside the office kettle, and every seasonal coordinator who ever worked there walks away still knowing it.

This article is about the limit that causes it. Most website builders meter how many people can work on your site. WordPress does not. That sounds like an admin detail. It is a security decision, and most owners make it without noticing on the day they pick a plan.

How a Summer College Ends Up With One Password

Run the college's year forward and the cap bites at an obvious moment. Through the winter, two people touch the website: the director and a part-time administrator who handles bookings. Come June, four coordinators arrive for the season. Their job includes posting the daily photo galleries and updates that parents check every evening, and they need to log in to do it.

On a capped plan, that is the moment of decision. Upgrade to a plan with more seats, which can cost several times as much for the sake of eight weeks of photo uploads, or hand out the one login that already works. Almost nobody upgrades. It feels like paying a premium for people who will be gone by September.

I read the plan pages for the two biggest closed builders this morning. The limits fall like this:

Platform	Who can log in	When you need one more person
Wix	2 collaborators on Light, 5 on Core, 10 on Business, 100 on Business Elite	Upgrade the whole plan; single seats are not sold
Squarespace	2 contributors on Basic, unlimited on Core and above	Move from Basic to Core
WordPress	No limit set by WordPress itself	Add a user and pick a role

Wix: Seats That Fill the Moment You Send an Invite

The Wix plans page lists 2 site collaborators on Light, 5 on Core, 10 on Business and 100 on Business Elite. Every Wix site starts with one free collaborator seat, according to Wix's own help article on the seat limit, and upgrading is how you get more. Two details in that article matter more than the numbers.

First, a seat is used the moment you send the invitation, not when the person accepts it. A pending invite to a coordinator who never got round to opening the email still occupies a chair. Second, you cannot buy a single extra seat. Wix says you get more by upgrading the site, and if you are already over the limit, existing collaborators can stay but nobody new can be invited until you upgrade.

For the college, the jump that hurts is the last one. A team of eleven has outgrown Business, and the next plan up, Business Elite, was listed at roughly four times the monthly price of Business on the dollar figures Wix shows for reference. Nobody pays four times as much for a summer of photo galleries. They share a password instead. Seat caps are only one of the meters on a closed builder, too, as our Wix vs WordPress performance comparison found when it looked at what you can and cannot tune on each.

Squarespace: Two People on Basic, Then Everyone

Squarespace is more generous, and fairness says so plainly. Its pricing page lists 2 contributors on Basic and unlimited contributors on Core, Plus and Advanced. Once you are on Core, headcount stops being a reason to share a login.

The pinch is at the bottom. Basic is the plan a two-person business picks to keep costs down, and two contributors means exactly two people. The first part-timer, the first nephew who looks after the social media, the first bookkeeper who wants to see orders, and you are either upgrading or sharing.

My honest concession: if you are a two-person photography studio that wants a polished portfolio and nothing more, Squarespace Core is a genuinely tidy arrangement. Everyone gets their own login, and because it is a closed system, there is far less a contributor can install that breaks the site. If that is your whole requirement, I would not try to talk you out of it. Most businesses outgrow a closed system for other reasons long before they outgrow the contributor list, though, and Squarespace has been moving its prices in one direction, as we set out when looking at what to do when the Squarespace renewal price goes up.

On a capped plan, the third person through the door has nowhere to sit.

Why a Seat Cap Turns Into a Shared Password

Sharing a login is not laziness. It is the rational response to a meter. When doing the right thing costs a plan upgrade and doing the wrong thing costs nothing you can see, people do the wrong thing, and they keep doing it for years.

Nothing you can see, until you can. Verizon's 2025 Data Breach Investigations Report, which analysed more than 12,000 confirmed breaches, found that credential abuse, meaning an attacker simply logging in with a username and password that work, was one of the two leading ways in, at roughly a fifth of breaches. The same report found third-party involvement in breaches had doubled to around three in ten. Those are global figures, drawn heavily from larger organisations, so I would not map them neatly onto a summer college. The direction is what counts. Most break-ins involve no clever hacking at all. Somebody has a password they should not have, or a password that has been in too many places.

A shared login is that problem by design. The password gets written down, texted, said out loud across an office and saved on personal phones that leave with their owners in September. You cannot change it without locking out everyone who legitimately uses it. So it never gets changed. I am not above this. Early in my hosting career I set up more than one client site with a single shared admin login because it was quicker on the day, and it was never quicker afterwards. I would not make that call now.

What the Owner's Login Actually Hands Over

Back to the college. The login every coordinator knew was not a limited editing account. It was the director's own. On most builders the owner account is the one that controls billing, the domain connection and the button that deletes the site. Every coordinator who passed through had the power to cancel the plan, point the domain somewhere else or wipe the lot. None of them did. That is not the same as being safe.

The real damage in the composite is quieter. When the fees table changed, the history showed one name against every edit. Was it a former coordinator with an old session still open on a phone? A current one who misread an instruction? An outsider who found the password in a breached list from some other website? Nobody can say, so nobody can fix the cause, only the symptom.

Then think about January. Bookings open with last year's prices showing, and the first parents either pay the wrong amount, ring the office to query it, or quietly book a different college with a website that looks like someone is minding it. The parents' contact details behind the booking form were also readable by every person who ever knew that password. That is an awkward thing to explain to a parent, before anyone mentions the Data Protection Commission.

WordPress: One Login Per Person, and a Role That Fits the Job

WordPress runs on roughly four in ten of all websites (W3Techs had it at 39.6% when I checked today, and close to six in ten of sites where the platform is known), and it approaches this from the other end. WordPress itself sets no limit on the number of users. You add a person, give them their own login and choose a role. We have a fuller walkthrough of which WordPress role to give each person on your team, but the short version maps neatly onto the college.

The WordPress.org documentation lists the built-in roles: Administrator, Editor, Author, Contributor and Subscriber, plus a Super Admin for multi-site networks that a small business will rarely need. Each role is a bundle of permissions, and the documentation makes the point that a role describes a person's responsibilities rather than their seniority.

Administrator stays with the director, the only account that can install plugins, change settings or manage other users.
Editor goes to the bookings administrator, who needs to change any page, including the fees table.
Author suits each summer coordinator, who can publish and edit their own gallery posts and nothing else.
Contributor fits a trainee who should write updates but not publish them, so someone reviews each post first.

So what does that change on an ordinary day? When the fees table moves, the record shows which account moved it. When a coordinator finishes on the last day of August, you remove one account and nobody else is disturbed. And a coordinator's phone left on a bus hands a stranger the power to post a photo gallery, not to delete the website or touch the billing.

One door per person, each with its own key.

What Unlimited Logins Do Not Fix

Unlimited users is not a security policy. It removes the reason to share a password. It does not do the rest of the job, and I would be overselling WordPress if I pretended otherwise.

Every account is another door. Eleven people with eleven logins means eleven passwords, some of them weaker than you would like, and automated login attempts against WordPress sites never really stop. Two-factor authentication is not built into core WordPress; you add it with a plugin, or through your hosting panel if your provider offers it. Offboarding is still your job, because WordPress will not notice that someone left. And the Editor role is broader than many owners expect: an Editor can change every page on the site, not just the ones you had in mind.

What should a properly run setup give you, then? Three things, whoever provides it:

Every person gets their own account, with no price conversation attached to adding one.
The server watches for repeated failed logins and blocks them before they turn into a guessing game.
When someone changes the wrong thing, you can roll back to a known good version in minutes rather than retype it from memory.

That is the standard. Web60 meets it on each count. It runs full WordPress, so adding a person is a WordPress setting rather than a plan upgrade, and it sits inside Web60's €60/year all-inclusive plan with no per-feature charges. In practice, the coordinator who starts on a Monday in June has their own login that morning, and nobody has to approve a new invoice first. Server-level hardening and fail2ban intrusion prevention block repeated failed logins, which means a bot hammering a coordinator's account gets shut out instead of getting a thousand more guesses. Automatic nightly backups with one-click restore mean a broken fees table is a restore, not an afternoon of retyping prices from an old brochure.

One honest limitation on that last point. A nightly backup will not tell you who made a change, and restoring last night's copy also removes anything legitimate added since. If a coordinator posted three galleries this afternoon and the fees table broke at teatime, a full restore takes the galleries with it. Separate logins tell you who. Backups give you the before. You want both.

Sorting Out Your Website Logins in Five Steps

Audit the accounts. Write down everyone who currently knows any website password, including people who have already left.

Provision one login per person. Give each current team member their own account, set up with their own email address.

Assign the narrowest role. Pick the role that covers the job they actually do, not the one that saves you answering questions later.

Rotate the owner password. Once everyone has their own login, change the main password and keep it to yourself.

Verify on the last day. When someone finishes up, remove their account before they leave the building, not when you next remember.

If you are on a capped plan and the next person costs an upgrade, it may be the moment to look at building on WordPress instead. With Web60 you describe your business, the AI Website Builder has a full WordPress site ready in under a minute, and from then on adding your team is one login at a time.

Before the Next Seasonal Hire

The number of people who can log into your website is a decision, whether you made it on purpose or not. When a plan makes the right answer cost more, the wrong answer becomes the default, and it stays the default until a fees table changes and nobody knows why. Count the people who need access today, add the ones you expect by next summer, and choose a setup that gives each of them a door of their own.

Frequently Asked Questions

How many people can edit a Wix website?

It depends on the plan. The Wix plans page lists 2 site collaborators on Light, 5 on Core, 10 on Business and 100 on Business Elite, and every site starts with one free collaborator seat. A seat is used as soon as you send an invite, and you cannot buy single extra seats, so adding one more person beyond your limit means upgrading the whole plan.

How many contributors does Squarespace allow?

The Squarespace pricing page lists 2 contributors on the Basic plan and unlimited contributors on Core, Plus and Advanced. If more than two people need to work on the site, you need Core or above.

Does WordPress limit the number of users on a website?

WordPress itself does not set a limit on the number of user accounts. You add each person under Users, give them their own login and choose a role such as Editor, Author or Contributor. Any limit you meet comes from the platform or hosting plan running WordPress, not from WordPress.

Is it safe to share one website login with my staff?

It is one of the riskier habits a small business can have. A shared password gets written down and passed around, it cannot be changed without locking everyone out, and the site history cannot show who made which change. If the shared login is the owner account, everyone who knows it can also reach billing, the domain settings and the option to delete the site.

What WordPress role should a part-time staff member have?

Give them the narrowest role that covers their job. Someone who only writes news or blog posts can be an Author, who can publish and edit their own posts. Someone who needs to update any page, such as prices or opening hours, needs Editor. Keep Administrator for the owner and anyone who genuinely needs to install plugins or manage other users.

How do I remove a former employee's access to my website?

In WordPress, go to Users, delete their account and, when prompted, assign their posts to another user so nothing they wrote disappears. If they ever knew a shared password, change it as well, and review any connected accounts, such as social media or payments, that used the same one.

Website Collaborator Limits: Why Small Teams End Up Sharing One Login