You Are Not the Only Person Who Can Log Into Your Website

You know your website password. You probably assume that makes you the gatekeeper. It does not.

Over the life of a business website, a surprising number of people get handed a way in. The person who built it. The freelancer who fixed it that one time. A staff member who updated the opening hours. A marketing contractor who needed to add a blog post. Each one gets an account, or worse, the shared admin password. And the part that catches owners out is this: almost none of them are ever removed.

This is not a story about hackers in hoodies. It is about the quiet accumulation of keys, and the fact that nobody keeps a list.

The Myth: If They Left, They Lost Access

The assumption goes like this. Someone stops working with you, so they can no longer get into your site. Out of the business, out of the system.

That is not how websites work.

A WordPress account does not expire when a working relationship ends. It sits there, username and password intact, until somebody actively deletes it. The receptionist who left in 2023 still has a login. The agency you stopped paying still has theirs. If you shared one admin password around instead of creating separate accounts, then everyone you ever gave it to still knows it, and changing your own password does nothing, because it was never yours alone.

Access is not something people lose by walking away. It is something you have to take back on purpose.

The People Who Quietly Still Hold a Key

Think back over everyone who has touched your site. Most businesses, when they actually do this, are unsettled by the length of the list.

• The web person who built it. Developers and agencies almost always keep an administrator account, and often separate hosting or SFTP credentials on top of that. Handy while you work together. A loose end afterwards.
• Former staff. Anyone who edited a page, loaded a product, or answered the contact form likely had a login. When they moved on, payroll got closed. The website account was forgotten.
• Contractors and freelancers. The one-off jobs. The photographer who uploaded the gallery. The SEO consultant from last spring.
• Connected services. Plugins, booking tools and marketing platforms often hold an application password or API token, a machine login that keeps working even when no human is at the keyboard.

Consider a Roscommon physiotherapy clinic that brought in a student on a summer placement to load their new site, then waved her off in September and never touched that login again. Nobody did anything wrong. The account simply outlived the reason it existed. That is the pattern, repeated across thousands of small businesses.

Why a Dormant Login Is a Live Threat

The operational reality is straightforward. An old account is not dangerous because the person is malicious. It is dangerous because it is unwatched.

The numbers back this up. In Verizon's 2025 Data Breach Investigations Report, credential abuse was the single most common way breaches began, involved in roughly a fifth of them, and stolen credentials turned up in around 88% of attacks on web applications. Verizon also puts the human element at close to six in ten breaches. These are not exotic zero-day exploits. They are valid logins used by the wrong person.

Now pair that with a figure from IBM's Cost of a Data Breach report. Breaches that start with compromised credentials take the longest of any type to spot and shut down, on the order of 292 days on average, though that figure naturally varies by organisation and by how closely anyone is actually watching. Nearly ten months.

Sit with that for a second. A login belonging to someone who left last year gets swept up in an infostealer infection on their old laptop. The credential leaks. Someone signs into your site with it. Because it is a legitimate account, nothing looks alarming. They read your customer enquiries, quietly change the bank details on your invoice template, and you find out when a customer rings to ask why the account number looked different. By then it has been months. That is the call no owner wants to take.

The account did not need to be hacked. It just needed to be forgotten.

Changing the Password Does Not Close the Door

Plenty of owners, once they get nervous, reset their own password and feel safer. It is a start. It is not a fix.

Separate accounts have separate passwords. Resetting yours does nothing to the administrator account the old agency still holds. If access was ever shared as one login, the answer is not a new password, it is a proper set of individual accounts with the old one retired.

And a website login is rarely just the WordPress login. There is often hosting panel access, SFTP or file access, a database login, and those application passwords that connected tools use. Each is a separate door. Closing one and assuming the house is locked is exactly how businesses get caught.

I will admit we learned this the slightly hard way ourselves. Early on we offboarded a contractor, removed their WordPress account, and completely forgot the separate SFTP credential we had set up months earlier. Nothing came of it. But it taught us to treat access as a list to be worked through, not a single account to be switched off.

How to Audit Who Can Get Into Your Website

You do not need to be technical for this. You need an afternoon and a willingness to be a little ruthless. Work through it in order.

1. List. Open your WordPress Users page and write down every account. Then add the logins that live outside WordPress: hosting panel, SFTP, database, and any connected apps holding an application password.
2. Verify. For each one, answer a single question. Does this person or service still need access today? Not "did they once", not "might they again". Today.
3. Revoke. Delete or deactivate every account that fails that test. When you remove a WordPress user, reassign their content to a current account so nothing breaks.
4. Rotate. Change the passwords on the accounts that remain, and retire any shared login by replacing it with individual accounts. Give each person the least access their job requires, not blanket administrator rights.
5. Diarise. Put a repeat in the calendar every quarter, and make revoking website access a standard step whenever anyone stops working with you.

Least privilege is the principle underneath all of it. The fewer people who can change everything, the fewer ways things go wrong. Deciding this deliberately is what assigning the right WordPress user role to each person is about, and it is worth getting right before you have a problem, not after.

What Good Access Control Actually Looks Like

Strip away the jargon and a well-run platform should let you do three things without phoning anyone. See every account that can reach your site in one place. Remove any of them in a click. And trust that the layers underneath the login are hardened and watched by someone whose job that is.

That last part matters, because access control at the WordPress level is only half the picture. If the hosting underneath has no intrusion prevention and no monitoring, a determined attacker does not need your login at all.

This is where managed hosting with server-level security hardening and fail2ban intrusion prevention built in earns its place. It watches the doors you cannot see, from an operations team in your own timezone, so a suspicious login pattern gets noticed in hours rather than the better part of a year. A tidy user list on top of a well-run stack, backed by automatic nightly backups so you can roll back if something does slip through, is the combination that actually keeps a small business safe. It is the same thinking behind a proper WordPress security and backup routine.

To be fair, not every business carries this risk equally. If you are a genuine sole operator who has never given another soul a login, who set the site up yourself and store one password in a reputable password manager, your exposure here is genuinely low. One person, one door. For you this is a ten-minute check, not an overhaul. The moment a second person gets involved, though, the maths changes, and it never changes back on its own.

One honest limitation worth naming: an access audit only catches the accounts you can see. A credential saved inside a plugin, a password sitting in an old email thread, or a backup file a former developer downloaded to their own machine all sit outside your user list entirely. Auditing logins reduces your exposure a great deal. It does not reduce it to zero, and anyone who tells you otherwise is selling something.

Conclusion

The dangerous login is rarely the one you are worried about. It is the one you forgot existed, belonging to someone who moved on and meant you no harm at all.

You can find those accounts today. Open your users list, be honest about who still needs to be there, and take back the keys that are no longer being used. Do it this week, then set a reminder to do it again in three months. A website you can account for, down to the last login, is a website that is genuinely yours to run.

Frequently Asked Questions

How do I see everyone who has access to my WordPress website?

In your WordPress dashboard, go to Users, where every account and its role is listed. Remember that this only shows WordPress logins. Access to your hosting panel, SFTP or file storage, database, and any connected apps holding an application password all live separately and need to be checked on their own.

Does a former employee or web developer still have access after they leave?

Unless someone actively removed their account, yes. A WordPress login does not expire when a working relationship ends. It stays valid until it is deleted, which is why offboarding should always include a step to revoke website and hosting access, not just email and payroll.

If I change my admin password, does that lock everyone else out?

No. Every account has its own password, so changing yours only affects your login. If other people have their own accounts, those still work. If you all shared one login, the real fix is to create individual accounts and retire the shared one, not simply reset the password.

How often should I review who can access my site?

A quarterly review is a sensible rhythm for most small businesses, along with an immediate check whenever anyone stops working with you. Stale accounts are the ones nobody is watching, so a regular diary reminder is what keeps the list honest.

Is a dormant account really a security risk if the person is trustworthy?

The risk is not usually the person, it is the account. A forgotten login can be exposed through malware on an old device or a password reused on a breached service, then used by someone else entirely. Because it is a legitimate account, misuse is hard to spot, which is why unused access is worth removing regardless of who it belonged to.

Sources