To remove former employee WordPress access safely, first confirm that your business controls the site and its recovery options. Then back up the site, identify every place the person or agency can sign in, revoke individual access, and carefully rotate shared credentials. Deleting a WordPress user alone does not remove access to hosting, the domain, or connected services.
A deliberate handoff helps protect sensitive information while keeping ordinary site functions working. Use this checklist before removing a former employee, contractor, or agency.
Confirm business control before changing access
Before you revoke anyone’s account, make sure an authorized person at your business can administer WordPress and recover access if needed. Confirm that the business controls the administrator email address and can reach the mailbox and recovery method tied to it. If access depends on the departing person’s email or phone, set up a business-controlled recovery route first.
Check that you can sign in to the hosting account and domain registrar, too. WordPress administrator access does not automatically give you control of the server, domain registration, or DNS settings. If an agency owns or manages those accounts, arrange a transfer or add a business-controlled owner before removing its access.
Review how WordPress roles and permissions work if you need to distinguish an administrator from a more limited user. Confirm that your own account has the permissions needed to complete the handoff.
Make and verify a backup
Create a current backup of the site’s files and database before changing accounts or credentials. Confirm that the backup completed and that you know how to access its restore process. A backup you cannot locate or restore is not a dependable recovery plan.
For sites with important forms, bookings, or online sales, plan the work for a time when you can check those functions afterward. Zevonix Cloud provides daily automated backups with instant restore capability. For general guidance on backup planning, see what to check in a WordPress backup setup.
Inventory every route into the website
Make a list of the departing person’s individual accounts and any shared or automated access they used. Ask the person or agency to identify the systems they managed, but verify the list against your own account records. Do not assume that the WordPress user list is the complete access map.
- WordPress: Administrator, editor, or other user accounts; application passwords; and any account used for maintenance.
- Hosting and server: Hosting control panel, file transfer accounts, SSH or SFTP access, database tools, and server access credentials.
- Domain and DNS: Domain registrar, DNS provider, and any account that can change where the domain points.
- Backups and security: Backup dashboards, security tools, malware monitoring, and recovery accounts.
- Connected services: Email delivery, analytics, payment or e-commerce tools, forms, scheduling, CDN, plugins, and other integrations.
- Shared credentials: Passwords, API keys, tokens, and other credentials used by more than one person or service.
Some connected services may rely on credentials the departing person set up. Identify what each credential supports before changing it. If you do not know whether a login or key is still in use, investigate first so you do not interrupt a necessary service.
Revoke access in a controlled order
Remove or change WordPress user access
In the WordPress dashboard, review the user list and identify the departing person’s account. If the person still needs limited access during a transition, consider reducing their role and setting a clear end point. If their work is complete, remove the account after confirming that another business-controlled administrator can sign in.
Before deleting a user, decide what should happen to content associated with that account. WordPress may offer the option to assign the user’s posts to another user or delete them. If the content should remain on the site, choose reassignment and select the appropriate business-controlled author. Do not choose content deletion unless removing those posts is intentional.
Also review application passwords and other WordPress access methods associated with the person. Remove credentials they controlled, and review whether any connected tool needs a replacement credential. For a broader perspective on credential revocation during offboarding, see CISA’s departing-employee credential guidance.
Revoke access beyond WordPress
Remove the person’s individual accounts from hosting, domain, DNS, backup, server, and connected-service dashboards. Where a service has shared access, remove the departing person’s account rather than simply changing a WordPress role.
Change shared passwords and rotate API keys or tokens when the departing person knew or controlled them. Update any legitimate integration that uses a changed credential, then test it. Store replacement credentials in a business-approved secure location and limit access to people who need them. Avoid changing credentials blindly: first identify dependencies and plan the update so forms, email delivery, payments, or other essential functions are not left using an invalid credential.
Test the site and document the handoff
After access is revoked, sign in with the business-controlled administrator account and review the WordPress user list. Check the live site and the functions that depend on connected services. Depending on how the site is used, that could include forms, appointment requests, checkout, payment processing, and email notifications.
Confirm that the business can access the hosting, domain, DNS, backup, and security accounts it needs. Record which accounts were removed, which shared credentials were changed, who now owns each account, and where recovery information is maintained. Keep the record current as responsibilities change.
If you find unexpected access or are unsure which integration depends on a credential, pause before making a change that could interrupt the site. Review the site’s security practices with this WordPress security checklist and resolve ownership questions before completing the handoff.
Frequently asked questions
Should I delete a former developer’s account or change their role?
If the person still needs temporary access for a defined transition, limit the role and remove access when that work ends. If the relationship is complete, remove the account after confirming another business-controlled administrator is available.
How can I remove someone without deleting their posts?
When WordPress prompts you about the user’s content, choose to attribute the content to an existing business-controlled user. Do not select the option to delete the content unless that is your intention.
Does deleting a WordPress user remove access to hosting and the domain?
No. Review and revoke access separately for hosting, the domain registrar, DNS, server tools, backups, and connected services. A WordPress account only addresses access within WordPress.
How can I confirm the person no longer has access?
Review account lists and access permissions across WordPress and the other systems in your inventory. Revoke individual accounts, rotate shared credentials the person knew, and check that business-controlled recovery methods are in place. Keep a record of what you verified.
Make offboarding part of site security
Removing a former employee or agency safely means protecting both the website and the business’s control of it. Confirm ownership and recovery first, make a verified backup, review all access routes, then revoke and test deliberately. If you need help managing WordPress access, backups, or ongoing site care, learn about Zevonix Cloud’s managed WordPress services.