Reviewing Who Has Access Before the New Year

Everyone who logged in this year

Think of everyone who logged in to one of the business's accounts this year. The staff, obviously. Also the summer student who ran Instagram, the contractor who fixed the booking page, the agency that ran a campaign in the spring.

Most were given access for a reason and kept it after the reason ended. Nobody removed it, because nobody was thinking about logins on their last day.

The stretch between Boxing Day and New Year is quiet enough to go through the lists properly. Little is changing, and few people are logging in to anything.

Where the lists are

• The website's own users, such as WordPress administrators and editors.
• The domain registrar and hosting account, including extra logins.
• Business email, with its mailboxes, forwarding rules and shared passwords.
• Google tools: My Business, Analytics, Search Console and Google Ads.
• Facebook page roles and the Instagram password.
• Booking, payment and newsletter systems, each with its own users.

The third hides the most. A former employee's mailbox can still be active, and a forwarding rule set up years ago can still be copying mail to an address outside the business.

Four kinds of entry

Going down each list, most entries fall into one of four kinds.

People who have left: former staff, finished contractors, the previous web company. Remove them.

People with more than they need: a bookkeeper with administrator rights to the website, an editor who only ever updates the hours. Lower them.

Logins nobody recognises: an account called admin2, a user named support created for a plugin company's help request three years ago. Find out, then remove.

Shared logins: one password known to several people, such as the hosting control panel. Change it whenever somebody who knew it leaves.

The website

On a WordPress site, the Users screen lists everyone with a login and their role. Administrators can change anything, including who else is an administrator; editors can change content only.

When you delete a user, WordPress asks what to do with the pages and posts they wrote. Attribute them to another user, or that content is deleted with them.

Behind the site sit logins the Users screen does not show: file transfer accounts on the server, the hosting control panel, sometimes a separate database login. Ask whoever maintains the site to list and prune those.

Email, which opens the rest

Business email deserves the closest look, because a password reset for almost anything else lands there.

When somebody leaves, do not simply delete their mailbox. Customers and suppliers keep writing to it, so forward it to a colleague or turn it into a shared mailbox, and change the password.

Check the forwarding rules and filters on every mailbox, your own included. A rule quietly sending copies of invoices to an outside address is how some frauds begin, and nobody looks at that settings page.

And check which phones are signed in. A former employee's phone may still be collecting the shared inbox long after their last day.

Google and Facebook

Google My Business, Analytics, Search Console and Google Ads each keep their own list of users, with their own levels. Look at all four; they rarely match.

Facebook pages are run through personal profiles given roles. A former employee who was an admin can still post as the business, and remove everyone else, until somebody takes the role away.

Instagram business accounts usually run on one shared login, so the password should change each time a person who knew it moves on.

A worked example

An indoor archery range with a pro shop runs lessons, leagues and birthday parties, with two full-time staff and a rotating group of part-time instructors.

When the owner went through the lists this time last year, the website had eleven users with logins.

Four were instructors who had since left, two of them administrators. One had been created for a booking plugin's support team during a problem two summers earlier.

The Facebook page had a former manager as its only other admin, and the shared mailbox for league registrations was still signed in on the phone of a student who had worked one summer.

None of these people had done anything wrong. They had been given access for a job and kept it afterwards.

The fix took an afternoon: removals, two role changes, new passwords for the shared mailbox and Instagram, and a one-page list of who holds what, updated whenever an instructor joins or leaves.

Two-step verification while you are there

For each account that stays, turn on two-step verification, which asks for a code from a phone as well as the password.

It matters most on email, the domain registrar and the hosting account, where a stolen password does the most damage.

Wherever a service allows it, every person should have a separate login. A shared login cannot be taken from one person; it can only be changed for everyone.

Before removing anyone

Removing the wrong login can lock the business out of its own account, so check one thing first.

Make sure somebody from the business holds the highest level on every account before anyone else comes off. A former manager who is the only owner of the Google listing has to transfer it, not simply be deleted.

Check what each person set up under their own name, such as an ad account billed to their card, and move it first.

And tell your web company before removing its logins, so a scheduled update or backup does not fail quietly in January.

The counter-case

Two partners who have shared every account from the start, with nobody else ever involved, have a short review: change the passwords and turn on two-step verification.

A business whose web company manages the hosting and domain as part of looking after the site can leave those lists to them, provided it asks for confirmation that they have been checked.

But anywhere staff, students or contractors have come and gone, the lists are longer than anybody thinks.

Review every list once a year, and remove access on the day people leave.

This week

1. List every account the business logs in to.
2. Open each user list and read every name.
3. Confirm a business owner at the top of each.
4. Remove people who have left.
5. Lower access that exceeds what the job needs.
6. Change shared passwords and check forwarding rules.
7. Add the review to the leaving checklist.

Step three comes before the removals for a reason. Taking away the only owner of an account, however long ago they left, can leave the business unable to get back in.

What to do if a fake notice has already been clicked is covered in fake delivery notices in December.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.