Who Still Has Access to Your Website? A Simple Security Check Every Business Should Do

A website can remain exposed long after a project ends.

A former employee may still have an email login. A previous developer may still control hosting. An agency may still appear as a Shopify collaborator. An old spreadsheet may contain the password to your domain registrar.

These access points are easy to overlook because they are rarely visible during normal business operations.

A simple access review brings them into the open.

This is a practical part of small business website security. It is not an emergency exercise. It is routine housekeeping that protects your website, email, customer data, and online reputation.

Start with a complete access list

Create one written list of every system connected to your website.

Do not rely on memory.

Include:

• WordPress or Shopify
• Hosting and server accounts
• Your domain registrar
• DNS or Cloudflare
• Business email and Google accounts
• Shared inboxes
• Payment processors
• Social media accounts
• Google Analytics and Google Search Console
• Website forms and email marketing tools
• Plugins, apps, and integrations
• API keys and access tokens
• Password managers and shared credentials

For each system, record:

• The account owner
• Every person with access
• Their permission level
• Whether multi-factor authentication is enabled
• Whether the person is an employee, contractor, agency, or former team member

Assign one accountable owner to each system.

The owner does not need to manage every daily task. They are responsible for knowing who has access and keeping the record current.

Remove people who no longer need access

Former employees are an obvious place to start.

Review their access to email, Google accounts, shared inboxes, website platforms, hosting, social media, analytics, and password managers.

Then review freelancers, contractors, and previous agencies.

This is a common blind spot when a business changes web developers. The new developer may build the site, while the old developer still has access to the hosting account, domain registrar, or WordPress administrator panel.

Remove access when the work ends.

Do not wait until the next website project.

A person who left six months ago should not still have an active login simply because nobody remembered to remove it.

When someone leaves, complete the access review during the same week. If they knew a shared password, change it. If they had access to an API key or access token, replace it.

Use individual accounts and limited permissions

People should have only the access their role requires.

This is called the principle of least privilege. In plain English, do not give someone the keys to the entire building when they only need to enter one room.

An editor may need to update website content. They may not need to install plugins, manage users, change payment settings, or access the domain registrar.

Keep administrator and owner accounts limited to the people who genuinely need them.

Avoid shared logins whenever the platform supports individual accounts. Individual accounts make it easier to see who performed an action and easier to remove one person without disrupting everyone else.

WordPress accounts

Review the user list inside WordPress.

Look for:

• Former employees
• Old freelancers and agencies
• Test accounts
• Duplicate administrator accounts
• Users with more access than their current role requires
• The default username “admin”

The default “admin” username is widely known and should not remain in use. Create a named administrator account for the person responsible for the site, then remove or reduce the old account after confirming that important content is properly assigned.

WordPress security also depends on reviewing access outside the dashboard. Check hosting control panels, SFTP, server access, database tools, and staging sites.

Shopify accounts

Review both staff accounts and collaborator accounts.

Remove former employees. Remove agencies and developers whose work is complete. Check which staff members have owner-level or financial permissions.

Shopify security improves when each person has a role that matches their work. A content editor does not need access to payment settings. A marketing contractor may need reports, but not customer exports.

Protect the accounts that control everything

Some accounts sit above the website itself.

Your domain registrar controls the domain name. Whoever controls it may be able to change where your website points, redirect email, or transfer the domain.

Your hosting account controls the server or service where the site runs.

Your DNS provider, including Cloudflare where applicable, controls important routing settings.

Protect all three with MFA.

MFA means multi-factor authentication. It requires something more than a password, such as a code from an authentication app or a security key.

Turn on MFA for:

• Domain registrar
• Hosting account
• Cloudflare or DNS provider
• WordPress administrators
• Shopify owners and staff
• Google Workspace and email
• Social media administrators
• Analytics and advertising accounts
• Payment and ecommerce services
• Password managers

Use passkeys where they are available. A passkey lets you approve sign-in with a device or biometric check instead of typing a password.

Treat email as part of website security

Email accounts often unlock other accounts.

A person who gains access to an inbox may be able to reset the password for WordPress, Shopify, hosting, social media, or the domain registrar.

Review who can access:

• Individual employee mailboxes
• Shared inboxes
• Former employee mailboxes
• Recovery email addresses
• Google Workspace administration
• Forwarding rules and delegated access

Remove old delegates and forwarding rules.

Do not store website passwords, API keys, or access tokens in email. Do not keep them in an unprotected spreadsheet or shared document. These files are easy to copy, forward, download, or leave accessible to former team members.

Use a reputable password manager with individual access and controlled sharing.

Review connected services and hidden credentials

Modern websites connect to many outside services.

A form may send leads to a CRM. A Shopify app may access orders. A WordPress plugin may connect to an email platform. An analytics tool may have access to your Google account.

Each connection creates another place to review.

Check:

• Active plugins and themes
• Shopify apps
• CRM integrations
• Email marketing services
• Payment tools
• Analytics accounts
• Social media connections
• API keys
• Webhooks and access tokens

Remove services you no longer use.

Replace credentials that belonged to a former employee, freelancer, or agency. Document what each API key does and who owns it. A key with no known owner should be treated as unnecessary until proven otherwise.

This is also where a website development and integration review can uncover access that is not visible from the main website dashboard.

Watch the signals

Logs and security alerts provide useful context.

You do not need to study technical logs every day. Set up alerts for important events, such as:

• A new administrator account
• A login from an unusual location
• A password reset
• A change to DNS
• A new Shopify collaborator
• A new plugin or app installation
• A failed login pattern
• A change to payment or email settings

Website forms should also have spam and bot protection. Otherwise, attackers and automated tools can flood inboxes, waste staff time, or use forms to test weaknesses.

Keep WordPress, plugins, themes, Shopify apps, and integrations current. Updates often fix known security problems. Remove software that is no longer maintained or needed.

Make the review quarterly

A quarterly review is a sensible cadence for most businesses.

Repeat it sooner after:

• An employee leaves
• A contractor finishes a project
• You change developers or agencies
• You launch a new integration
• You move hosting
• You change your domain registrar
• You suspect a phishing attempt

Use this simple checklist:

• Every website and connected system is listed
• One accountable owner is assigned to each system
• Former employees have been removed
• Old contractors and agencies have been removed
• WordPress administrators are current
• Shopify staff and collaborators are current
• Hosting and registrar access are limited
• MFA or passkeys are enabled
• Shared passwords have been replaced or rotated
• API keys and access tokens have known owners
• Unused apps, plugins, and integrations are removed
• Security alerts and backups are being monitored

If you find suspicious access

Stay calm and act in order.

First, use a trusted device to change the affected password. Enable MFA if it was not already active.

Then review recent login activity, remove unknown users, revoke active sessions, and check forwarding rules. If a shared password was exposed, change it everywhere it was used.

Contact the platform, hosting provider, domain registrar, or email provider if you cannot regain control.

Do not delete evidence before recording what happened. Note the time, affected account, unfamiliar users, changed settings, and messages received.

Good business cybersecurity starts with clear ownership.

You do not need a complicated system. You need an accurate access list, limited permissions, strong sign-in protection, and a repeatable review process.

FultonStudio can help review your website access, WordPress or Shopify administrator accounts, hosting, domain registrar settings, email protection, and connected services. Our ongoing website care service helps keep those systems aligned as your business and team change.