Logging in to your WordPress website to update content or process an order is simple enough. But have you stopped to consider who else has access to your site?
Whether you’re managing the site on your own or working with a small team, each person who assists with your WordPress site may have their own login. Additionally, third-party providers, such as copywriters, web developers, marketers, and IT support, often require access as well. Over time, this can lead to a surprisingly long list of users with access to your site. And while these logins are necessary, it’s easy to overlook removing them when someone leaves or a third-party engagement ends.
Unused and outdated accounts pose a security risk to your website and business. If a user account is compromised or misused, it could lead to severe consequences, including data breaches, website downtime, and even harm to your customers.
In this blog, I’ll guide you through auditing your WordPress user accounts, share some best practices on password management and two-factor authentication (2FA), and help you establish a simple Standard Operating Procedure (SOP) for future access audits.
1. Identifying and Removing Outdated Accounts
An “outdated account” is simply a login for someone who no longer needs access to your WordPress site. Over time, these accounts accumulate, creating unnecessary security risks. Fortunately, WordPress makes it easy to review and manage your users.
To start, log in to your WordPress admin dashboard and select the ‘Users’ option from the left-hand menu. At the top of the page, filter users by selecting ‘Administrator’ to see a list of all accounts with admin-level access. Review each entry carefully. If there are users you no longer work with, remove their accounts promptly to secure your site.
Pro tip: Consider recording a quick tutorial video showing how to navigate to the Users menu and delete an outdated account. This can be useful for team members and help ensure consistent actions across your organisation.
2. Best Practices for Password Security
Keeping strong, unique passwords is essential for all logins, including those for your WordPress site. A strong password should combine letters, numbers, and special characters. Ideally, passwords should be updated every three months to minimise security risks.
When sharing access with third-party providers, request that they use strong passwords and change them at regular intervals as well. Using a password manager can simplify this process for everyone involved by securely storing and managing login information.
3. Enabling Two-Factor Authentication (2FA)
Two-factor authentication (2FA) is a valuable security measure that adds an extra step to the login process. With 2FA, after entering a password, users are prompted to complete a secondary step, such as entering a code sent via SMS or generated through an authentication app. This additional layer of security makes it much harder for unauthorised users to gain access.
If you’re not currently using 2FA on your WordPress site, consider setting it up. Many WordPress security plugins offer 2FA features that are simple to install and configure. Alternatively, you can guide users through your preferred 2FA setup in a short video or step-by-step screenshot guide.
4. Creating an SOP for Access Management
Once you’ve audited your accounts and implemented security measures, the next step is creating an SOP for future access reviews. This document will guide you or your team in maintaining secure access practices on an ongoing basis.
Here are two processes to include in your SOP:
1. Offboarding Process: Outline the steps to follow when an employee leaves or when you finish working with a third-party provider. This might include deleting their user account from WordPress, revoking access to other associated tools, and changing any shared passwords.
2. Routine Access Audit: Every three months, perform an access audit on your WordPress site and any other key platforms. Document the steps for reviewing user accounts, checking for outdated logins, and ensuring that everyone who needs access has it securely.
Consider offering a downloadable version of your SOP as a PDF for your readers. This could double as a valuable content upgrade in exchange for subscribing to your newsletter, adding value to your audience while growing your mailing list.
5. Extending Your Audit Beyond Your Website
Finally, remember that managing access doesn’t stop with your website. Many businesses use various online tools for accounting, marketing, design, and data analysis, all of which require regular access checks.
Set aside time every three months to audit all your essential tools. Review logins, remove outdated users, and verify that your security settings align with your current needs. Keeping these platforms secure will help maintain the integrity of your business data and customer information.
Regularly auditing access to your WordPress site and other critical tools is essential for maintaining a secure digital presence. By removing outdated accounts, enforcing strong password practices, implementing 2FA, and following a standard SOP, you’ll help protect your business from potential security risks.
Invest a small amount of time each quarter in access management, and you’ll find peace of mind knowing your website—and your business—is secure.
