Business owners
How to Remove a Former Employee's Access to Your Website
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
Audit every layer where the departing person could have credentials: CMS users in WordPress or your content platform, your hosting control panel (cPanel, Plesk, or the hosting dashboard), DNS registrar access, analytics platforms like Google Analytics, advertising accounts including Google Ads and Meta Business Suite, and every shared password stored in spreadsheets, notes, or team password managers.
Where does access actually live (and why will you miss some)?
Access to your website's content sits in the CMS dashboard under Users or All Users (cms.ubc.ca), where you can remove a specific login or change its role. In Google Analytics, navigate to Admin, then Account Access Management or Property Access Management, and remove the user from the list (docs.analyzify.com).
Most registrars including GoDaddy, Namecheap, and Network Solutions allow you to delegate DNS updates through built-in access delegation features rather than sharing your login (crearewebsolutions.com), but you still need to revoke that delegated access after the person leaves. Log in to your registrar, locate account or domain access settings, and remove any email address or user you no longer recognize.
Hosting accounts are separate from DNS. Your hosting provider (the company that runs the server files) may use a different login from your domain registrar (the company where you bought the domain name). Check both.
Why you need an ordered checklist
Not all access carries the same risk. Classify access by risk into standard access like email and productivity tools, and privileged access such as domain admin, database admin, cloud root roles, or production SSH keys (infosec4tc.com). Start with the highest-damage areas first.
Work through the following in order:
- DNS registrar and hosting control panel. Someone with DNS access can redirect your domain to a different server. Someone with hosting access can delete your files or lock you out.
- CMS admin accounts. A WordPress administrator or equivalent can change every page, install malicious plugins, or create new admin accounts you won't notice.
- Google Analytics and ad platforms. These contain months of visitor data and can be deleted or exported. Revoke access when a person or partner is no longer working with your business (newage.agency).
- Shared passwords stored anywhere. Business passwords should not be shared through chat, email, SMS, WhatsApp, shared documents, spreadsheets, or personal notes (proton.me). If you've been storing credentials this way, assume the departing person still has them and change every password they could have seen.
If you use shared passwords, change these after an employee is terminated and turn off access to any third-party services that use those shared passwords, like Dropbox (agio.com).
What happens if you use a password manager?
A solid password manager organizes credentials into shared vaults, assigns roles carefully, and offers rapid revocation when someone leaves the team. If your business uses the guide (/guide) to choosing secure infrastructure, your credentials should live in a business password manager with admin controls, not scattered across text files or browser autofill.
To remove someone, log in to the admin console, navigate to the user list or team management section, and delete their account or revoke vault access. Most platforms including LastPass, 1Password, Bitwarden, and Proton Pass let you do this in under a minute.
If the departing person was the only admin, you have a different problem. Promote someone else to admin before you remove the last person with that privilege, or you'll lose the ability to manage users entirely.
How long this actually takes
Standard access should be revoked within 24 hours, but privileged access needs to go faster. The window should be measured in days, with hostile or high-risk exits flagged immediately, and security should know whether the departure is amicable or contested because the response differs significantly between the two.
Auditing shared passwords hidden in Slack threads, email, Google Docs, or handwritten notes takes longer than revoking formal user accounts. Budget time for this separately.
What to check after you think you're done
Notify external service providers, vendors, or partners with whom the terminated employee may have had access or shared credentials, and review and secure any accounts that were shared with external parties so the former employee can no longer access them.
Check for API tokens, particularly in tools like Zapier, Make, or custom integrations the person may have set up. These don't appear in user lists but can grant ongoing access long after the account is closed.
If your site has been scanned recently through the free AI-visibility check (/check), you'll have a record of which third-party scripts and tracking codes are installed. Cross-reference that list against what the departing person managed, then verify that each service still uses credentials you control.
Security issues compound when access lingers. Run through this checklist as part of every departure, not just hostile ones. For teams managing this at scale or agencies handling multiple clients, consider white-labelling the security audit process directly into client offboarding with tools available under ActiScore's pricing (/pricing).
Common questions
Where do I find website access to remove when someone leaves?
Website access lives in multiple layers that most businesses miss. Start with your CMS user list under Users or All Users in WordPress or your content platform, then check your hosting control panel like cPanel or Plesk, your DNS registrar account at GoDaddy or Namecheap, Google Analytics under Admin and Access Management, advertising platforms including Google Ads and Meta Business Suite, and every shared password stored in spreadsheets, notes, chat messages, or team password managers. Each layer requires separate action because removing CMS access does not affect hosting, DNS, or analytics logins.
What order should I revoke access in when an employee leaves?
Revoke privileged access first because it carries the highest damage potential. Start with DNS registrar and hosting control panels since someone with DNS access can redirect your domain and hosting access can delete files or lock you out entirely. Next remove CMS admin accounts that can change pages and install malicious plugins, then revoke Google Analytics and ad platform access that contains months of visitor data, and finally change all shared passwords the person could have seen in chat, email, documents, or notes. Standard access like email can follow after these critical areas are secured.
How do I remove someone from Google Analytics?
To remove someone from Google Analytics, log in and navigate to the Admin section, then select either Account Access Management or Property Access Management depending on what level of access the person had. Locate the user in the list by their email address and click the remove option next to their name. This revokes their ability to view reports, export data, or change settings immediately. You need to do this for each Analytics property separately if the person had access to multiple properties under your account.
What if we share passwords instead of using individual accounts?
If you share passwords through chat, email, spreadsheets, or notes instead of using individual logins, you must assume the departing person still has every password they ever saw and change all of them after they leave. This includes CMS logins, hosting panels, registrar accounts, and any third-party services like Dropbox that use shared credentials. Business passwords should never be shared this way because you cannot revoke access without changing the password entirely, which affects everyone else who uses that login. A business password manager with individual vaults and role-based access solves this by letting you revoke one person's access in under a minute without disrupting the rest of your team.
How long does it take to properly remove all website access?
Standard access should be revoked within twenty-four hours, but privileged access to DNS, hosting, and admin accounts needs to be removed much faster, ideally within hours for hostile or high-risk departures. Revoking formal user accounts in your CMS, hosting panel, and analytics platforms takes minutes per system if you know where to look. The time-consuming part is auditing and changing shared passwords hidden in Slack threads, email, Google Docs, or handwritten notes, which can take several hours depending on how many credentials were shared informally. Budget time separately for finding API tokens in automation tools like Zapier that do not appear in standard user lists but grant ongoing access.