Running alone, you had one account. Then someone joins to help with content, a freelance designer needs access for a fortnight, a marketer arrives. The fastest thing is to make everyone an administrator, and that is how most sites start.
The trouble is that this state is hard to reverse. And the moment there are five administrators, nobody can say with certainty what happened to the site. If everyone is an administrator, nobody is.
Roles are about blast radius, not distrust
If splitting permissions reads as “I don’t trust you”, the team pushes back — so the framing matters. Roles are a device for limiting how far a mistake or an incident travels.
If an account is compromised and it can only write posts, the damage stops at posts. An administrator account can install plugins and add users, and that is the path to losing the whole site. Mistake or attack, the consequence scales with the permission.
How to divide it in practice
The rule is simple: give the least that the person’s work requires. Someone writing content does not need to install plugins; a freelancer adjusting the design does not need to manage users.
And keep administrators to a minimum. One is ideal; two is the realistic number once you allow for absence.
Shared accounts are the most dangerous of these. With three people on one login, nothing can be attributed, and when one of them leaves the password must be changed for everyone. In practice it never gets changed, and the departed person keeps their access.
Joining, and leaving
Onboarding usually has a procedure; offboarding usually does not. If accounts are not tidied on the day a contract ends or a role changes, that access simply stays. Accounts still live years later really are where incidents begin.
Put a quarterly review in the calendar. Open the user list and ask one question per row: does this person still need this level of access? It takes five minutes.
Finally, put two-factor authentication on administrator accounts. If a password leaks somewhere, that one extra layer is what remains.
Articles on accounts and access control live in the security archive, and permissions, hardening and vulnerability review are handled together in our optimization program.
Next part
The final part gathers everything so far into a single checklist, so you can tell whether the site is ready for the next six months.