Give each client or contractor a separate WordPress account, assign only the role their task requires, protect privileged accounts with strong passwords and multi-factor authentication, and remove access as soon as the work ends. Never share an administrator login. Use revocable Application Passwords for software integrations, keep a written access register, and maintain updates, backups, and a controlled deployment path.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Why client access needs a system
A WordPress login is not simply a key to a page editor. It is an identity that can change content, publish under someone else’s name, expose personal data, install code, alter settings, or create more accounts. The safest arrangement limits both what a person can do and how long they can do it.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse five boundaries for every access decision:
- Permission scope: the exact role and capabilities needed, including whether user, plugin, theme, or site-setting access is required.
- Authentication strength: a unique password plus two-factor authentication (2FA), with a phishing-resistant security key for privileged users where practical.
- Credential type: a named human account for a person, or a separate revocable machine credential for software.
- Blast radius: production access only when necessary; otherwise use staging or a task-specific workflow.
- Lifecycle control: an owner, review date, logging, rotation, and a clear revocation procedure.
This model also makes investigations possible. If a shared administrator password is used, the activity trail cannot reliably identify the person who made a change. Individual accounts preserve accountability and make offboarding predictable.
Match the WordPress role to the job
WordPress roles are bundles of capabilities. Choose the narrowest bundle that completes the work, rather than starting with Administrator and hoping the user behaves carefully.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Role | What it permits | Good fit | Why not to over-assign it |
|---|---|---|---|
| Administrator | All administration features for one WordPress site. | Only a trusted site owner or operator who genuinely must manage users, settings, plugins, themes, and other administration functions. | A compromised administrator can change security settings, install code, create accounts, or lock out other users. Keep the number of administrators small. |
| Editor | Manage and publish posts, including posts created by other users. | A content lead who edits, schedules, or publishes the whole site’s editorial work. | It is broader than needed for a writer who only manages their own articles. |
| Author | Publish and manage the user’s own posts. | A client or contributor responsible for their own articles and media. | It does not provide the oversight of other authors’ posts. |
| Contributor | Write and manage their own posts but cannot publish them. | A freelancer whose work must be reviewed before publication. | Someone expecting to schedule or publish will need an approved publishing workflow instead. |
| Subscriber | Manage only their own profile. | A person who needs a profile or logged-in reading access, not editorial access. | It cannot support content production. |
These are the standard single-site role boundaries described by WordPress.org. A client who only reviews drafts should not receive Administrator. A publisher may need Editor or Author depending on whether they manage other users’ posts. If a task does not fit a built-in role, document the required capabilities and use a carefully designed least-privilege role rather than granting the next broadest role by default.
Step 1: define the access boundary before creating an account
Write the task in plain language before opening the WordPress dashboard. “Needs WordPress access” is not a useful requirement; “uploads product images and submits draft posts” is.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- List the actions: review drafts, write posts, publish, upload media, moderate comments, manage users, edit plugins or themes, change site settings, or deploy code.
- Separate environments: decide whether the person needs production, staging, or only exported content. Give production access only when the task cannot be completed elsewhere.
- Identify dependencies: note whether the person needs hosting, SSH, SFTP, a deployment system, analytics, or another service in addition to WordPress.
- Map actions to capabilities: select the narrowest built-in role or a documented custom capability set.
- Set an end condition: record the project end date, review date, or event that will trigger removal.
For high-impact work, define who approves a production change, where the backup is stored, and how to roll back. Access should be approved for a purpose, not granted indefinitely because a person may need it later.
Step 2: create named accounts, never shared logins
Create one account for every client, employee, and contractor under an identifiable username or email address. In the dashboard, use Users > Add New, enter the person’s details, assign the approved role, and send the invitation or temporary setup instructions through a secure channel.
Do not pass around a shared administrator username and password. Shared credentials defeat audit trails, make selective offboarding impossible, and encourage password reuse. If an emergency administrator account must exist, keep it separate from daily accounts, protect it strongly, monitor its use, and limit who can access its recovery method.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep administrator count low. WordPress brute-force guidance recommends 2FA for all administrators, limiting the number of administrators, and using least-privilege roles. A client can usually perform editorial work without any administrator capability.
Step 3: protect every privileged login
Use a generated password of at least 20 characters
WordPress password guidance recommends credentials of at least 20 characters, unique to that account and site. Generate them with a password manager instead of inventing a memorable phrase reused elsewhere. Store the credential in the manager, not in a shared document, email thread, ticket, or chat transcript.
The WordPress Security Team summarizes the risk plainly: “The weakest link in the security of anything you do online is your password.” A long unique password reduces guessing and reuse risk, but it does not replace 2FA.
Require 2FA for administrators and other privileged users
Enable 2FA for every administrator and for any other account that can publish, manage users, change settings, or install extensions. Establish the requirement before granting production access, and make sure the user has enrolled and tested the second factor rather than merely agreeing to do it later.
Prefer a FIDO2/WebAuthn security key when the user’s devices and workflow support it. The official WordPress MFA tutorial describes security keys as a phishing-resistant factor and states that “security keys aren’t vulnerable to phishing attacks.” Keep an approved recovery method under the site owner’s control; recovery should not be a second shared password.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect recovery as carefully as the login
Document who controls the account email, recovery codes, and security-key enrollment. Store recovery codes in the password manager or another protected offline location. Test the recovery process with a non-production account before an emergency occurs, and record when recovery material is rotated.
Step 4: separate people from software integrations
Deployment scripts, reporting tools, mobile apps, and other integrations should not use a human’s browser password. Create a dedicated integration identity with only the capabilities required, then issue a descriptive WordPress Application Password.
Application Passwords are per-application API credentials. WordPress displays a newly generated value once, so store it immediately in the integration’s server-side secret store. Send it only over HTTPS. They are intended for programmatic API authentication, not for signing in through the wp-admin browser login form.
In the user profile, the Application Passwords section lets an administrator create a label such as “staging deployment” or “monthly reporting.” Use one credential per integration so that one retirement or suspected compromise does not require changing every other connection. Record the owner, purpose, creation date, last-use information when available, and intended end date.
Revoke an individual Application Password as soon as its integration is retired, replaced, or suspected of compromise. If a machine credential may have been exposed, revoke first, then investigate logs and issue a new one only after the integration is secured.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 5: keep production changes controlled
Access management cannot compensate for an unmaintained site. WordPress identifies keeping core, plugins, and themes up to date as the most important security step and recommends actively maintained extensions.
- Check maintenance status: before installing an extension, confirm that it is actively maintained and compatible with the site’s WordPress version.
- Back up before impact: create a restorable backup before plugin, theme, database, or configuration changes. Verify that the backup can actually be restored.
- Use staging when available: let the contractor test changes in a staging copy and record what was changed. Do not assume staging is harmless if it contains production data; protect it too.
- Approve and deploy: identify who approved the production change, which account performed it, and the exact deployment window.
- Verify and roll back: check front-end pages, logins, forms, and key integrations. If the result is wrong or suspicious, use the documented rollback path instead of making additional untracked edits.
Give a developer WordPress access only for the WordPress portion of the task. Hosting-panel, SSH, SFTP, database, and deployment credentials are separate privileges; issue them individually, limit their scope, and remove them together with the WordPress account when the work ends.
Maintain an access register
A small written register prevents “temporary” access from becoming permanent. Keep it in a location with its own access controls and change history. At minimum, record:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Person’s name, organization, and contact address.
- WordPress username and the site or environment covered.
- Role and any additional custom capabilities.
- Business reason and approved task.
- Whether 2FA is enrolled and which recovery owner is responsible.
- Application Password label, if an integration is involved; never store the secret itself in the register.
- Start date, planned end date, last review date, and approver.
- Related hosting, SSH, SFTP, deployment, or third-party access.
- Last known use, relevant change records, and offboarding status.
Review the register on a recurring schedule and immediately after a role change, project handoff, suspected incident, or personnel departure. A review should answer “Does this person still need this exact capability?” rather than merely confirming that the account exists.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Offboard a client or contractor completely
Removal should happen when the work ends, not at the next annual security review. Use this order so a departing user cannot retain an alternate route:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Confirm the handoff: identify the replacement owner, preserve required content and change records, and capture any pending deployment details.
- Disable or delete the WordPress user: choose the option that preserves or reassigns their posts and media as required by your editorial policy.
- Revoke every Application Password: remove integration credentials associated with the person or project, including credentials that are no longer actively used.
- Remove adjacent access: revoke hosting-panel, SSH, SFTP, deployment, repository, analytics, and support accounts granted for the work.
- Rotate non-revocable shared secrets: change any secret that could not be tied to an individual account, and update approved integrations.
- Check active sessions and logs: review recent administrative activity and investigate unexpected changes before closing the ticket.
- Preserve recovery material: retain backups and logs according to your retention policy so an unauthorized change can be traced and reversed.
- Update the register: record the removal date, person who performed it, and any follow-up findings.
If you suspect compromise, disable the account and revoke tokens immediately, then rotate exposed credentials and restore from a known-good backup if necessary. Do not wait for a scheduled review.
Practical access patterns
Client reviews and approves drafts
Use a named Contributor account if the client writes material that someone else must publish. If the client only comments through a separate review process, they may not need a WordPress account at all. Do not grant Editor or Administrator for convenience.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Client publishes their own articles
An Author account fits when the client publishes and manages only their own posts. Require a unique 20-character-or-longer password and 2FA if the account has meaningful publishing or personal-data access.
Editorial lead manages the whole publication
Use Editor when the person must edit or publish other users’ posts but does not need plugin, theme, user, or site-setting administration. Keep an administrator out of the workflow unless a separately approved administrative task exists.
Developer performs a plugin or theme change
Prefer staging and a controlled deployment. Grant the minimum WordPress capability set for the change, provide separate hosting or repository access only when required, take a restorable backup, and record approval and rollback steps. Remove all temporary access at handoff.
Automation publishes or reports through the API
Create a dedicated integration identity and one labeled Application Password. Restrict the account’s role, transmit the credential over HTTPS, store it server-side, monitor use, and revoke it independently when the automation is replaced.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Common failures and their fixes
- “Everyone uses the agency administrator account.” Create named accounts, reduce administrators, and reserve the emergency account for monitored recovery.
- “The contractor needs access to everything just in case.” Translate the task into capabilities, use staging, and set an expiry or review date.
- “The password is strong, so 2FA can wait.” Enroll 2FA before production access, with a security key preferred for privileged users.
- “The integration uses the owner’s password.” Replace it with a dedicated user and revocable Application Password over HTTPS.
- “The user was deleted, so the job is finished.” Revoke tokens, hosting and deployment access, rotate shared secrets, inspect logs, and update the register.
- “Updates are postponed because the site is busy.” Use maintenance windows, staging, backups, and rollback procedures; actively maintained, current core and extensions are a central security control.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
