Recommended Free Tools
Do not share an administrator password. Create a separate, named WordPress account for each person, assign the least-privileged role that completes the job, and have the person set a unique password through WordPress’s invitation or password-reset flow. Require HTTPS and two-factor authentication for privileged accounts. When the work ends, remove or downgrade the account, revoke any application credentials, and review sessions and logs.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This approach works for freelancers, support technicians, agencies, and internal teams because every action remains tied to a person and one person’s access can be withdrawn without disrupting everyone else.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why a separate account is safer than sharing one password
A shared login removes accountability. If several people use the same administrator credentials, the site owner cannot reliably tell who changed a setting, deleted content, installed a plugin, or created another account. Changing that password later also requires updating every person and device that used it, so old copies may remain active.
Individual accounts solve both problems. WordPress records activity under a named user, and an owner can disable one account without changing anyone else’s credentials. The account should still be treated as temporary when the assignment is temporary: access that is no longer needed is unnecessary attack surface.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Never paste a reusable administrator password into email, chat, a support ticket, a screenshot, or a shared document. Even if the channel is private, copies can remain in message history, backups, browser caches, notifications, or a recipient’s compromised account. Let WordPress send an invitation or password-reset message so the recipient establishes their own password.
WordPress recommends strong, unique passwords, password managers, HTTPS, and two-factor authentication. A password manager allows a person to use a different long password for every site without memorizing each one.
Match the WordPress role to the actual task
Start by describing the work in plain language: editing existing pages, publishing new posts, managing other authors, changing plugins or themes, or administering the whole installation. Then select the lowest role that can complete it. Do not grant Administrator merely because it is convenient.
| Role | What it can generally do on a single-site installation | Typical assignment |
|---|---|---|
| Administrator | All single-site capabilities, including site settings, users, plugins, themes, and content | Site owner or a highly trusted maintainer performing a task that truly requires full control |
| Editor | Publish and manage posts, including posts written by other users | Content manager who must review and publish a team’s work |
| Author | Publish and manage the user’s own posts | Writer who needs to publish personal articles but not manage other authors’ work |
| Contributor | Write and manage drafts but cannot publish them | Guest writer whose submissions require editorial review |
| Subscriber | Manage only the user’s profile | Someone who needs an account for profile access or a member-facing feature, not back-end editing |
Roles are a starting boundary, not a guarantee that every plugin follows the same rules. Plugins can add capabilities or expose their own permissions. Before assigning a role, check whether the requested operation is provided by WordPress core or by a plugin, and test the account on a staging site when the change is consequential.
Compare secure ways to provide access
The best method depends on whether the person is a continuing collaborator, a short-term support worker, or a machine that needs API access.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Best use | Main security property | Limitation to plan for |
|---|---|---|---|
| Named WordPress user with a role | Ongoing collaborator | Individual accountability and role boundaries | The account must be reviewed and removed or downgraded when work ends |
| WordPress.com invitation or sign-on controls | Teams using WordPress.com | Centralized invitations and account administration | Available controls depend on the WordPress.com plan and configuration |
| Temporary-login plugin | Short support or maintenance job | Expiring or revocable access without a permanent shared password | Adds plugin supply-chain, privacy, compatibility, and maintenance risk |
| Application Password | Script, deployment tool, or API client | Per-application credential that can be revoked independently | It is not for a human typing into the wp-admin login form |
| FIDO2 security key with two-factor authentication | Administrators and other privileged users | A phishing-resistant possession factor separate from the password | Requires enrollment and a recovery plan if a key is lost |
Set up a named account on self-hosted WordPress
- Define the trust boundary. Write down the exact deliverable and the capabilities it needs. “Fix the checkout plugin” may require plugin administration; “format these three posts” normally does not. If you cannot explain why Administrator is necessary, do not assign it.
- Open the user-creation screen. Sign in with an account allowed to manage users, then go to Users → Add New. Enter the collaborator’s real name or an identifiable username and their individual email address. Do not create one generic account for an entire agency or support team.
- Choose the role before sending the invitation. Select Editor, Author, Contributor, Subscriber, or Administrator according to the capability analysis. Recheck the selection; the default role on a site may be more powerful than the task requires.
- Use WordPress’s enrollment message. Send the generated invitation or password-reset email. The recipient should set a strong, unique password directly through the WordPress page. If the email is not delivered, verify the address and the site’s mail configuration rather than copying a password into a message.
- Require a secure connection. Visit the login and administration URLs over HTTPS and ensure the site’s certificate is valid. WordPress documents secure authentication cookies for HTTPS logins. Do not administer a site over plain HTTP, especially on public or shared networks.
- Require two-factor authentication when the role is privileged. Self-hosted WordPress does not include two-factor authentication by default. Add it through a maintained security plugin or an identity provider, then verify that the chosen solution supports the WordPress version, other security controls, and the required recovery process. Authenticator applications and security keys are documented options.
- Test the account with the recipient. Ask the collaborator to sign in and confirm that the assigned task is possible. If a needed screen is missing, identify the specific capability rather than immediately escalating to Administrator. Remove unnecessary permissions after testing.
Use WordPress.com invitations for hosted teams
On WordPress.com, invite the person through the site’s team or user-management workflow instead of giving them an existing user’s password. The invite associates the person’s own WordPress.com account with the site and lets the site owner apply the role supported by the plan and configuration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Before sending an invitation, confirm the recipient’s email address and the role they should receive. Review the team-management and sign-on controls available on your plan, because WordPress.com features and permission options vary by configuration. When the engagement ends, remove the person from the site or reduce their role; do not leave an unused invitation or membership active.
Enroll and protect two-factor authentication
Two-factor authentication adds a second proof after the password. A password can be phished or reused; a second factor limits what an attacker can do with the password alone. Require it first for Administrators, then for Editors and any other account that can publish, install code, or alter users.
Authenticator application
A maintained two-factor plugin or identity provider can require a time-based code from an authenticator application. During enrollment, save the recovery codes in a password manager or another protected location. Do not store them in the same unprotected chat or document as the username.
FIDO2 security key or passkey
A FIDO2/WebAuthn security key provides a separate possession factor and is designed to resist phishing. Enroll a primary key and, where the system permits it, a second key kept in a secure location. A second enrolled key or a documented recovery method prevents an otherwise legitimate administrator from being locked out after losing a phone or key. Test the recovery procedure before an emergency, not after the only factor has disappeared.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recovery and offboarding
Record who controls the recovery email, which administrators can reset two-factor authentication, and where backup codes are stored. Do not bypass two-factor authentication permanently because one person lost a device. Use the documented recovery process, then enroll a replacement factor and invalidate the missing one.
Use Application Passwords for scripts, not people
WordPress Application Passwords are separate credentials for an application, deployment tool, script, or API client. They can be revoked without changing the user’s main password, which limits the effect of a compromised integration. Create one credential per application and label it clearly so an individual token can be identified later.
Application Passwords are intended for software that calls the WordPress API, not for a human typing credentials into a browser login form. Store the value in the application’s secret store or an access-controlled password manager; never commit it to source control, place it in a screenshot, or put it in a shared ticket. If the integration is retired, revoke its Application Password immediately. If it may have been exposed, revoke it and issue a replacement rather than simply changing the account’s main password.
Give support temporary access without leaving a permanent account
For a short maintenance or troubleshooting job, a temporary-login plugin can issue access that expires automatically or can be revoked on demand. This avoids distributing a permanent password and can reduce cleanup if the expiry is enforced correctly.
A temporary-login plugin is still code running with access to the site. Before installing one, check its current maintenance activity, compatibility with the site’s WordPress and PHP versions, requested permissions, privacy behavior, and the developer’s process for security fixes. Download it only from a trusted distribution channel, keep a backup, and remove it when the job is complete if it is no longer needed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set the shortest practical expiry, assign the least powerful role the support person needs, and give the support person a named identity where the plugin supports it. Confirm the expiry by checking the account list after the work. If the plugin cannot show when access ends or who used it, a normal named account with explicit offboarding may provide better accountability.
How to send the invitation safely
- Confirm the recipient through a channel you already trust, especially if the request came from an unexpected support email.
- Enter the recipient’s individual address in the WordPress user or team-invitation screen.
- Send only the generated invitation or password-reset message. Do not add a password, recovery code, Application Password, or security-key backup code to the message.
- Tell the recipient to open the link directly, set a unique password, enable two-factor authentication if required, and save the credential in a password manager.
- Ask the recipient to report suspicious redirects, certificate warnings, or requests for a second password. A legitimate WordPress enrollment page should use the site’s expected HTTPS hostname.
If an invitation link was forwarded, expired, or sent to the wrong address, cancel or invalidate it and issue a new one. Treat the original link as exposed even if the wrong person claims not to have opened it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Close access when the task ends
Offboarding is part of secure sharing, not an optional cleanup step. Use a written end date for every temporary assignment and a recurring review for ongoing collaborators.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Confirm the deliverable. Ask the owner of the work to verify that the person no longer needs access.
- Remove or downgrade the user. Delete the named account when its history is no longer needed, or reduce it to Subscriber if the profile must remain. Preserve content ownership according to the site’s deletion prompt and your retention policy.
- Revoke machine credentials. Remove every Application Password associated with the project and disable integration accounts that are no longer used.
- End temporary sessions. Revoke active sessions where the site or identity provider provides that control. A password change alone may not terminate every existing session.
- Review authentication records. Check available login, user-change, plugin, and security logs for activity outside the agreed window. Investigate unexpected account creation, role changes, exports, or plugin installations.
- Rotate exposed secrets. If a password, Application Password, recovery code, or security-key credential was copied into an ordinary message or document, treat it as compromised and replace or revoke it.
- Patch the site. Update WordPress core, plugins, and themes after confirming backups and compatibility. An unpatched component can undermine otherwise careful account controls.
Common failure modes and fixes
“The developer says Administrator is required.”
Ask which exact screen or capability is blocked and whether the work can be performed on staging. Grant Administrator only for the smallest time window that genuinely requires all single-site capabilities, then remove or downgrade the account and review its activity.
“The recipient never received the invitation.”
Check the address, spam quarantine, and the site’s outgoing-mail configuration. Resend through WordPress after correcting the problem. Do not solve delivery problems by sending a password in chat.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“Two-factor authentication locked out the only administrator.”
Use the documented recovery codes, a second enrolled FIDO2 key, or the identity provider’s recovery process. Once access is restored, enroll a replacement factor, remove the lost factor, and ensure another trusted administrator has a tested recovery path.
“A temporary account still appears after the job.”
Do not assume an expiry worked. Disable or delete the account, revoke any related sessions and Application Passwords, inspect logs, and check the plugin’s configuration and maintenance status before using it again.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems“The site still uses HTTP.”
Stop transmitting administrative credentials until HTTPS is correctly configured. Obtain and validate a certificate, update the site and home URLs where appropriate, verify redirects, and test login cookies over HTTPS. Coordinate with the host or administrator if the site has mixed-content or proxy issues.
“Several agency employees need access.”
Create one account per person, even when they work for the same company. Their manager can request access, but the WordPress account should identify the actual operator. Remove each person separately when their assignment changes.
A practical access policy for a WordPress site
Document these rules where the site owners and maintainers can find them:
- Every human uses an individual account; generic shared administrator accounts are prohibited.
- Every request states the task, required capability, requester, approver, start date, and planned end date.
- Roles follow least privilege, with Administrator reserved for explicitly approved work.
- Passwords are unique and stored in a password manager; they are never transmitted in ordinary messages or documents.
- All administration occurs over HTTPS.
- Privileged users enroll two-factor authentication and maintain a tested recovery method; FIDO2 keys are an option when phishing resistance is important.
- Scripts use individually labeled Application Passwords stored as secrets, never human login credentials.
- Temporary access expires, and every account is reviewed after the assignment.
- Offboarding includes account removal or downgrade, session and token revocation, log review, and secret rotation when exposure is possible.
The safest default is therefore straightforward: invite the person by name, give only the role their task needs, protect the account with HTTPS and appropriate two-factor authentication, and close every access path when the work is finished.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
