Organise website access around people, tasks, and ownership
Website access often grows informally as designers, content editors, and support providers join a project. Over time, the business may lose track of who can change what. Start with a simple ownership review that connects every account to a real responsibility and a person authorised to manage it.
Map the accounts behind the website
List domain registration, hosting, content management, enquiry delivery, analytics, and any connected services actually in use. Record the account owner, approved users, purpose, and recovery contact. Do not place passwords in this inventory. For an illustrative service company, the person editing articles may need access to content but no ability to change domain settings or billing. Treat each permission as a deliberate decision.
Use stronger sign-in arrangements
CISA encourages strong, unique passwords managed with a password manager and the use of multifactor authentication. Review the options offered by each provider and enable suitable protections with the account owner. Store recovery information through an approved restricted process. Avoid making the business depend on a contractor’s personal phone or mailbox for recovery; ownership should remain clear when the working relationship changes.
Make access review part of handover
When someone joins, changes duties, or leaves, review their access against the work they still perform. Remove permissions that are no longer needed and verify that another authorised owner can still operate the account. Test recovery arrangements carefully without disrupting active work. No checklist guarantees security, so keep provider instructions and the team’s incident contact route available.
- Assign separate named accounts where the service supports them.
- Document approval for elevated permissions.
- Review access after a project or role change.
- Keep recovery ownership current and restrict secret sharing.
Take it into your working day
Clear ownership and deliberate permissions make website access easier to review, transfer, and maintain as the team changes.