How do I share logins with staff and vendors safely?

How do I share access the safe way?

1. List the accounts that run your business, and who can get in to each:
   • business email and the admin account behind it
   • your domain registrar
   • your website admin
   • your Google Business Profile
   • social media pages
   • payment, booking and accounting systems
2. Check the business owns each one. The owner should be you or a business address, not an employee’s personal email or a former web company. For domains, see who owns my domain?
3. Invite people instead of sharing, using each service’s “add user” or “invite” feature.
4. Pick the lowest level that works. A blog writer doesn’t need to be an administrator.
5. Turn on two-factor login everywhere it’s offered. See turn on two-factor login.
6. Keep the list in a password manager’s secure notes, and update it when access changes.
   • Expected result: every account has a named owner in the business, and nobody uses anyone else’s login.

The short version

• Invite, don’t share. Give each person their own login at the lowest level that does the job.
• Keep the owner role yourself. On someone’s last day, remove them and change shared passwords.

How do I add people on common services?

Your website. Add a WordPress user with their own email and the right role. See add or remove a person’s access. Developers who need server files get a separate account too; see FTP or cPanel access.

Google Business Profile. Google’s guide to managing profile users gives these steps:

1. Open your Business Profile.
2. Select More, then Business Profile settings, then People and access.
3. Select Add and enter the person’s email address.
4. Under Access, choose Owner or Manager, then select Invite.

Google explains that owners have full control, including adding and removing people, while managers can’t add or remove users. For a vendor, Manager is usually enough. Keep at least one owner who works for your business.

Microsoft 365 and Google Workspace. An administrator can add a user, or give someone access to a shared mailbox, without anyone handing over a password.

Why does this matter?

Separate logins let you remove one person without changing everyone’s password, and most systems record who changed what. They also keep ownership with the business. A hard case to fix is an account that belongs to someone who has left, such as a domain or Google listing in a former employee’s or old agency’s name. Getting it back means proving ownership to that company’s support, which can take a while.

What if a password really has to be shared?

Some older systems have only one login. Then:

1. Use a password manager’s sharing feature, so you can take it back later.
2. If you don’t have one, read it out by phone.
3. Change the password when the work is done.

A password in an email, text or shared document stays around for years.

What should I do when someone leaves?

Do this on their last day:

1. Remove their logins from every account on your list.
2. Change any shared passwords they knew.
3. Check their phone isn’t your two-factor device or recovery number.
4. On Google, remove them under People and access. Google notes their past posts and replies stay on the profile.
5. If they ran your email, make sure the admin account is in the business’s name.

Our guide to removing an email account for someone who left covers email in more detail.

What are the common mistakes and edge cases?

• Access scam emails. A common trick is an email asking you to “add this person as an admin” or “confirm your login.” The FTC warns that fake invoices can be phishing aimed at getting into business systems. Call the person or company on a number you already know before granting anything.
• Only manager access. You can’t remove people without an owner. Ask an owner, or the service’s support.
• Nobody knows who has access. Most services have a users or “people” page. Check each one and remove anyone you don’t recognize.

What if this didn’t work?

• An ex-employee still controls an account: contact that service’s support with proof the account belongs to the business.
• A vendor won’t hand back ownership: ask in writing, keep records, and contact the service’s support.

For more, see which logins your business should own and business password basics.

How does E-3 handle this?

Don’t email passwords to anyone, E-3 included. When we need access to something you own, such as your Google profile or analytics, invite us as a user, so you can remove us whenever you like. If you’re not sure who has access to your website or accounts, email support@e3help.me or call 814-399-4655.

Related questions

• How do I add or remove a person’s access to edit our website?
• How do I turn on two-factor login?
• Who owns my domain?