Every person managing your website should have an account that matches their responsibilities. Separate accounts make it easier to identify changes, remove access when someone leaves and protect administrative tools. This Digital Rebellion guide explains the decisions to make before adding a user and the checks to perform when access changes.
Choose the role before creating the account An Administrator can manage broad site functions on a standard single-site installation. An Editor manages content, including other authors’ posts and pages. An Author generally manages their own posts. A Contributor can prepare posts but ordinarily needs someone else to publish them. A Subscriber has limited account access.
WooCommerce adds roles such as Shop Manager for store management and Customer for shoppers. Plugins and customisations can change capabilities, so treat these as a starting point. Give the lowest role that supports the person’s actual work. Someone writing occasional articles rarely needs plugin installation access.
Add a team member If your permissions allow it, open Users → Add New User or the equivalent control. Enter the person’s correct email address and a suitable username. Choose the agreed role and send the account notification. Ask the person to set their own password through the email link rather than choosing and sharing a password for them.
Confirm their public display name if the account will publish articles. A username used for login does not need to appear as the public author name. Some integrations can expose profile details, so review the author page if privacy matters.
- Choose the role
- Create a separate account
- Protect sign-in
- Review and revoke access
Protect your own account Use a unique, long password saved in a trusted password manager. Do not reuse an email or banking password. Secure the associated email account as well: password resets often depend on access to that mailbox.
Where an approved plugin, hosting service or sign-in provider supplies two-factor authentication, enable it and store recovery codes securely. Core WordPress installations do not all include a built-in two-factor setup screen. Follow your site’s configured method rather than searching for a universal menu.
Log out on shared devices and avoid storing credentials in public browsers. If you receive an unexpected password-reset message, do not share the link. A reset email alone does not prove that someone has accessed your account, but repeated suspicious activity should be reported.
Review access when responsibilities change Check the user list periodically and compare it with your current team and suppliers. Remove unnecessary administrator privileges. Use a separate account for a contractor, with an agreed purpose and end date. Do not rename your own account and hand it to someone else.
Before deleting a content owner’s account, consider reassigning their content. The deletion screen may offer to attribute content to another user; read the options carefully. Choosing to delete associated content can remove material you intended to keep. For store customers and order records, use the approved privacy and retention process rather than indiscriminate account deletion.
Respond to a suspected compromise Use a trusted device and contact Digital Rebellion through your established support route. Preserve the suspicious email, timing and affected URLs. Change the relevant passwords and revoke suspicious access in coordination with the person investigating. A password change alone does not prove that malware or unauthorised accounts have been removed.
Do not send passwords, authentication codes, recovery codes or secret API keys in a ticket. Provide screenshots only after removing private information.
Frequently asked questions Can an Editor update plugins? Standard Editor permissions focus on content, not plugin administration.
Should I delete Digital Rebellion’s account? Confirm the account’s purpose and any ongoing maintenance responsibilities first, so you do not interrupt agreed support access.
