When a developer, employee or SEO agency needs access to your website, sending them your own username and password feels quick. It also removes accountability, exposes the most powerful account and makes access difficult to revoke later.
The safer approach is to invite each person with their own account and grant only the permissions needed for the work. The exact names vary by platform, but the principle stays the same.
This guide starts with WordPress user roles, then explains how to add users or collaborators to Shopify, Wix, Squarespace and Webflow.
Answer five questions first:
Follow the principle of least privilege: give the smallest role that lets the person complete the agreed task. You can increase access later if a genuine requirement appears.
Also make a backup before major development work, require strong unique passwords and enable two-factor authentication wherever the platform supports it.
A standard WordPress installation includes five site-level roles. WordPress Multisite adds a sixth. WordPress.org’s roles and capabilities documentation describes roles as collections of permitted tasks rather than a simple job-title hierarchy.
Administrators can manage virtually every part of a single WordPress site, including users, themes, plugins, settings, pages and posts.
Use this role only when somebody genuinely needs site-wide technical control. A developer may need temporary Administrator access to install a plugin or change a template. A copywriter usually does not.
On many sites, an administrator can add another administrator. That makes the role especially sensitive.
Editors can publish and manage pages and posts, including content created by other users. They do not normally manage plugins, themes or site settings.
This is often suitable for an experienced content or marketing lead who needs to control the editorial calendar across the website.
Authors can create, publish and manage their own posts. They cannot manage somebody else’s posts or site-wide settings.
Use this for a trusted contributor who publishes their own blog content without needing broader editorial control.
Contributors can write and edit their own posts but cannot publish them. An Editor or Administrator must review and publish the work.
This is a useful default for guest writers or new team members while an approval process is in place.
Subscribers can manage their own profile and access content that requires a login. They cannot create or edit normal site content.
Many brochure websites do not need Subscriber accounts unless they have a membership or gated-content feature.
Super Admin exists on WordPress Multisite networks. It controls network-wide settings, sites, themes, plugins and users. It should be limited to the small number of people responsible for the whole network.
Plugins can create additional roles or capabilities, so your dashboard may not match this default list exactly.
You need an account with permission to create users.
The official WordPress Add New User guide explains each field. Menu wording can vary slightly between WordPress versions, managed hosts and security plugins.
Do not create a generic account called “agency” for several people. Named accounts make it easier to trace changes and remove one person without disrupting everybody else.
There is no universal answer because SEO work ranges from content editing to technical implementation.
Ask the agency to explain the tasks that require Administrator access. If the need is temporary, raise the role for the implementation window and reduce it afterwards.
Website access is only one part of an SEO handover. Use separate named invitations for analytics, advertising and search tools too. See our guide to adding a Google Search Console user.
Go to Users, then All Users. Open the account to change its role, or select Delete to remove it.
When deleting a user who created content, WordPress asks whether to delete their content or attribute it to another user. In most business handovers, reassign the content so published pages and posts remain available.
Shopify uses user accounts and roles. Availability and user limits depend on the store plan, so check the current Shopify user-account requirements before promising an internal staff seat.
For an eligible store:
Shopify’s role-based access guidance explains how roles group permissions. Predefined options may include work such as online store editing, customer support, merchandising, marketing or app development.
An agency or freelancer in the Shopify Partner programme can request a collaborator account instead of taking a staff login. This is usually the cleanest route for an external specialist because the store owner approves the requested permissions and can remove the collaborator later.
Avoid granting access to orders, customers, finances or apps when the task does not require it.
Wix lets the owner invite collaborators with predefined or custom roles.
The current Wix collaborator instructions note that invitations expire after 30 days and that collaborator allowances vary by plan. If an invitation is not accepted, cancel or resend it rather than sharing your owner account.
Wix roles cover different tasks, including website editing, blogging, marketing and billing. Use a custom role when the defaults provide more access than the work requires.
Squarespace calls invited users contributors. Only an owner or administrator can normally invite them.
The person receives an email asking them to sign in or create their own Squarespace account. The Squarespace contributor guide also allows an owner to change or cancel the invitation before it is accepted.
Squarespace can combine multiple permissions for a tailored role. Administrator access gives the widest control and should be reserved for people managing the site as a whole.
Webflow separates Workspace roles from site roles. This lets an owner control both account-level actions and what a person can do on a particular website.
To invite a Workspace member from an open site:
Owners and admins can also manage members in Workspace settings. The current Webflow invitation guide says Reviewer is a free role for viewing and commenting, while roles with editing or design capabilities can require a paid seat.
Webflow also offers a Guest route for eligible agency and freelancer Workspaces. This helps the client retain ownership while limiting the external team to selected sites and permissions.
Do not use a sandbox or comment-only link when somebody needs to publish real changes. Those options are useful for review, not implementation.
Every person should use their own email address and account. Never send the website owner’s password over email, chat or a project-management ticket.
The client should own the domain, website subscription, hosting, analytics, Search Console and advertising accounts. Agencies should be invited into those assets, not create an arrangement the client cannot access.
A developer who edits templates rarely needs billing permissions. A finance user rarely needs to publish pages. Split these responsibilities unless one trusted owner genuinely performs both.
Maintain a simple register containing the person, platform, role, purpose, approval date and planned review date. Review it quarterly and whenever staff or suppliers change.
Require it for owners, administrators and anyone with customer, payment or publishing access. Store recovery codes securely and make sure the business (not an individual contractor) controls recovery options for the owner account.
When a project or employment ends:
Good access management lets specialists work while the business keeps control. Create named accounts, match each role to a task and remove access when it is no longer needed.
If you need help after access is in place, talk to our UK based SEO agency. Our SEO team can work with your platform and existing developers while you keep ownership.
No. Editorial work may need an Editor-style role. Administrator access is justified only for technical tasks involving site-wide settings, plugins, code or redirects.
"*" indicates required fields
