Password Hygiene for Teams That Share a WordPress Login
Nearly every site we take over has one: a single administrator account, its password known to between three and nine people, some of whom no longer work there. It's usually called "admin" and the password is usually the company name with a number after it.
Nobody planned this. It's what happens when a site is set up quickly and then used by a team.
Why it's worse than it looks
You lose accountability. When a page changes or a setting flips, there's no way to know who did it. That matters for mistakes as much as for malice.
Offboarding becomes impossible. Someone leaves and the only remedy is changing a password everyone has to relearn — so it doesn't happen, and a former contractor keeps full access indefinitely.
Second factor becomes impractical. You can't reasonably put two-factor on an account nine people use, so the account most in need of protection is the one without it.
The password gets shared badly. Email, chat, a sticky note, a spreadsheet called passwords.xlsx. Each copy is a place it can leak from.
The fix, which takes about an hour
One account per person. Named, with their own email. This is the single change that resolves most of the above.
Correct roles. Most people who edit pages do not need Administrator. Editor covers content; Administrator covers plugins, users, and settings. Give the fewest people the highest role, and check the list of who has it — it's usually longer than anyone expects.
Two-factor on every administrator. Non-negotiable in 2026. Authenticator apps rather than SMS where you can.
Unique passwords, generated, in a manager. The business pays for the password manager; it is the cheapest security control available and it removes the reason people reuse passwords in the first place.
Delete the shared account once everyone has their own. Don't leave it deactivated.
The other three things worth doing while you're in there
Rename or remove the "admin" username. Automated attacks assume it exists, and half the guessing work is done for them.
Limit login attempts. Brute-force attempts against a small business site run constantly. Rate limiting turns a real risk into background noise.
Audit the user list quarterly. Former employees, agencies you no longer work with, the developer from two rebuilds ago, and any account created by a plugin you removed.
The offboarding checklist
When someone leaves: disable their account (don't delete — you may need the attribution history), revoke their sessions, remove them from the password manager, and rotate any shared credential they had that can't be individually revoked — hosting, DNS, registrar, mail.
Write that list down once and follow it every time. It's five minutes on the day and it's the difference between a departure and an exposure.