Give website access without giving everything
Least privilege means giving someone only the access needed for their agreed task, for only as long as required. A person updating opening hours does not automatically need ownership of your domain or access to payment settings. Website platforms offer different roles, so check the actual permissions rather than relying on a friendly-sounding role name.
Useful context
- Write a clear task description and expected finish date.
- Identify the platform account that owns the website and its recovery route.
How it works
Map the task to the right system
Editing a page, reviewing analytics and changing DNS are different jobs. Identify which system the person actually needs. Do not grant access to hosting, email and the registrar as a standard bundle when the task can be completed within the website editor.
Read the role’s real permissions
A role called editor may control more than one page or include access to non-public content. Review the provider’s current permission description before inviting someone. Where the platform cannot provide a narrow enough role, agree another supported approach rather than inventing a restriction that does not exist.
Use a named account and review date
Invite the authorised person using their own account where supported. Record the reason for access and when it should be reviewed. Named access is easier to remove and investigate than a shared owner password, especially if several suppliers work on the same business website.
Retain the business owner’s control
Make sure the business keeps an appropriate owner account and working recovery arrangements. A supplier’s operational convenience should not leave you unable to renew, approve changes or change providers. Review access after the agreed work finishes and whenever responsibilities change.
What to check
- The granted permissions match the actual task.
- Access belongs to an identifiable person rather than a circulated owner login.
- The business retains ownership and a review date.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.