Remove an old website supplier’s access safely
When a supplier no longer needs access, review and remove their permissions through each relevant provider’s supported controls. Begin by confirming that the business has working owner access and that the handover is complete. Removing a website collaborator does not necessarily remove their access to hosting, DNS, email, analytics or connected services.
Before you start
- Confirm you are authorised to manage the business accounts involved.
- Gather the handover record and check for unfinished work or supplier-owned licences.
What to do
Prove your own access first
Sign in through the business owner’s normal route and check that recovery details are current. Confirm another authorised person can help if the primary device is unavailable. Do not remove the only account capable of administration while assuming a future support request will recover it.
List the separate systems
Check website editing, hosting, registrar, DNS, email, analytics and any form or payment administration actually used. Record the supplier’s named invitations and role in each. Review pending invitations too, so an old invitation cannot become a new access route after the handover.
Remove roles without deleting business content
Use the platform’s supported collaborator or permission removal process. If deleting an account can also affect its content, obtain platform-specific help first. Website files, authored pages and customer information should not be deleted simply because the person who worked on them has left.
Review shared credentials and connected jobs
Ask the responsible administrator to review shared passwords, API keys and automated integrations the supplier used. Replacing a credential can stop a scheduled task, so identify dependencies and test the replacement before retiring it. Confirm that forms, essential notifications and current authorised access still work afterwards.
What to check
- The business retains working owner and recovery access.
- Unused roles and pending invitations are removed from each relevant system.
- Essential integrations and current staff access still work.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.