Who has admin access to my website after it is built?

Many owners only discover who controls their site when something goes wrong. Website admin access decides who can change pages, add users, install software and, in the worst case, lock everyone else out. After launch, the business must hold the keys, not the developer.

Here is what to own, how to share access safely, and what to do if you do not have it today.

The accounts that make up website admin access

How to share website admin access safely

1. Keep the main owner or administrator account in your name with your email.
2. Give each developer or agency their own user account, never your password.
3. Use the lowest role that lets them do the job, for example Editor instead of Administrator when possible.
4. Turn on two-factor authentication for all admin users.
5. Remove or downgrade accounts when the work ends.

WordPress explains user roles and safe practices in its security hardening guide.

Why developers sometimes keep website admin access

Often it is convenience rather than bad intent: the developer set everything up with their own email to move quickly. The risk comes later, when that person is busy, changes job or stops replying. Read what to do if your developer stops responding to see how quickly this becomes a problem.

Example: an easy handover

At launch, a good developer sends a handover note: the domain registrar and hosting are in the client’s name, the client is the WordPress administrator, the developer has a separate admin account for the support period, and all logins are listed in a secure document. When support ends, the client removes the developer’s account in two clicks. That is what healthy website admin access looks like, and it takes ten minutes to set up properly.

What to do if you do not have website admin access today

• Ask your developer in writing to create an administrator account for you.
• Ask for the domain and hosting to be transferred to your account.
• Change passwords once you have access, and review the user list.
• Take a full backup.

Good habits for the future

• Store logins in a password manager, shared only with trusted staff.
• Review admin users every few months and remove old ones.
• Use your business email, not a personal one, for owner accounts.

A quick access audit you can do today

Open your WordPress Users screen or Shopify staff list and write down every account. For each one, ask: who is this, do they still work with us, and do they need this level of access? Remove anyone you do not recognise and downgrade anyone who has more access than they need. Then check that your own email is on the owner account, the hosting account and the domain. Ten minutes of review gives you clear control over website admin access and closes the most common gaps attackers use.