What to do when an employee with website access leaves

A marketing executive resigns on good terms, serves notice, hands back the laptop and leaves. Six months later a stray promotional post appears on the company Instagram, or a customer export lands somewhere it should not. Nobody did anything malicious; the account was simply never closed. This employee offboarding checklist covers the website and digital side of a staff exit, so access ends when employment does.

Work through it on the last working day rather than "sometime next week". The gap between those two is where the risk lives.

Prepare before the last day

Once notice is given, start with a short conversation rather than a technical scramble. Ask the person directly what they log into for work, including things you may not have issued: a courier panel, a bulk SMS account, a listing on a marketplace, a Google Business Profile, an ad account.

People usually answer honestly and often remember systems that never appeared on any register. Write the list down and add it to what your records already show. Also ask which routine jobs they do that nobody else knows how to run, such as a weekly export or a monthly upload, and have them show a colleague before they go.

Website and admin accounts

Start where the damage would be most visible.

• Disable their login on the website admin and end any active sessions, not only the password.
• Reassign drafts, scheduled posts and saved reports that belonged to them.
• Check for automations or scheduled jobs running under their account, such as a report emailed nightly, and move those to another owner.
• Look at the activity log for the notice period so you know the state they left things in.
• If they were the only administrator, promote a replacement before disabling them, so you are never left without one.

Shared passwords are the real problem

Individual accounts are easy to switch off. The difficult part is everything the person knew rather than everything they held. If your office uses a common password for the hosting panel, the Wi-Fi router, the accounting software or a marketplace seller account, that knowledge walks out with them.

List every shared credential the person had sight of and change each one. Do it in a single session so you do not lose track halfway. Afterwards, use the moment to move those shared logins into a password manager with per-person access, so the next exit needs no mass reset at all.

Do not forget credentials written on paper near desks, saved in a browser on a shared computer, or sitting in an old WhatsApp message thread.

Email, forwarding rules and handover

Email needs care because closing it too fast loses business, and leaving it open loses control.

1. Change the password on their mailbox and sign out all devices.
2. Inspect the account for forwarding rules, filters and auto-replies. A forward set up months ago will keep sending copies of everything to a personal address unless you remove it.
3. Check which app passwords or connected apps have access to the mailbox and revoke them.
4. Set an auto-reply or forward to a colleague for a defined period, then close the mailbox.
5. Look at where that address was used as a recovery email or a contact for other services, especially the domain registrar, and replace it.

That last step catches a common trap. If a departing employee's address is the recovery contact on your hosting or registrar account, closing their mailbox can lock you out of your own systems later.

Keys, tokens and anything a machine uses

Technical staff leave behind credentials that are not logins at all. These are easy to miss because nothing prompts you about them.

• SSH keys: remove their public key from the server and any deployment configuration.
• API keys and tokens: rotate keys they created for payment gateways, SMS or WhatsApp providers, maps, shipping partners and any integration.
• Database users: remove personal database accounts and change any shared one.
• Code repositories: remove them from the organisation, and revoke personal access tokens and deploy keys.
• FTP or SFTP accounts: delete their user, which is often forgotten because it sits in the hosting panel rather than the site.
• Backup storage: check access to any cloud drive or bucket holding site backups or customer exports.

Rotating a live API key can briefly break an integration, so plan it for a quiet hour and have the developer ready to update the new value.

Domain, hosting and third-party platforms

Finish with the accounts that sit outside the website but control it. Remove them as a user from the domain registrar and hosting provider, and confirm the account contact details point to the business. Then work through the third-party list: analytics, Tag Manager, ad accounts, social pages, the payment gateway dashboard, courier and logistics panels, the GST or e-invoicing portal if they had access, and any WhatsApp Business setup where their number was linked.

WhatsApp deserves a specific look. If customer enquiries were handled on a personal number or a device tied to them, arrange the handover of the business number before the exit, not after.

Sudden exits and difficult departures

When someone leaves abruptly or on bad terms, the order changes. Cut access first and sort out handover afterwards, starting with the accounts that could cause immediate harm: website admin, email, payment gateway, social media and hosting. Take a fresh backup of the site and database before making changes, so you have a clean copy of the state at that moment. Then review logs for unusual activity in the preceding weeks and keep a written record of what you found and what you changed.

Turn the checklist into a habit

Copy the sections above into a document, adapt it to the systems your business actually uses, and keep it with your HR exit paperwork. Tick each line with a date and the name of who did it. The first run will take a couple of hours because you will be discovering accounts; later ones take twenty minutes.

If you would rather have someone go through the technical items with you, our team can help audit the site, server and integrations after a staff change; start with a support request or read about our website development and maintenance services.

Frequently asked questions

Should I delete a former employee's website account or just disable it?

Disable it. Their name may be attached to posts, orders or log entries, and deleting the user can remove or reassign that history in ways you did not intend.

How soon should access be removed after resignation?

Access should end on the last working day. During the notice period, consider reducing high-risk rights such as bulk data export while keeping what they need to finish work.

Can a former employee still be logged in after I change the password?

On some systems, yes. An existing session can survive a password change, which is why you should explicitly sign out all devices or invalidate sessions as well.

What if the employee owns the company social media or WhatsApp number?

Transfer ownership while they are still available and cooperative. Recovering an account or number afterwards depends entirely on the platform's process and can take weeks.