The Most Secure Way To Give Someone Access to Your WordPress Website

What is the most secure way to give someone login access to your WordPress website?

The most secure method for giving someone login access to your WordPress site is to create a new user and assign the proper Role to that user. It’s fast and simple. The other method is to just give the user your login credentials (ie username and password) to log in. However, we don’t recommend this and give our reasons why later in this article.

Creating a new user in WordPress

There are very few steps to create a new user in WordPress, but we want you to have full confidence that you are doing it right, and to be aware of the various settings you have at your disposal when creating a new user. For a super-fast walkthrough, watch this video as we go through the process from start to finish.

For the readers out there, we have written instructions below including more details about the user roles and notification settings.

Steps to create a new user in WordPress

1. Login to Your Account – First go to yourwebsite.com/wp-admin. But replace yourwebsite.com with your website’s domain name. You will either be taken to your Dashboard or to the login page. If you are not logged in, you will enter your username or email address (WordPress recognized both) and password.
   
2. Navigate to Add New User Page – From the Dashboard, you find the Users tab on the left menu bar. You can either click or hover over that option and then click Add New.
3. Enter Their Details – Next you will want to enter some details for the account
   
   • Username – You need to provide a username, this can be anything you want, but to keep it simple, we recommend either their first and last name with no capitalized letters and no spaces. Or to use their email address. This is a required field.
   • Email – You will need to enter an email address. We recommend using their email so they can recover their password easily. This is a required field.
   • First Name & Last Name – We like including the name fields so everything is personalized for that user, but this is not required and they will be able to enter this information themselves when they log in.
   • Website – If the new user is writing content for you as a website contributor, then you may want to include their website if your WordPress site uses the author’s website field in a bio description.
   • Password – If you want to send the password manually to the user, you can click the Show Password button and copy the password. You can also change the password to something different by just replacing the auto-generated one with whatever strong password you would like.
   • Send User Notification – Leaving the send user notification checked will trigger an email to the email address you entered. They can then create/change their password and access the site. If the user didn’t receive the email. It’s important to note that email sending capabilities are not a default feature of WordPress, so this may need setup to successfully send the email. If this is the case, you also won’t be able to reset passwords through email, because WordPress has no way to send them. Instead, just copy the password and send that with the username to the user and get your email setup!
   • Role – Assigning a role to the user will determine what the user has access to do. These are just the default Roles.
     • Subscriber – This creates an account where the user can log in, but not edit or view anything other than there own comments. It’s pretty worthless on its own unless you intend to extend it with customization. Examples of usage with customization include member-only content, forums, social platforms, and returning customers for e-commerce
     • Contributor – This role is good for one-off guest authors. They can view their posts and edit their posts, but they cannot publish them or even add media files. They cannot edit other people’s posts or pages.
     • Author – An author is a great role for regular contributors to your blog. They can create, publish, and edit their own posts, but they cannot do the same for other authors. They cannot edit pages.
     • Editor – An editor is good for a site manager who isn’t super tech-savvy. Some agencies actually give business owners this access level just so they won’t mess up their own website! They can view, edit, publish all pages and posts. They do not have access to administrative settings like Plugins, Themes, and Settings that if messed with could break your website. They also cannot create or delete users.
     • Admin – An admin is only for people you really trust or are experienced. This is the same access level as the site owner (unless you have a multisite setup). They can edit anything. Agencies and Developers need this access level because all their changes are usually related to more administrated controls.
     • Super Admin – If you have a multisite setup, you will have the Super Admin option. Otherwise, Admin is as high as you can go. A Super Admin has Admin access to all the websites on the multi-site install while an Admin has access to just one. An admin cannot remove a Super Admin user.
     • Other Roles – If these default roles are not enough, there is hope. Plugins like User Role Editor allow you to create and edit Roles. This can be helpful for giving more granular access to various people.
4. Submit – Click Add New User to create the account. If you want to manually email the new user their login credentials, then paste the password and username in an email and send it to them. If you do this, we do recommend they change their password immediately, for security reasons.

Why we don’t recommend sending your personal username and password

Although you can just as easily send the user your personal login credentials to your website. It really should just be a last resort. Here is why:

Too much access: By giving the individual your personal login information, they can essentially do what they want to your website and even create their own admin account and deleting yours so you can’t log in to your website. Now if you give someone Admin access to your website they can technically do the same thing, but you can select various user roles when creating a new account limit their access and prevent them from doing that.

Unsecure Transfer of Sensitive Information: Sending your login information via email just isn’t secure. If someone gains access to your email account or theirs or intercepts the transmission the credentials are not encrypted or password-protected to limit this vulnerability. If you need to send information like this over email, we recommend resetting your password before and after the user has created their own account or is finished with what they needed to do.

Changes to Your Password: At some point, you will need to change the password for your account or the other person will. When that happens, one of you will be locked out until the new password is shared again. This can be a big hassle and an unnecessary barrier if you are needing urgent help.

What if I am locked out of my account?

If you are locked out of your account and the forgot password email isn’t working. Even if someone went rouge and removed you as an Admin user to your own website, there is still hope.

You can get around this by accessing the database for the website and adding a user there.

This is more than we want to cover in this article, but if you find yourself in this situation, this guide should help: Add a WordPress Admin User with PHPMyAdmin.