Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The safest way to give a client or contractor WordPress access is to create one named account for that person, assign only the role and capabilities required for the agreed work, protect the account with a unique password of at least 20 characters and multi-factor authentication, and avoid sharing administrator credentials. Give scripts and integrations separate, revocable Application Passwords rather than human logins. Keep a written access register, review it on a defined schedule, and remove every account, token, and hosting credential when the work ends.
This approach preserves accountability without making ordinary content work a site-wide security risk.
Start with the access boundary, not the username
Before opening WordPress, write down exactly what the person must do. “Manage the site” is too broad to be a safe permission request. Separate content work from administration and from infrastructure work.
- Review or comment on drafts.
- Write and edit their own posts.
- Publish their own posts.
- Edit or publish posts written by other users.
- Upload and manage media.
- Manage users or change account permissions.
- Install or configure plugins and themes.
- Change site settings.
- Deploy code, run reports, or connect an external service.
- Access hosting, SSH, SFTP, databases, or production files.
Turn the answer into an access boundary before creating an account. A client reviewing copy needs neither publishing authority nor an administrator account. A developer changing a plugin may need a temporary elevated role, but that does not make a permanent administrator login appropriate. Server access is a separate boundary and should not be implied by a WordPress role.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the narrowest WordPress role that fits
WordPress roles are bundles of capabilities, not job titles. Select the bundle that matches the task and check whether an installed extension adds capabilities that change the practical scope. The standard role descriptions are:
| Role | What it permits | Good fit | What it should not be used for |
|---|---|---|---|
| Administrator | All administration features for one site | A tightly controlled site owner or emergency administrator | Routine client, editorial, or contractor work |
| Editor | Manage posts by other users | A content lead who must review, edit, or publish other authors’ work | A writer who only handles their own posts |
| Author | Publish and manage the user’s own posts | A client or writer responsible for their own published content | Managing another author’s posts or site configuration |
| Contributor | Write posts but cannot publish them | A contributor whose work requires editorial approval | Independent publishing or media administration unless separately required |
| Subscriber | Manage only the user’s profile | A person who needs an account to maintain profile details | Any editing, publishing, or administration task |
Use the lowest role that completes the work. If a task crosses role boundaries, document the specific capability that is missing instead of defaulting to Administrator. In some cases, a temporary elevation during a supervised maintenance window is safer than leaving broad rights in place indefinitely.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Examples of practical role decisions
- Draft reviewer: Subscriber may be enough if the review happens outside WordPress. If the person must edit content in WordPress, choose the least editorial role that supports the review workflow.
- Independent publisher: Author is appropriate when the user publishes and manages only their own posts.
- Editorial manager: Editor fits when the user must manage posts created by other users.
- Unapproved writer: Contributor allows writing while preserving an approval gate before publication.
- Site maintenance: Do not treat Administrator as a default maintenance role. Define the plugin, theme, settings, or deployment task and grant access only for the period and environment where it is needed.
Create an individual account for every person
In the WordPress dashboard, use Users > Add New to create a separate account for each client, employee, and contractor. Use a recognizable username or email identity, record the business reason, and assign the approved role at creation time. Never pass around a shared administrator login.
Individual identities make activity attributable. When one account is used by three people, a log entry cannot tell you who changed a page, installed an extension, or altered a user. A named account also lets you disable one person without disrupting everyone else.
Keep an emergency administrator separate
Maintain an emergency administrator account for recovery, but do not use it for everyday editing. Protect it with a unique generated password, store that password in an approved password manager, require strong multi-factor authentication, and monitor its use. Keep the number of administrators small. WordPress brute-force guidance specifically recommends two-factor authentication for all administrators, limiting the number of administrators, and applying least privilege.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not confuse a role with hosting access
A WordPress account does not automatically govern your hosting control panel, SSH, SFTP, database, deployment system, or domain registrar. Treat each of those as another credential with its own owner, purpose, expiry, and review. Give infrastructure access only when the task requires it, prefer a named account over a shared one, and remove it alongside the WordPress account when the engagement ends.
Protect every human login
Use a unique password of at least 20 characters
WordPress password guidance recommends a unique credential of at least 20 characters, generated and stored with a password manager. Do not reuse the client’s email, hosting, or personal password. Do not send a password in a shared chat or place it in a project ticket that many people can read.
The password manager should let the user retrieve the credential without learning a pattern that is reused elsewhere. If a credential is exposed, reset it immediately and investigate where it was used. The WordPress Security Team summarizes the risk plainly: “The weakest link in the security of anything you do online is your password.”
Add multi-factor authentication, prioritizing privileged accounts
Require multi-factor authentication for every administrator and other privileged account. Extend the requirement to client and contractor accounts when the account can publish, manage other users, alter settings, or install code. A second factor limits the damage from a stolen password, but it does not make an over-permissioned account safe; role scope still matters.
Where the user and the site’s authentication setup support it, prefer a FIDO2/WebAuthn security key. The WordPress MFA tutorial describes security keys as a phishing-resistant factor and states that “security keys aren’t vulnerable to phishing attacks.” A time-based one-time password is preferable to password-only access when a security key cannot be used.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make recovery deliberate
Document who controls the recovery method for each privileged account and how a locked-out user can be verified. Recovery details should not silently point to a former agency employee or a shared mailbox. Test the emergency recovery path during a planned review, not for the first time during an incident.
Use Application Passwords for software, not people
A deployment script, reporting tool, mobile client, or other integration should not borrow a person’s browser password. Create a dedicated integration identity and issue a descriptive WordPress Application Password for that purpose.
Application Passwords are per-application API credentials. WordPress shows a generated value once, and each value can be revoked independently. They are intended for programmatic access rather than signing in to wp-admin through a browser. Send them only over HTTPS and store them server-side, such as in the deployment system’s secret store rather than source code or a ticket.
| Access type | Identity | Authentication | Lifecycle control |
|---|---|---|---|
| Human editorial work | Named person | Unique 20-character-or-longer password plus MFA | Review role, activity, and employment or contract status; disable when work ends |
| Automated integration | Dedicated machine or integration user | Descriptive Application Password over HTTPS | Record purpose and last-use information; revoke the individual token when retired or suspected compromised |
| Emergency recovery | Separate monitored administrator account | Strong unique credential plus MFA, preferably a phishing-resistant key | Restrict use, monitor it, and test recovery procedures |
Label and monitor each token
Name an Application Password after its function, not after a person who may leave. Record the system that stores it, the owner, the approved scope, the creation date, and the last-use metadata available to you. A reporting integration and a deployment integration should have separate tokens so one can be revoked without interrupting the other.
Revoke instead of rotating everything
When an integration is retired, revoke its Application Password. Revoke it immediately if the token may have been exposed. Individual revocation keeps the change targeted and avoids leaving an abandoned credential active simply because replacing every integration would be inconvenient.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep production changes controlled
Access governance fails if a legitimate account can make an unreviewed production change with no way back. WordPress identifies keeping core, plugins, and themes up to date as the most important security step and recommends actively maintained extensions. Put that maintenance inside a repeatable process.
- Record the change: State what will change, who requested it, who approved it, and which site and environment are affected.
- Back up before high-impact work: Create a restorable backup before changing plugins, themes, settings, or code. Confirm that the backup can actually be retrieved.
- Use staging when available: Test a plugin, theme, configuration, or deployment in a staging environment before production. Keep staging credentials and data access separate from production.
- Limit the maintenance window: Grant elevated rights only for the agreed task and period. Remove the elevation when the work is verified.
- Verify and record the result: Check the site’s critical paths, note the final version or configuration, and retain the approval and rollback information.
Backups are not a substitute for least privilege, and least privilege is not a substitute for backups. A narrow account reduces the chance and scope of an unauthorized change; a tested backup gives you a recovery option when prevention fails.
Maintain an access register
Keep one authoritative register for WordPress, hosting, deployment, and integration access. It can be a protected document or an access-management system, but it must be current enough to answer who can enter the site and why.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Field | What to record |
|---|---|
| Identity | Person, team, or integration name; account username or token label |
| Scope | Site, environment, hosting system, repository, or other resource |
| Role or capability | WordPress role and any approved task-specific elevation |
| Business reason | The work that requires this access |
| Authentication | Password-manager ownership, MFA method, or Application Password location; never store the secret itself in the register |
| Dates | Start date, last review, planned end date, and actual removal date |
| Owner and approver | The person responsible for the account and the person who authorized it |
| Activity and recovery | Last-use information where available, relevant logs, backup location, and rollback contact |
Review the register on a defined recurring schedule and after any role, staffing, vendor, or project change. Privileged accounts deserve the most frequent scrutiny. Compare the register with the actual WordPress user list, Application Passwords, hosting accounts, and deployment secrets; an accurate spreadsheet that is never reconciled is not an access control.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Offboard clients and contractors completely
Set the end date when access is granted so removal is a normal workflow rather than an emergency reminder. When the work ends, follow this sequence:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Confirm the termination: Identify the person, projects, sites, and exact time access should end.
- Disable or delete the WordPress user: Preserve content ownership and records according to your site policy, but do not leave an unused login active.
- Revoke Application Passwords: Revoke every token belonging to the person or integration, including tokens that appear unused.
- Remove adjacent access: Delete or disable hosting-panel, SSH, SFTP, database, repository, deployment, monitoring, and domain access that was granted for the engagement.
- Rotate shared secrets: Change any credential that cannot be individually revoked, such as an old shared recovery or deployment secret.
- Check active sessions and logs: Look for unexpected activity around the cutoff and retain the relevant logs.
- Update the register: Record the removal date, approver, resources checked, and any follow-up investigation.
If the person is leaving under suspicious circumstances, do not wait for the planned end date. Disable the account, revoke tokens, remove infrastructure access, rotate non-revocable secrets, and review recent changes first. Preserve backups and logs before cleaning up evidence.
Respond to a suspected compromise
When a credential may have been stolen, treat it as active until revoked. Use a focused response rather than changing unrelated accounts blindly.
- Disable the affected human account or integration identity.
- Revoke its Application Passwords and reset its password through a trusted administrator.
- Remove unauthorized sessions or other access paths your authentication system exposes.
- Review WordPress users, roles, plugins, themes, settings, and recent content changes for modifications the owner did not approve.
- Check hosting, SSH, SFTP, database, repository, and deployment logs because a WordPress login may not be the only compromised path.
- Restore from a known-good backup only after identifying the change and preserving evidence; otherwise the unwanted access may return.
- Reissue credentials using named accounts, least privilege, and MFA, then document the incident and corrective action.
Do not “fix” a suspected breach by sharing one new administrator password with the entire team. That removes accountability and recreates the original weakness.
Use a decision framework for common client requests
| Client request | First question | Safer access pattern | Review trigger |
|---|---|---|---|
| “I only need to see drafts.” | Must the person edit inside WordPress? | Use the minimum editorial capability, or keep review outside the dashboard if editing is unnecessary. | When the review project ends or the person begins publishing |
| “I will publish my own articles.” | Will the person manage anyone else’s posts? | Author is the starting point when publication is limited to their own posts. | When responsibility expands to other authors or site settings |
| “I run the editorial calendar.” | Must the person manage posts written by others? | Editor may fit; do not add administrator rights merely for editorial work. | When the editorial role or staffing changes |
| “I need to install a plugin.” | Is the change tested and approved, and can it be done in staging? | Use a controlled maintenance window, backup, staging, and temporary elevation rather than a permanent shared administrator login. | After the plugin is verified and the maintenance window closes |
| “Connect our reporting tool.” | Does the tool need API access rather than dashboard access? | Create a dedicated integration identity and descriptive Application Password over HTTPS. | When the tool changes, is retired, or shows suspicious use |
| “Give our developer server access.” | Which exact host, files, and deployment action are required? | Create named, task-specific infrastructure access; keep it separate from the WordPress role and production access. | At deployment completion, contract end, or environment change |
Administrator checklist
- Every person has a named account; no shared administrator login is in circulation.
- The role is the minimum bundle that supports the documented task.
- Administrators and other privileged users have MFA; a FIDO2 security key is preferred where supported.
- Passwords are unique, generated, at least 20 characters, and stored in a password manager.
- Integrations use dedicated, individually revocable Application Passwords over HTTPS.
- Core, plugins, and themes are kept current, with actively maintained extensions selected.
- High-impact changes have approval, a restorable backup, staging or another controlled workflow, and rollback information.
- The access register records purpose, scope, owner, review date, and planned end date.
- Offboarding removes WordPress, hosting, SSH/SFTP, deployment, and token access, and rotates shared secrets that cannot be revoked individually.
- Backups and logs remain available after a user is removed.
Bottom line for agencies and site owners
Client access is safest when it is treated as a lifecycle, not a one-time invitation: define the work, create a named identity, assign the smallest capability bundle, require strong authentication, separate machines from people, control production changes, and remove access promptly. This gives the client a workable path to do their job while keeping the site’s administrative and recovery powers under deliberate control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
