Someone’s leaving. Maybe a staff member, maybe a web developer you’ve stopped working with, maybe an agency. HR has a checklist for the laptop and the building key. Almost nobody has one for the website.
So their admin login stays active. Their personal phone is still the two-factor device on the domain registrar. Their API token is still in a server somewhere. Nothing bad happens, usually. But “usually” isn’t a security plan, and the risk isn’t only bad intentions: an old account with a reused password is exactly what attackers look for.
Here’s the checklist I use.
Before they go
1. Find out what they have access to. Ask them. Seriously: most people will happily list it. Then check it against your own list of the accounts that can take your business offline.
2. Hand over anything only they hold. If they’re the only admin on something, add a second admin before removing them, not after. Recovery from “the only admin left” ranges from annoying to impossible.
3. Find the things that run in their name. Scripts, scheduled jobs, integrations and API tokens created under their personal login will stop working when their account goes. Move them to account-owned tokens or a service account first. (See Stop using your Cloudflare Global API Key.)
On the day
Work through each of these. Remove their access, or for shared logins, change the password.
| Where | What to remove or change |
|---|---|
| Domain registrar | Their login, and their phone or email as the two-factor or recovery method |
| Cloudflare | Their account membership, API tokens they created, Zero Trust / Access policies that name their email |
| Hosting and servers | Control panel login, SSH keys, FTP/SFTP accounts, database users |
| Website (WordPress etc.) | Their admin account (reassign their posts to someone else), application passwords |
| Email admin | Admin roles in Microsoft 365 / Google Workspace; forwarding rules on their mailbox |
| Trusted IP Lists | Their home IP address, if you added it so they could reach the admin area |
| Shared passwords | Anything in a shared vault they could see: change it |
| Everything else | Analytics, Search Console, ad accounts, social media, the newsletter tool, the payment gateway |
The trusted IP List one gets missed a lot. If you followed my advice in How to use Lists in Cloudflare and put a contractor’s home address on trusted_ips, that address can still reach your login page until you take it off. A good comment on each entry (“Jo’s home, added 2026-05”) makes this a two-minute job.
After they’ve gone
- Check the Audit Log in Cloudflare (and anything else that has one) for changes made in their last few weeks. Not because you suspect them, but because rushed handovers leave half-finished changes behind.
- Test the important things: the website loads, forms arrive, email flows, backups ran last night.
- Update your one-page list of who has access to what.
For agencies and developers
If you’re ending a relationship with a web agency, there are a few extra questions:
- Who owns the domain? It should be registered to your business, in an account you control. If the agency registered it in their own account, get it transferred before anything else.
- Who owns the Cloudflare account and the hosting? Same answer. If they’re in the agency’s account, you’ll need to move them.
- Where are the backups? Make sure you have a recent copy, stored somewhere you control, that you can restore without them.
- Which licences are in their name? Premium plugins and themes often are. You’ll need your own.
Make it routine
Put this checklist where HR’s leaving checklist lives, and give one person the job of working through it. Do a smaller version twice a year even when nobody’s left: list everyone with access to each account and ask, “does this person still need this?”
Want help working out who has access to what? Get in touch.
