Contractor Website Access: What to Close After the Job

A paid invoice does not close contractor website access. The seats, keys, and shared inboxes used to build the site stay live until you remove the person or change the secret. July 2022 guidance from the Canadian Centre for Cyber Security says accounts should be disabled when contractors leave, and the UK National Cyber Security Centre says access should come off when the job is done. [1][2] Close those paths without deleting the owner logins you still need, and keep a short record of what you changed.

Acceptance is not the same as a closed login

Accepting the work means the pages and forms are done. It does not mean the builder's access expired. Hosting panels, content logins, analytics seats, ad accounts, and form inboxes keep trusting the user, password, or key created during the job.

Who owns the domain, the DNS zone, the files, and the media is a separate question. Closeout is who can still sign in. You can pay the hosting bill and still share a password with a former contractor.

Guidance from the Canadian Centre for Cyber Security that took effect on July 19, 2022, says to disable accounts when employees or contractors leave, and to review privileges held by a cloud or managed provider. It also says to keep control of your own credentials when IT work is outsourced, and to remove special access when someone no longer needs it. [1] November 2025 guidance from the National Cyber Security Centre says people should have only the access the job requires, and that access should be removed when the job is completed. Administrator accounts go only to people who need them, provider access stays at least privilege, and 2-step verification should be on. Its checklist also asks whether the contract covers obsolete accounts. [2]

Write the list before you revoke anything

Start with a page, not a password reset. Ask the contractor where they can still sign in, then check that list against invoices, welcome emails, and the settings you can open yourself. Their list is a lead, not the audit.

• Hosting panel users, FTP or SFTP accounts, and SSH or deploy keys.
• Site administrators, editors, and any application password the site issued.
• Registrar and DNS logins. If theirs is the only one, get an owner login in your name before you cut them off.
• Analytics, search-performance tools, tag managers, and ad accounts.
• The address that receives form submissions, plus shared inboxes and forwarding that still point at the contractor.
• Social profiles or schedulers used for the launch.
• Repository access, and keys for maps, spam checks, email delivery, booking, or payment webhooks.
• Shared vault items, and any email or spreadsheet where a password was pasted.

The NCSC's small-organisation guide, published in April 2026 and reviewed in July 2026, says accounts for staff, suppliers, or contractors often stay active after the person leaves, across email, cloud storage, social media, and finance tools. Remove or disable accounts you no longer use. The same guide lists the company website, and domain hosting when that is a separate account, among the logins worth securing, and it says to review who has access every few months. [3]

Removing a name from a user list does nothing to a password they still know. A key copied into a settings file keeps working after the person is gone. The list has to include secrets, not only names.

Remove named seats first

Prefer a login that belongs to one person. The July 2022 Canadian guidance says unique, identifiable accounts should be tied to individual users, and that each privileged account should have its own password or passphrase. [1] A named seat can be turned off without changing the password you use. A shared admin login cannot.

Confirm you are an owner or administrator, sign in from a browser that is not their session, then remove their user. Leave the billing contact and the recovery address on an inbox you open.

Google Analytics shows the lockout risk. A user added at the account level also has access to every property in that account, so check the account, not only one property. Deleting users at the account level requires the Administrator role, and the last person with that role cannot delete themselves. [7] Make your own email an Administrator before you remove the contractor.

Search Console is stricter. Only a property owner can add or remove users, and the property must keep at least one verified owner or users lose access. A verified owner proved control with a token, such as an HTML file, an HTML tag, or a DNS record. Removing the person does not delete that token, so they can verify again and come back. If every verified owner is removed, remaining users lose access after a grace period. [8] Verify yourself first, remove the contractor, then remove their token and leave yours. Google warns the same token can be reused by other Google services, so check before you delete a DNS record or tag you still need. [8]

Use the same check on the host, the content system, the ad account, the email host, and the repository, and open the user list yourself. Scheduled audits are one way to spot administrator rights that are no longer needed. [2]

If they will still help for a defined window, add a named user with the smallest role, require 2-step verification, and write an end date. Access should come off when the job is completed, and a provider should get only the permissions the work needs. [2]

Rotate shared passwords, keys, and form inboxes

Registrars, older hosting plans, a single social profile, and the mailbox info@ often have one login. NCSC password guidance, reviewed on November 19, 2018, says sharing a work account makes it harder to know which person did what, and that delegation to a named account is better when the product allows it. If a shared password has to stay and someone may no longer use it, change the password. [4]

NIST said the same thing in September 2020. Special Publication 800-53 Revision 5, control AC-2, tells organizations to change shared or group authenticators when someone leaves the group, so former members do not keep access. The same control treats transfer or termination as a reason to disable accounts. [5] The February 2024 NIST Cybersecurity Framework 2.0 examples say to review access when someone leaves and promptly take back privileges that are no longer needed. [6]

Change the shared password only after you can sign in, recovery mail reaches you, and the new password is in a manager you control. Do not send it back in the contractor's email thread. [4]

For a key, create the replacement, put it on the site, test the form, map, or checkout, then revoke the old one. Replace any copy sitting in a file or note. If form mail still goes to the contractor, point it at a mailbox you read, send a test, and remove them from a build-only inbox or forward. If customers already use that mailbox, keep it and drop their membership, or change the password. [4] The April 2026 NCSC guide says not to reuse passwords on business-critical accounts. [3] Remove their public key from the host or repository only after you can still publish a change.

What to keep, and the record

Keep an owner or administrator seat on the registrar, DNS, hosting, the content system, analytics, Search Console, and any ad account tied to the site. Keep billing and recovery on an address you open. A reset message that still goes to the contractor is access you did not close. Keep a second owner where the tool allows it. With no verified Search Console owner, users lose the property. [8] Analytics protects you only if you are the last Administrator, because that person cannot delete themselves. [7]

Keep notes a future helper can use: where the site is hosted, which email is the owner, and where the secrets live. Do not keep the old build login "just in case." The NCSC tells small organisations to look again every few months, and to keep 2-step verification on while any provider access remains. [2][3]

Write one row per system the same day: the system, the account email, what you did (removed, lowered, rotated, or left until a date), the date you looked, where the new secret is stored, and who still has access and why. Do not put the password in the row. The July 2022 Canadian guidance says to log when an administrative account is added or removed, and to review provider access against what the business still needs. [1] Store the record where another owner can find it, not only in a thread the contractor still receives.

An order that does not lock you out

Sign in, and confirm recovery mail reaches you, before you remove anyone. Verify your own Search Console token before you remove theirs. [8] Hold the Analytics Administrator role before you delete users. [7] Point form mail at your inbox and test it. Create a replacement key, switch the site, test, then revoke the old key. Change shared passwords only after the new one is in your manager. [4][5]

If a screen will not let you in, stop and get an owner login in your name first. If the contractor is the only person who can reset the registrar, you have a lockout, not a closeout. The July 2022 guidance says to retain control of your credentials even when the work is outsourced. [1] Use the admin tools on services you pay for. If a login is gone, use the host or registrar recovery process rather than leaving the old access in place.

Practical takeaways

• Close contractor website access on the day you accept the work. Do not keep the build logins as a spare set of keys.
• Remove named users only after your own owner seat works. On Analytics, be an Administrator and do not remove the last one. On Search Console, verify yourself, then remove their user and their token.
• Rotate shared passwords and keys only after the replacement is saved and the live form or checkout still works. Point form mail and recovery messages at an inbox you read.
• If they stay for a defined task, use a named seat with an end date and 2-step verification, and review the written record within a few months.

How we can help

Have more questions or want to get in touch? Our team can talk through which seats, keys, and inboxes to close when a contractor finishes, and which owner logins are worth keeping so you can still get help. Reach us on the contact page.

Citations

1. Canadian Centre for Cyber Security, "Top 10 IT security actions: No. 3 managing and controlling administrative privileges (ITSM.10.094)" (2022-07-19)
2. National Cyber Security Centre, "Choosing a managed service provider (MSP)" (2025-11-24)
3. National Cyber Security Centre, "Small organisations guide to cyber security: Secure your important online accounts" (2026-04-09)
4. National Cyber Security Centre, "Password policy: updating your approach" (2018-11-19)
5. National Institute of Standards and Technology, "Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5)" (2020-09)
6. National Institute of Standards and Technology, "NIST CSF 2.0 Implementation Examples" (2024-02-26)
7. Google Analytics Help, "Add, edit, and delete Analytics users and user groups" (n.d.)
8. Google Search Console Help, "Managing owners, users, and permissions" (n.d.)