A web studio's access to the site: convenient for them and for whoever comes next
A contractor with a permanent admin account is a common audit finding. Revoking access on the day the work ends matters more than arguing the contract afterwards.
A studio built the site, a freelancer finished the store, a friend runs the ads. Each kept a sign-in: the CMS, the host, analytics, sometimes the domain registrar. While the relationship is good, it looks like service. On the day of a quarrel, a breach of their mail or a studio employee leaving, it is your incident. You may not even know the full list.
A normal contractor access
- A separate account for the term of the work, not a shared admin and not the owner's personal mail.
- Rights for the task. Laying out a landing does not mean owning the domain.
- Revocation on the delivery day, including host keys and ad access.
- A contract that says passwords are not forwarded in a messenger.
Taking the site "back" after the fact is painful if the domain is registered to the studio. That is worth checking before a conflict. The contractor will still have a copy of the files: the point is that after revocation the old password no longer opens anything, and the sessions were ended.
In a basic audit Lexora builds exactly this list: who can enter the site, hosting, mail and the registrar. It is free for new clients. If the studio is still working with you, we do not throw them out of the project. We separate their access from yours, so someone else's mailbox does not become the key to the store. When the site is under our maintenance, contractor accounts live for the term of the task, not "until better times".
Related Lexora services
Do not remember who else is an admin?
We will collect the list across the site, the host and the domain. The basic audit is free for new clients.