Employee offboarding checklist: the website access to revoke when someone leaves
Digital offboarding means removing, in the right order, every access a departing person had: employee, freelancer, intern or agency. It is one of the simplest ways to protect your website and your customer data, and one of the most often skipped.
This guide gives you an IT offboarding checklist for websites: the order of operations when an employee or contractor leaves, the access to revoke within 24 hours (domain, hosting, CMS, email, marketing tools, code, payments), the mistakes that cost content or data, and how to organize access so the next departure takes an hour instead of a week. An interactive checklist tracks your progress.
At a glance
- Digital offboarding removes every access a departing person had, whether they are an employee, a freelancer or an agency.
- In a 2026 US survey, 79% of former employees said at least one work account or access point still worked after their last day.
- Order matters: email and password manager first, then domain and hosting, CMS, marketing tools, code, API keys and payments.
- Downgrade or suspend accounts instead of deleting them, so you lose neither published content nor history.
- An up-to-date access inventory and a team password manager turn a departure into a task of a few minutes.
What is digital offboarding?
Digital offboarding is the set of actions that removes a departing person’s rights to your company’s tools: accounts, shared passwords, access keys, devices and integrations created in their name. It mirrors onboarding: whatever was opened on day one has to be closed at the end, not much earlier and not much later.
The term comes from HR, where offboarding covers the whole exit process (exit interview, paperwork, handover). This guide covers the technical and web side, the part that protects your site, your customer data and your ad budgets.
It applies to every departure, not just terminations: a resignation, the end of a freelance contract, a switch to a new web agency, the end of an internship, a retirement. The riskiest cases are often the friendliest, because nobody thinks to check.
Why access so often stays open
The problem is widespread. In a 2026 survey of more than 1,000 US adults who had left a job, run by the IT and cybersecurity provider Sagiss, 79% of former employees said at least one work account or access point kept working after their last day. Email was the most common loose end: a third could still log in.
Contractors are the most exposed. Among people whose contract or temporary role ended, 89% still had some access and 79% could still reach sensitive company information. Collecting equipment is not enough either: 82% of former employees whose laptop was taken back still had at least one working account.
Three reasons explain the gap:
- Nobody owns it. HR handles the contract, IT handles a few accounts, marketing handles its own tools. For a third of the people surveyed, it was unclear who was responsible for their offboarding.
- Nobody has the list. SaaS tools pile up without an inventory: a Canva seat here, Search Console access there, an API key created late one night.
- The website runs on personal accounts. A domain registered by the contractor, Google Analytics owned by a former employee’s address, automations built on an individual account: close the account and the site breaks.
The consequences range from wasted money (licenses paid for ghost accounts) to real damage: ad budget spent without control, customer data viewed, a defaced site or a lost domain. Most of the time it is not malice, just a mistake made from an account that should no longer exist.
The legal side of access left open
Open access is also a compliance risk. Customer personal data must be protected with appropriate security measures under state privacy laws such as the CCPA/CPRA in California, PIPEDA in Canada and the UK GDPR in the United Kingdom. A former team member who can still browse your CRM is a potential data breach, and some breaches have to be reported.
The former employee who logs in without permission also takes a risk: unauthorized access to a computer system is a crime in most jurisdictions, including under the US Computer Fraud and Abuse Act. That does not shift your responsibility for securing the data, though. Closing access on time keeps you from getting there.
The order of operations when an employee or contractor leaves
Under pressure, especially after an unexpected exit, the temptation is to cut everything at once and risk breaking production or deleting useful data. The order below closes first the access that would let someone regain control of everything else.
The logic is simple: email and the password manager are master keys. As long as they stay open, the “forgot password” link of any tool can bring back access you thought you had closed.
Our advice: schedule the shutdown for the end of the last working day, with the manager’s agreement. For a contentious departure, cut critical access at the moment of the announcement.
The IT offboarding checklist: web access to revoke within 24 hours
The table below lists the access to check, where to find it and what to do. Adapt it to your tools; the key is not to miss a whole family.
| Access | Where to find it | Action | Trap to avoid |
|---|---|---|---|
| Domain name | Registrar (GoDaddy, Namecheap, Cloudflare…) | Check the registrant, change the password, turn on 2FA | Domain registered in the contractor’s name |
| DNS and CDN | Cloudflare, host DNS zone | Remove the member, review recent changes | Traffic or email quietly redirected |
| Hosting | cPanel, Plesk, FTP, SSH | Delete FTP accounts and SSH keys, change passwords | SSH key left in authorized_keys |
| Google Workspace, Microsoft 365 | Suspend, forward, transfer files | Deletion that wipes shared documents | |
| CMS | WordPress, Shopify, BigCommerce | Downgrade, change the email, end sessions | Deleting an author without reassigning content |
| Analytics and Search Console | Property user management | Remove access, check the owner | Property owned by a personal address |
| Ad platforms | Google Ads, Meta, LinkedIn, Microsoft Ads | Remove the user and unneeded partners | Campaigns billed to your card |
| Source code | GitHub, GitLab, Bitbucket | Remove from the organization, revoke tokens | Personal token still used by a script |
| API keys and automations | Zapier, Make, n8n, email and SMS services | Recreate keys from a company account | Forms or follow-ups that stop |
| Payments | Stripe, PayPal, Square | Remove the member, review sign-ins | Access to refunds and payouts |
The following sections cover the points that need the most care.
Domain name, DNS and hosting
Your domain is your most valuable online asset: whoever controls it controls your website and your email. Check at your registrar (GoDaddy, Namecheap, Cloudflare Registrar, Squarespace Domains…) that the registrant is your company, not the contractor or a former employee in their own name. Change the account password, turn on two-factor authentication and check the recovery email.
On the hosting side, remove access to the control panel (cPanel, Plesk), FTP and SFTP accounts, and delete any SSH keys the person added to the authorized_keys file. If your DNS runs through a service such as Cloudflare, remove them from the account members: DNS access is enough to redirect your traffic or your email.
To know exactly what belongs to you, read our guide to website ownership.
Email and team accounts
Do not delete the departing person’s work address right away. Suspend sign-in, change the password, sign out all devices and set up forwarding or an auto-reply to a colleague for a few months, so you lose neither customer requests nor supplier invoices.
In Google Workspace or Microsoft 365, transfer ownership of shared files before deleting the account, or the documents go with it. Also review the third-party apps the person authorized with their account (“Sign in with Google” to Trello, Canva, Slack…) and revoke them.
WordPress and other CMSs
The golden rule: never delete an author account without reassigning its content. In WordPress, deleting a user offers to attribute their posts and pages to another account; skipping that step deletes their content, along with the traffic it brought.
The safest method is to downgrade the account to Subscriber, change its email and password, sign it out of all sessions and delete its application passwords. The same logic applies to Shopify (staff accounts), BigCommerce or Drupal (roles). While you are there, check that no unknown admin account has been created.
Not sure who still has access to your website? Explore our website security services
Google Analytics, Search Console and ad platforms
In Google Analytics 4 and Search Console, remove the user and, above all, check who owns the property. It should belong to a company account (a shared address such as web@your-company), never to a contractor’s personal address.
For Google Ads, Meta Business Suite, LinkedIn Ads or Microsoft Advertising, the risk is financial: forgotten access can launch campaigns billed to your card. Remove the user, review the partners (agencies) linked to your ad accounts and check the saved payment methods.
Source code, API keys and automations
Remove the person from your GitHub, GitLab or Bitbucket organization, and revoke their personal access tokens and deploy keys. Automation tools (Zapier, Make, n8n) and email or SMS services often run on API keys created from an individual’s account: close that account carelessly and your forms or follow-ups stop. Create new keys from a company account first, swap them into your tools, then revoke the old ones.
Payments and customer data
In Stripe, PayPal, Square or your payment provider, remove the user from the team and review recent sign-ins. Do the same in your CRM, your email marketing tool and your store back office, which all hold customer personal data.
Interactive offboarding checklist
Check off each item as you go. The tool shows your progress and the critical items still open. Nothing is saved: the list resets when you reload the page.
The timeline of a good offboarding
Good offboarding starts before the last day and ends a few weeks after. Here is how the tasks spread out.
Prepare
List the person’s access, decide who takes over each tool, plan the handover and collect transfer codes.
Close the essentials
Email, passwords, domain, hosting, CMS, ad platforms and payments, at the end of the day.
Finish
Code, API keys, automations, secondary tools, SaaS seats, shared passwords.
Verify
Review sign-in logs, delete suspended accounts, update the inventory.
Common offboarding mistakes
- Keeping shared passwords. Removing the person’s account is pointless if they know the password to the shared inbox, the Wi-Fi or the company Instagram. Every shared password they knew must change.
- Forgetting two-factor authentication. If the login code for a company account goes to the former team member’s personal phone, they keep control. Re-enroll two-factor on a company device or app.
- Deleting instead of suspending. An inbox or CMS account deleted too early loses messages, files or published content.
- Paying for ghost licenses. Every forgotten SaaS seat keeps billing you every month.
- Forgetting the agency. When you change web agencies, several people and several technical accounts usually need to go, including shared “agency” logins.
- Not checking afterwards. A month later, a quick review of sign-in logs catches forgotten access.
Manual vs centralized access management
Offboarding gets much easier when access is centralized. The table compares both approaches.
| Criterion | Manual management | Centralized (SSO, password manager) |
|---|---|---|
| Time per departure | Hours to days | Minutes for the essentials |
| Risk of forgetting something | High, especially small SaaS tools | Low for connected tools |
| Traceability | Low: hard to know who had access to what | Access and sign-in logs |
| Shared passwords | Changed one by one | Shared vaults, easier rotation |
| Cost | Free but time-consuming | Subscription and initial setup |
For a small business, a team password manager (1Password, Bitwarden, Dashlane, Keeper…) is the most cost-effective first step: everyone gets the credentials they need, and rights are removed in one click. Single sign-on (SSO) through Google Workspace or Microsoft Entra ID comes next, as the number of tools and people grows.
Prepare for the next departure today
The best time to prepare for a departure is when nobody is leaving. Four habits are enough:
- An access inventory. A simple spreadsheet listing each tool, its owner in the company, who has access and at what level.
- Accounts in the company’s name. Domain, hosting, Analytics, ad accounts and payments tied to shared company addresses, never personal ones.
- Least privilege. Everyone gets the rights they need, no more: a writer does not need to be a site administrator.
- A regular review. Once a quarter, checking the user list of each tool takes an hour and prevents a lot of surprises.
With a contractor, put these points in the contract: return of access, handover of domain transfer codes and source files, a handover period. It is also a good moment to check that your updates and backups do not depend on a single person.
The bottom line
Every departure, whether an employee, a freelancer or an agency, should come with digital offboarding within 24 hours. Start with email and the password manager, then domain and hosting, the CMS, marketing tools, code, API keys and payments. Suspend and downgrade rather than delete, change shared passwords and move two-factor authentication. Above all, keep an access inventory and tie key accounts to the company: the next departure will be a non-event.
Frequently asked questions about offboarding and website access
How fast should you revoke a departing employee’s access?
Critical access (email, password manager, hosting, CMS, ad platforms, payments) should be revoked within 24 hours of the departure at the latest, ideally at the end of the last working day. For a contentious exit or a termination, it is safer to cut it at the moment of the announcement. Secondary tools can be handled within the week, and a final check a month later is worthwhile.
Should you delete or suspend a former employee’s email?
Suspend it rather than delete it. Block sign-in, change the password, sign out all devices, and forward messages to a colleague or set an auto-reply for a few months. Transfer ownership of shared files as well. Deletion can come later, once no useful messages are arriving at that address anymore.
How do you remove a WordPress user without losing their posts?
The safest approach is not to delete them right away: downgrade their role to Subscriber, change their email and password, end their sessions and delete their application passwords. If you do delete the account, WordPress offers to attribute their content to another user; accept that option, otherwise their posts and pages are deleted.
Do you need to change all shared passwords after someone leaves?
Yes, every shared password the person knew: shared accounts, social media, Wi-Fi, tools used by several people. Removing their individual account does not protect those shared credentials. You should also regenerate API keys they created and re-enroll two-factor authentication on a company device if login codes went to their personal phone.
How do you recover a domain registered by a former contractor?
First check who the registrant is through a WHOIS or RDAP lookup and with the registrar. If your company is the registrant, request the transfer authorization code and move the domain to your own account. If the domain is in the contractor’s name, you need to negotiate a change of registrant, relying on your contract and legal advice if necessary.
Which tools make digital offboarding easier?
A team password manager such as 1Password, Bitwarden or Dashlane centralizes credentials and removes rights in one click. Single sign-on through Google Workspace or Microsoft Entra ID ties apps to one account you disable at departure. An access inventory, even a simple spreadsheet, is still essential to cover tools that go through neither system.
