Blog / security monday
Who Still Has Access to Your Website?
A quarterly access review takes about twenty minutes and closes the door on old developer accounts, stale FTP logins and shared passwords.
Most of the compromised sites we clean up were not broken into by anything clever. Somebody still had a key. An old developer account nobody removed. A support login handed out for one afternoon and never revoked. A shared FTP password sitting in three people's notes, two jobs ago.
This week in Security Monday we are doing the least exciting job on your site, and one of the most useful: working out exactly who can still get in, and closing the accounts that should have gone a long time ago.
Start with the WordPress user list
Open Users, then All Users, and sort by role. Your question for every Administrator is simple. Would you hand this person your online banking login today? Administrator in WordPress can install code, edit files through the dashboard, add other administrators and read anything in the database. There is no smaller version of it.
Most small sites need one or two administrators. Everybody else can work fine as Editor or Author. If a person only writes posts, give them Author. If they manage other people's posts, Editor. Dropping somebody down a level is usually better than deleting the account outright, because deleting forces you to reassign their content.
While you are in there, look at the email address attached to each administrator. When a site has been taken over, the giveaway is often an extra admin account you do not recognize, using a free webmail address, created at an odd hour. We wrote about what that looks like from the server side in a hacked site as we see it. If you find an account like that, do not just delete it and move on. Assume the password of every other account has been read.
The logins that sit underneath WordPress
The dashboard is only one door. Under it sit several more, and they tend to outlive the projects that created them.
In cPanel, check FTP Accounts. Almost every site we look at has at least one left over from a redesign, often named after a developer or an agency. Delete the ones nobody is using. If you do need file access for somebody, prefer SFTP over plain FTP, since plain FTP sends the password in the clear across the network.
Then check SSH keys, cPanel API tokens and database users. Each of those is a standing invitation that does not expire on its own and does not care whether you changed your main password. A database user with full rights is enough to rewrite your content or quietly add an admin, no dashboard login required.
Email deserves its own look. Old mailboxes that nobody reads are a comfortable place to hide, and an attacker who gets into your business email can reset passwords everywhere else. Check the forwarders and filters on your main address too. A silent forward, added months ago, is one of the oldest persistence tricks there is, and almost nobody thinks to look.
Shared logins are the real problem
Agencies, freelancers and contractors are not the risk. The shared login is. When four people use one account, you cannot tell who made a change, and when one of them moves on you have to rotate a password that everybody has memorized and half of them have saved.
Give every person their own named account instead. Then offboarding is a thirty second job: remove one account, done. Nobody else is interrupted and nothing needs to be re-shared.
Two habits worth keeping. Set an end date when you create access for a project, and write it down somewhere you will see it. And when a plugin or theme vendor asks for a temporary admin account to debug something, create one for that purpose, then remove it the moment the ticket closes. Turning on two-factor authentication for the accounts that survive the review is the other half of the job, and we covered the specifics in locking down your hosting account.
Make it a recurring twenty minutes
Access reviews fail because they are a one-off resolution instead of a scheduled task. Put it in the calendar once a quarter. Alongside it, keep a plain list of who is supposed to have access to what: WordPress, cPanel, the domain registrar, the email accounts. Reviewing without that list means you are judging each account on whether it looks familiar, which is exactly the judgment attackers rely on.
Run it early, too, whenever somebody leaves, a contract ends or a project wraps up. The review is cheapest on the day the work finishes and most expensive the day you are reading a malware scan.
If you are unsure what an account in your cPanel is for, or whether an FTP login you found is still needed by something, send us a ticket through support and we will look at it with you before you delete anything.