Offboarding a staff member across all your systems

When someone leaves your team (whether on good terms or not), their access to your systems must be removed promptly and completely. An overlooked account is an open door.

This guide gives you a complete, system-by-system checklist. It's the reverse of the onboarding checklist, and if you documented access when they joined, this becomes much easier.

For a one-page tickbox list you can print or email to whoever runs the offboarding, including social media, payment tools and physical access, use security steps when someone leaves.

Departures on bad terms: act today

If the departure is hostile, contentious, or you have any reason to believe the person may misuse access, complete this checklist on the same day. Do not wait. Change any shared passwords immediately. Contact us if you need help moving quickly.

Before you start

0 of 4 done

Retrieve the access record you kept from their onboarding. (If you didn't keep one, work through this checklist system by system.)
Decide whether their email address needs to stay active to catch incoming messages. You can usually redirect it to a colleague without keeping the account alive.
Confirm who is taking over any tasks, projects, or ongoing work in each system.
Allow adequate time, rushing leads to missed accounts.

Saved in this browser only.

Email & productivity suite

Google Workspace

Suspend the account first. In the Admin console, go to Directory → Users, point at the person, and click More options → Suspend user. This locks them out immediately without deleting anything. Google still charges the full rate for a suspended account, so it's a safety step, not a saving. See removing a user safely.

Transfer their files. Before deleting the account, transfer their Google Drive files to a colleague. Items in their Trash are not transferred, so move anything that matters out of Trash first. See transferring files when someone leaves.

Redirect their email if business emails will still arrive at their address. An admin can route their mail to a colleague, or, once the account is deleted, add the old address as an alias on the person taking over. See removing a user safely.

Remove them from Groups and Shared Drives. Go to Directory > Groups and remove them from all mailing lists. Then go to each Shared Drive they had access to and remove them as a member. See shared drives explained.

Delete the account when you're ready. Once files are transferred and email is sorted, delete the user. A super admin can recover a deleted user for up to 20 days; after that the data is gone. See removing a user safely.

WordPress

Remove their account. Log in to WordPress as an Administrator and go to Users → All Users. Hover over their name and click Delete. When WordPress asks what to do with their content, choose Attribute all content to another user. If you delete their content instead, the media files they uploaded are deleted permanently. See how to remove a user safely.

Check for application passwords. In WordPress, application passwords (used for API access) are separate from the main login. Go to Users, click their name, scroll to Application Passwords, and revoke any that exist.

Rotate the admin password if any shared WordPress admin credentials were in use. It's better practice to use individual accounts, but if sharing happened, change the shared password now.

Hosting

Remove their access in your hosting dashboard. The steps vary by host:

Flywheel: on each site's collaborator list, open the three-dot menu next to their name and click Remove. Collaborators are added per site, so check every site.
WP Engine: in the User Portal, open Users → Account Users, click Edit next to their name, then Remove. Only an Owner can do this.
Kinsta: in MyKinsta, go to Company settings → Users and click the trash icon next to their name, or remove them from a single site's User management page.

Revoke any SSH keys and API keys they may have added or used. Removing a hosting user doesn't do this for you: WP Engine says deleting an account user doesn't modify the SFTP users they had access to, and Kinsta says it doesn't revoke API keys or reset database or SSH/SFTP passwords.

Change FTP/SFTP and database passwords if any shared credentials were in use.

Password manager

Remove them from the organization vault. In your password manager's admin settings, revoke their membership. This removes their access to the shared vault entries.

Rotate any passwords they had access to. Once removed from the vault, they no longer see new updates, but they may remember passwords from before. Rotate the passwords for any critical systems they could access. Prioritize: hosting, domain registrar, billing accounts, WordPress admin.

Two-factor authentication (2FA) devices

Revoke their devices and sessions on every platform that allows it. In Google Workspace, remove their work account from their mobile devices and reset their sign-in cookies. In Microsoft 365, sign them out of all sessions (see above).

Remove them from any shared authenticator setups. If any 2FA was set up on a shared phone or device, remove those codes from the device.

Domain registrar

Remove their delegate access from your registrar account. Log in to your registrar (GoDaddy, Namecheap, etc.) and go to account settings or access management to revoke their permissions.

Verify the primary account email is not theirs. If the registrar account uses their email address as the contact, update it to a shared business email (like admin@yourbusiness.com) now. This is critical, if the contact email belongs to a former employee, they could receive renewal notices and account recovery emails.

Other systems

Work through every system on your access record. Common examples:

System	Steps
ClickUp	Go to your workspace settings and remove or deactivate their member account.
Google Analytics	In Admin, open Property access management and remove them.
Google Search Console	In Settings → Users and permissions, remove them.
Meta Business Suite	In your business settings, find them under users and remove them.
Mailchimp / Klaviyo	Mailchimp: Account & billing → Settings → Users. Klaviyo: Settings → Users.
Stripe	In your settings, open Team and security and remove them on the Team tab.
Shopify	Go to Settings → Users (labelled Users & permissions on some stores) and remove them.
Cloudflare	Go to Manage Account → Members and remove them.
GitHub	Remove them from your organization, or from each repository's Collaborators list.
Figma	Remove from the team or project settings in Figma.

After the checklist

Confirm these are complete:

When you're done

0 of 7 done

Email account suspended or deleted, files transferred
WordPress account removed and posts reassigned
Hosting access revoked
Password manager membership removed, critical passwords rotated
Domain registrar access revoked, contact email updated
All other systems cleared from your access record
Any shared passwords changed

Saved in this browser only.

Update your access record. Note the date of removal for each system. This is useful for audits and for confirming the offboarding is complete.

Keep their email address active for 30 days (as a suspended account or redirect) to catch any business correspondence that arrives.

Run a quick security check after the offboarding. See the business security checklist for a post-offboarding review.

Common questions

How quickly should I remove access?

For planned departures on good terms, completing the checklist on the last working day is fine. For unplanned or difficult departures, complete it on the same day you learn of the departure. Do not wait.

Do I need to delete their accounts, or is suspending enough?

Suspending is usually the right first step in Google Workspace. It blocks access while preserving data. Microsoft 365 has no suspend button: reset their password and sign them out of all sessions instead. Delete after 30 days or once you've confirmed there's no data or correspondence to retrieve.

What if I didn't document what access they had?

Work through this checklist system by system. In Google Workspace and Microsoft 365, you can search for the person's email in each system's user or access management area. For WordPress, check the Users list. For password manager vaults, check the shared items. It takes longer, but it's completable.

Should I change all our passwords, not just theirs?

You should rotate passwords for any accounts where credentials were shared directly (not through individual named accounts). For accounts with individual named logins, removing their account is sufficient. You don't need to change your own password.

What about their personal device?

If they used a personal device for work (Bring Your Own Device), ask your IT administrator or us to review mobile device management settings. In Google Workspace, an admin can remotely wipe the work account off a phone without wiping the whole device. If they synced or downloaded files to a personal device, there's no way to wipe those from the Microsoft 365 admin center. See managing company devices.