Onboarding a new staff member across all your systems
A complete checklist for giving a new team member the right access to WordPress, Google Workspace, Microsoft 365, hosting, passwords, and more.
Bringing on a new team member means setting them up with the right access to the right systems, and nothing more. Getting this right from day one saves time, prevents security headaches, and means your new colleague can actually do their job.
This guide is a complete, system-by-system checklist. Work through the sections that apply to your business.
Before you start
Answer these questions before creating any accounts:
- What is this person's role, and what do they actually need access to?
- Are there systems they should be able to view but not edit?
- Are there systems they should never have access to (e.g., billing, hosting)?
- Who will be their manager, and should that person be notified of each access grant?
Write down the systems you're granting access to. You'll need this list when the person leaves. The offboarding checklist is the reverse of this one. Keep them together.
Email & productivity suite
Google Workspace
Create their user account. Sign in to the Google Admin console at admin.google.com. Go to Directory → Users, then Add new user. Enter their name and choose their email address. Google says it can take up to 24 hours before every service is available to them. See adding a user in Google Workspace.
Assign the right role. For most staff, the default User role is correct. Only assign Admin if the person manages the Google Workspace account. See the Admin console for role options.
Share the temporary password securely. Use your password manager's secure sharing feature, not email, not Slack, not a text message. See how to share a password safely.
Add them to the relevant Groups. Groups control access to shared mailboxes and distribution lists. Go to Directory > Groups in the Admin console and add them where appropriate. See groups & email aliases.
Share relevant Shared Drives. Go to Google Drive, open each shared drive they need, click Manage members at the top, and add their email. You need Manager access to the drive to add anyone. See shared drives explained.
Ask them to enable 2-step verification on their first day. See turning on 2-step verification.
WordPress
Decide on the right role before creating the account. Most content editors should have the Editor role. People who manage the site should have Administrator. Avoid giving Administrator access to anyone who doesn't need it. See WordPress user roles explained.
Add them as a user. In WordPress, go to Users → Add User (older versions call it Add New User). Enter their email, set their role, and save. WordPress emails them a link to set their password. See how to add a new user.
Send them the login URL. Your WordPress login URL may not be the obvious one. See how to find your WordPress login URL.
Ask them to set a strong password the first time they log in. See how to reset your WordPress password.
Enable two-factor authentication if your site uses it. See turning on two-factor login for WordPress.
Hosting
Most staff do not need hosting access. Only grant it if the person is directly managing or deploying the site.
Add them as a collaborator in your hosting dashboard. The steps vary by host:
- Flywheel: see give us Flywheel access for the steps (the same flow works for adding any user)
- WP Engine: see give us WP Engine access
- Kinsta: see give us Kinsta access
Assign the minimum role needed. Hosts offer different roles: Kinsta, for example, has administrator, developer and billing-only roles. Use the most restrictive option that lets them do their job.
Password manager
Create them an account or invite them to your organization's shared password manager vault (1Password, Bitwarden, LastPass, etc.).
Share only the vaults or collections they need. Don't give them access to billing credentials, hosting root passwords, or other sensitive vaults unless their role requires it.
Never share individual passwords over email or chat. All sharing should go through the password manager's built-in sharing feature. See using a password manager with us.
Two-factor authentication (2FA)
Two-factor authentication (2FA) adds a second step to login (usually a code from a phone app) so that a stolen password alone can't unlock an account.
Require 2FA on every account the new person accesses. It's one of the most effective security measures you can take. See two-factor authentication explained.
Ask them to set up an authenticator app on their phone, such as Google Authenticator, Authy, or Microsoft Authenticator. See using an authenticator app.
Make sure they save their backup codes in the password manager. Without them, a lost phone can lock them out of their accounts.
Domain registrar
Only grant domain registrar access if the person manages your domain or DNS.
Use delegate access if your registrar supports it (GoDaddy calls it Delegate Access; Namecheap calls it Share Access). This is safer than sharing your main account password. See give us access to your domain registrar.
Assign the minimum permission level: where your registrar lets you choose, give access to manage DNS without giving billing access.
Other systems
Consider any other tools your team uses. Common examples:
| System | Notes |
|---|---|
| ClickUp | If we've invited your team to a shared ClickUp space, send us their name and email and we'll invite them. See getting your ClickUp invite. |
| Google Analytics | In Admin, open Property access management and add them as a Viewer or Editor. See give us access to Google Analytics. |
| Google Search Console | In Settings → Users and permissions, add them as a Full or Restricted user. |
| Meta Business Suite | Add them in your business settings with the appropriate access for Pages or Ads. See give us access to Facebook & Instagram. |
| Mailchimp / Klaviyo | Mailchimp: Account & billing → Settings → Users. Klaviyo: Settings → Users. |
| Stripe | In your settings, open Team and security and add them on the Team tab with the appropriate role. |
| Shopify | Add them as staff under Settings → Users. (Collaborator access, described in give us Shopify collaborator access, is for agencies like us, not your own staff.) |
On their first day
Confirm these are done before the new person starts:
Day one checklist
0 of 7 done
- Email account created and working
- Invited to relevant Shared Drives / SharePoint / OneDrive folders
- WordPress account created (if applicable)
- Password manager invitation sent and accepted
- 2FA enabled on all accounts
- ClickUp invitation requested from us (only if you have a shared ClickUp space with us)
- They know the login URL for each system they'll use
Saved in this browser only.
Document what you've given them
Write down (in your password manager or a shared document) exactly what accounts and permissions this person has. You'll need this list when they leave. The offboarding checklist depends on it.
Common questions
Should I give the new person my own admin account login?
No. Always create a separate account for them. Sharing your login means you lose the ability to audit who did what, and you'll have to change your own password when they leave.
What role should I give them in WordPress?
For most content editors, the Editor role is right. They can edit and publish pages and posts but can't change settings or install plugins. Only give Administrator access to people who need to manage the site itself. See WordPress user roles explained.
What if they need access to something I'm not sure about?
Err on the side of less access. It's easy to grant more access later. Revoking access after a security incident is harder. Contact us if you're unsure what level of access is appropriate for a particular role.
Do I need to tell them about our security policies?
Yes. Make sure they understand: use a unique password for every system (via the password manager), enable 2FA, never share passwords over email or chat, and know how to recognize phishing. See how to recognize phishing attempts.
Related guides
Was this page helpful?
Go deeper on chykalophia.com
- Our full guideWebsite maintenance: costs and risksWhat upkeep costs, and what goes wrong without it.
- Website careThe Boring StuffOur care plan: updates, backups, security and speed, looked after for you.
- Our approachWebsite optimizationTesting, performance work and analytics hygiene that keep your site earning.
Talk it through
Want a second pair of eyes on this?
Book a free discovery call, up to an hour. Bring the question you're stuck on and we'll tell you honestly what we'd do.
Already a client? Email support@chykalophia.com.
Last updated