Security steps when someone leaves

The security checklist to run every time a team member, contractor, or employee moves on, to protect your business and remove unnecessary access.

Time
5 min read
Difficulty
Intermediate
Last updated
Updated
Share
Security topicAccess topic

When someone leaves your team (whether it's an employee, a contractor, a freelancer, or a long-term collaborator), there are security steps that need to happen promptly. Skipping them can leave doors open that you've forgotten about, sometimes for years.

This guide gives you a checklist you can work through every time someone leaves. For the click-by-click steps in Google Workspace, Microsoft 365, WordPress, your hosting dashboard and other tools, see offboarding a staff member across all your systems.

Why this matters even for good departures

It's easy to think "they're leaving on good terms. There's no risk." But ongoing access creates risk even without any malicious intent:

  • Their credentials could be compromised by someone else
  • They might inadvertently make changes while wrapping things up
  • If they later have a dispute with your business, access to accounts is a liability
  • Many security and compliance frameworks expect access to be removed promptly, so your own obligations may depend on it. Check what yours say

The goal is not to suspect people. It is to maintain control of your business's digital assets.

The offboarding security checklist

Work through this list on or before their last day:

Email and communication

0 of 6 done

  • Disable or delete their business email account (or convert to an alias forwarding to you)
  • Set an out-of-office or bounce reply directing contacts to an active email address
  • Export any important emails or content before deleting the account
  • Remove them from any shared inboxes (e.g., support@, info@)
  • Remove from any team chat channels (Slack, Teams, etc.)
  • Remove from ClickUp or your project management tool

Saved in this browser only.

Website and hosting

0 of 4 done

  • Remove their WordPress user account, or downgrade their role to Subscriber
  • Remove their access to your hosting control panel (Flywheel, WP Engine, Kinsta, cPanel)
  • Remove their FTP/SFTP access if applicable
  • Remove their access to your staging environment

Saved in this browser only.

Domain and DNS

0 of 2 done

  • Remove their access to your domain registrar account
  • Remove their access to your DNS provider (e.g., Cloudflare)

Saved in this browser only.

Google and Microsoft accounts

0 of 5 done

  • Suspend or delete their Google Workspace or Microsoft 365 user account
  • Transfer their files to another team member before deleting the account
  • Remove them from shared Google Drives, Calendars, and Docs with sensitive information
  • Revoke their access to Google Analytics, Search Console, and Tag Manager
  • Check for any third-party apps they authorized with their company account

Saved in this browser only.

Social media

0 of 3 done

  • Remove their access from Meta Business Suite, both from your business portfolio and from the individual Pages and ad accounts in it
  • Remove them as an admin or editor from your Instagram, LinkedIn, X/Twitter, or other accounts
  • If they were the sole admin on any platform, add yourself before removing them

Saved in this browser only.

Marketing tools and advertising

0 of 2 done

  • Remove from Mailchimp, Klaviyo, or other email marketing platforms
  • Remove from Google Ads, Meta Ads Manager, or other advertising platforms

Saved in this browser only.

Financial and payment tools

0 of 3 done

  • Remove their access from Stripe, PayPal, or your payment processor
  • Remove from QuickBooks, Xero, or accounting software
  • If they had a company card or payment credentials, deactivate or change them

Saved in this browser only.

Passwords they may have known

0 of 3 done

  • Change any passwords to shared accounts they had access to
  • If they used a shared password vault entry, rotate that password
  • If they knew your domain registrar password, change it

Saved in this browser only.

Physical and device access

0 of 4 done

  • Collect any company devices (laptops, phones)
  • If they used a personal device for work, ensure any company data is wiped or inaccessible
  • Revoke any VPN access
  • Change door codes, alarm codes, or physical security credentials if applicable

Saved in this browser only.

Timing: when to do this

Don't delay

Access revocation should happen on the last day of work, not "sometime soon" or "when you get around to it." The longer access remains active, the greater the risk.

For planned departures: prepare the list in advance. For sudden departures: prioritize email and the most sensitive systems first and work through the rest within 24 hours.

Don't forget contractors and freelancers

Contractors and freelancers often have more access than you realize. They may have been added to tools during a project and never removed. Include them in this process when the engagement ends.

Granting access to the replacement

Create new accounts for the person taking over; do not reuse the departed person's credentials. See onboarding a new staff member for setting up access and keeping a record of it.

Common questions

Can I just change the password instead of removing the account?

Changing a shared password helps, but if the departing person had their own account (which is best practice), change the password on shared accounts AND remove or disable their personal account. Don't rely only on password changes.

What if they are the only admin on an account?

This is a common problem, especially with social media. On a Facebook Page, for example, someone with Facebook access with full control can add, edit or remove other people's access, so if they are the only person who has that, you need them to give it to you before their last day, and then you remove theirs. Address this as early as possible, before they leave.

Do I need to notify them that I'm revoking access?

That depends on your employment contract and local law. In most cases, revoking access to business systems on the last day of employment is standard practice and requires no special notice. Consult an employment lawyer if you're unsure about your specific situation.

How do I handle shared social media accounts where they knew the password?

Change the password on any shared account they had access to. Also turn on 2FA if it isn't already on, so that a password on its own is never enough to get in, even if someone noted one down somewhere.

Was this page helpful?

Keep a copy of this checklist

We’ll email you this checklist so you can tick through it later. Or print this page, it’s set up to print cleanly.

We use your email to send this checklist and, only if you tick the box, our tips.

Go deeper on chykalophia.com

Talk it through

Want a second pair of eyes on this?

Book a free discovery call, up to an hour. Bring the question you're stuck on and we'll tell you honestly what we'd do.

Book a free callSee how we work

Already a client? Email support@chykalophia.com.

Last updated