Security steps when someone leaves

When someone leaves your team — whether it's an employee, a contractor, a freelancer, or a long-term collaborator — there are security steps that need to happen promptly. Skipping them can leave doors open that you've forgotten about, sometimes for years.

This guide gives you a checklist you can work through every time someone leaves.

Why this matters even for good departures

It's easy to think "they're leaving on good terms — there's no risk." But ongoing access creates risk even without any malicious intent:

• Their credentials could be compromised by someone else
• They might inadvertently make changes while wrapping things up
• If they later have a dispute with your business, access to accounts is a liability
• Many security and compliance frameworks expect access to be removed promptly, so your own obligations may depend on it — check what yours say

The goal is not to suspect people — it is to maintain control of your business's digital assets.

The offboarding security checklist

Work through this list on or before their last day:

Email and communication

• Disable or delete their business email account (or convert to an alias forwarding to you)
• Set an out-of-office or bounce reply directing contacts to an active email address
• Export any important emails or content before deleting the account
• Remove them from any shared inboxes (e.g., support@, info@)
• Remove from any team chat channels (Slack, Teams, etc.)
• Remove from ClickUp or your project management tool

Website and hosting

• Remove their WordPress user account, or downgrade their role to Subscriber
• Remove their access to your hosting control panel (Flywheel, WP Engine, Kinsta, cPanel)
• Remove their FTP/SFTP access if applicable
• Remove their access to your staging environment

Domain and DNS

• Remove their access to your domain registrar account
• Remove their access to your DNS provider (e.g., Cloudflare)

Google and Microsoft accounts

• Suspend or delete their Google Workspace or Microsoft 365 user account
• Transfer their files to another team member before deleting the account
• Remove them from shared Google Drives, Calendars, and Docs with sensitive information
• Revoke their access to Google Analytics, Search Console, and Tag Manager
• Check for any third-party apps they authorized with their company account

Social media

• Remove their access from Meta Business Suite — both from your business portfolio and from the individual Pages and ad accounts in it
• Remove them as an admin or editor from your Instagram, LinkedIn, X/Twitter, or other accounts
• If they were the sole admin on any platform, add yourself before removing them

Marketing tools and advertising

• Remove from Mailchimp, Klaviyo, or other email marketing platforms
• Remove from Google Ads, Meta Ads Manager, or other advertising platforms

Financial and payment tools

• Remove their access from Stripe, PayPal, or your payment processor
• Remove from QuickBooks, Xero, or accounting software
• If they had a company card or payment credentials, deactivate or change them

Passwords they may have known

• Change any passwords to shared accounts they had access to
• If they used a shared password vault entry, rotate that password
• If they knew your domain registrar password, change it

Physical and device access

• Collect any company devices (laptops, phones)
• If they used a personal device for work, ensure any company data is wiped or inaccessible
• Revoke any VPN access
• Change door codes, alarm codes, or physical security credentials if applicable

Timing: when to do this

For planned departures: prepare the list in advance. For sudden departures: prioritize email and the most sensitive systems first and work through the rest within 24 hours.

Don't forget contractors and freelancers

Contractors and freelancers often have more access than you realize — they may have been added to tools during a project and never removed. Include them in this process when the engagement ends.

Granting access to the replacement

When someone new joins:

• Create new accounts; do not reuse the departed person's credentials
• Grant only the access they need for their role — you can always add more later
• Document what access was granted and when

Common questions

Can I just change the password instead of removing the account?

Changing a shared password helps, but if the departing person had their own account (which is best practice), change the password on shared accounts AND remove or disable their personal account. Don't rely only on password changes.

What if they are the only admin on an account?

This is a common problem, especially with social media. On a Facebook Page, for example, someone with Facebook access with full control can add, edit or remove other people's access — so if they are the only person who has that, you need them to give it to you before their last day, and then you remove theirs. Address this as early as possible — before they leave.

Do I need to notify them that I'm revoking access?

That depends on your employment contract and local law. In most cases, revoking access to business systems on the last day of employment is standard practice and requires no special notice. Consult an employment lawyer if you're unsure about your specific situation.

How do I handle shared social media accounts where they knew the password?

Change the password on any shared account they had access to. Also turn on 2FA if it isn't already on, so that a password on its own is never enough to get in — even if someone noted one down somewhere.

Related guides

• Two-factor authentication, explained
• Revoking our access after a project
• Your business security checklist
• Social media account security
• Securing your domain name
• Offboarding a staff member