Recommended Free Tools
Give each client or contractor a separate WordPress account, assign only the capabilities their task requires, protect every privileged account with strong authentication, and remove access as soon as the work ends. Never share an administrator login. Use revocable Application Passwords for software, keep production changes controlled, and maintain a written access register so you can see who can do what and shut access down quickly.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Start with the work, not the WordPress role
WordPress roles are bundles of capabilities, not job titles. Before creating an account, write down the exact work the person must perform: reviewing drafts, writing posts, publishing content, uploading media, managing other authors, changing plugins or themes, administering users, or working on the server. Map that work to the narrowest role that completes it.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This prevents a common mistake: choosing Administrator because it is convenient, then leaving broad production access in place after the original task has finished. An account that can install a plugin can usually change site behavior; an account that can manage users can create another privileged identity. Those are materially different risks from editing one’s own post.
What the built-in roles permit
| Role | Core capability scope | Typical client use | Security boundary |
|---|---|---|---|
| Administrator | All administration features for one WordPress site, including user, plugin, theme, and site settings. | Trusted site owner or a tightly controlled technical operator. | Highest blast radius. Keep the number of administrators small and protect every one with multi-factor authentication. |
| Editor | Can manage posts by other users as well as their own, including editorial and publishing work. | Content lead who needs to review, edit, schedule, and publish the team’s posts. | Broader content authority than an Author; it still should not be used for technical administration. |
| Author | Can publish and manage their own posts. | A client who creates and publishes only their own articles. | Does not provide control over other authors’ content or site configuration. |
| Contributor | Can write and manage their own posts but cannot publish them. | Freelancer or client whose work must be reviewed before publication. | Useful for draft-only workflows; pair it with an Editor who approves and publishes. |
| Subscriber | Can manage only their own profile. | A person who needs a profile or authenticated viewing account, not editorial access. | Minimal WordPress privilege. |
These are the standard role bundles described by WordPress.org. A site can add custom roles or alter capabilities, so verify the effective permissions on the particular installation rather than assuming a role has its default meaning. Hosting, SSH, SFTP, database, CDN, DNS, and billing permissions are outside these WordPress roles and must be governed separately.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When the built-in role is not an exact fit
If a client needs one unusual permission—such as uploading media but not publishing, or approving comments without editing posts—use a carefully designed custom role or a workflow that keeps the sensitive action with an internal operator. Document each added capability and test it with a non-production account. Do not solve an awkward permission requirement by granting Administrator indefinitely.
Create individual, attributable accounts
Create one named account for every client, employee, and contractor. The username and email should identify the person, and the account should not be reused when personnel change. Individual identities produce meaningful activity records and make removal possible without disrupting everyone else.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Confirm the identity and business need. Record the person’s name, organization, requested task, start date, approving owner, and expected end date before sending an invitation.
- Create the account in WordPress. In the dashboard, use Users → Add New, enter the person’s own email address, and select the previously approved role. Do not use a team mailbox as a substitute for an individual identity.
- Deliver the invitation safely. Let the recipient set their own password through the site’s normal invitation or reset flow. Do not email a shared password or paste credentials into a chat channel.
- Verify the boundary. Have the user perform the intended task in a test or staging area where possible. Check that menus and actions outside the assignment are unavailable, and record any exception.
Keep one emergency administrator account for recovery, but protect it as a break-glass credential: store it in a password manager, restrict who can use it, monitor its use, and do not use it for routine client work. Minimize the total number of administrators; WordPress brute-force guidance specifically recommends limiting administrators and applying least privilege.
Strengthen authentication before granting access
Use a generated password of at least 20 characters
WordPress password guidance recommends a unique password of at least 20 characters. Generate it rather than inventing a memorable phrase that has appeared on another service, and store it in a reputable password manager. Never send the password in the same message as the username, and never ask a client to share their password with your team.
A password manager also makes offboarding practical: the user can change or revoke the credential without anyone having to know the old value. If a password may have been exposed, reset it immediately and investigate account activity instead of waiting for the next review.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Require multi-factor authentication for privileged users
Enable two-factor authentication for every administrator and for any other account that can affect many users, publish high-impact content, or change site behavior. A time-based one-time-password app is stronger than a password alone. Where the user’s devices and chosen WordPress security solution support it, prefer a FIDO2/WebAuthn security key. WordPress’s MFA tutorial describes security keys as resistant to phishing attacks, because the key verifies the legitimate site rather than approving a look-alike login page.
Provide at least two enrolled security keys or a documented recovery method so a lost device does not lock out the only administrator. Store recovery codes offline, restrict access to them, and test the recovery procedure before an emergency. The WordPress Security Team’s official two-step-authentication handbook summarizes the underlying risk plainly: “The weakest link in the security of anything you do online is your password.” MFA reduces the chance that a stolen password alone becomes a site takeover.
Apply stronger controls to non-administrator accounts when practical
An Editor can alter many pages and posts, so protecting that account with MFA is prudent even when WordPress’s minimum recommendation focuses on administrators. Make the requirement explicit in the access policy, show the client how to enroll, and set a deadline before production access is enabled. Do not disable MFA to work around a forgotten device; use the documented recovery path and then re-enroll the factor.
Keep human logins separate from software credentials
A deployment script, reporting tool, mobile app, or integration should not use a person’s password. Create a dedicated WordPress user or integration identity with only the capabilities the software needs, then issue an Application Password with a descriptive name such as “staging deployment” or “monthly reporting.”
- Application Passwords are per-application API credentials, not replacements for a browser login.
- WordPress displays the secret once; copy it directly into the protected server-side secret store and do not put it in source code, tickets, screenshots, or chat.
- Send it only over HTTPS. Reject a workflow that transmits the credential over an unencrypted connection.
- Record the application name, owner, creation date, intended scope, and last-use information where the site or integration exposes it.
- Revoke one token without changing a person’s password when an integration is retired, a vendor changes, or compromise is suspected.
Do not paste an Application Password into the normal wp-admin login form. It is intended for programmatic authentication to the WordPress API. If a tool cannot use HTTPS, cannot protect the secret, or demands a full administrator password, stop and redesign the integration rather than weakening the site’s credentials.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use staging and controlled production changes
Production access should be the exception, not the default. Give a developer or agency the narrowest environment that can complete the work: a staging copy for theme and plugin changes, a content role for editorial work, or a deployment identity that can release an already reviewed build. Keep the production approval with a named owner.
- Define the change. Record what will be changed, who requested it, the affected URLs or features, and the rollback method.
- Back up before high-impact work. Create a restorable backup of the database and files, verify that it completed, and keep it separate from the server being changed.
- Test outside production. Reproduce the change on staging when available. Check forms, logins, media, caching, integrations, and responsive layouts—not just whether the dashboard reports success.
- Approve and deploy. A second person or an explicit client owner should approve a production release. Use a controlled deployment process rather than ad-hoc edits made directly on the live site.
- Verify and document. Confirm the expected result, review logs, note the deployment time and account used, and retain the rollback instructions.
A staging copy is not automatically safe: it may contain real personal data and working API keys. Mask sensitive data where possible, give it separate credentials, and ensure that search engines cannot index it. If production access is unavoidable, make it time-limited and remove it when the maintenance window closes.
Patch the site and its extensions
WordPress identifies keeping core, plugins, and themes up to date as the most important security step. Enable a dependable update process, choose extensions that are actively maintained, and remove software that is abandoned or no longer needed. Updates should be tested in staging when the site’s compatibility requirements justify that step; delaying critical security updates without a tested plan leaves a known weakness exposed.
- Inventory WordPress core, every plugin, every theme, and any must-use code.
- Subscribe to security and maintenance notifications for the components you rely on.
- Apply updates through a controlled account, then check the public site and key workflows.
- Remove inactive plugins and themes instead of leaving them installed as dormant attack surface.
- Keep a tested backup before changes that could affect code, data, or authentication.
Updates do not compensate for excessive access. A patched site can still be compromised if a former contractor retains an administrator account or an integration token remains active.
Maintain an access register and review it
An access register turns a collection of dashboard accounts into a manageable control. Keep it in a restricted location and make one owner responsible for its accuracy. At minimum, record:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Person or integration name and the account identifier.
- Role and any custom capabilities.
- Business reason, approving owner, and environment (production or staging).
- Start date, planned end date, and last review date.
- MFA method for human accounts, without storing the secret factor itself.
- Application Password name, owner, creation date, and last-use information for software identities.
- Related hosting, SSH, SFTP, database, DNS, repository, or deployment permissions.
Review the register on a recurring schedule appropriate to the site’s risk and immediately after a project, role, or staffing change. Compare it with the actual WordPress user list and hosting identities. Investigate accounts with no business owner, no recent use, or capabilities that exceed the recorded task. A review is an action: downgrade, suspend, or remove access rather than merely marking the row as checked.
Offboard a client or former contractor safely
Do not wait for a quarterly review when work ends. Treat offboarding as a short incident-response checklist, especially if the relationship ended unexpectedly.
- Disable or delete the WordPress user. If the account owns posts, choose the appropriate content reassignment option so deleting the identity does not delete required work. Preserve the audit record.
- Revoke every Application Password. Revoke tokens individually for integrations that are retired, transferred, or possibly exposed.
- Remove external access. Revoke hosting-panel, SSH, SFTP, database, repository, deployment, CDN, DNS, analytics, and support-tool permissions associated with the person or agency.
- Rotate shared secrets. Change any credential that could not be individually revoked, including shared hosting or API secrets. Update the controlled secret store and dependent services.
- Check logs and recent changes. Look for unexpected logins, new users, altered plugins or themes, scheduled tasks, modified payment settings, and unfamiliar Application Passwords.
- Confirm recovery. Verify that current backups and logs still exist and that an authorized owner can restore the site if an unauthorized change is discovered.
- Close the register entry. Record the date, approver, actions taken, and any follow-up investigation without retaining unnecessary personal data.
If compromise is suspected rather than merely a normal contract end, preserve logs before deleting evidence, place the site in a controlled state, rotate credentials in priority order, and involve the hosting or security team. Removing one dashboard user is not enough if that person also had server or repository access.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose access by risk, not convenience
| Situation | Recommended access | Additional control |
|---|---|---|
| Client reviews copy and leaves comments | Subscriber or a workflow-specific review account, depending on the editorial tool. | Keep publishing with the internal Editor; require MFA if the account can access sensitive drafts. |
| Client publishes only their own articles | Author. | Use approval rules for legal, regulated, or brand-sensitive content. |
| Client manages the whole editorial calendar | Editor. | Enable MFA, log publishing activity, and keep technical settings outside the role. |
| Freelancer submits drafts for approval | Contributor. | Have an Editor review and publish; set an end date in the register. |
| Developer changes a theme or plugin | Staging access or a tightly scoped deployment identity. | Back up, test, obtain approval, and remove temporary production access after release. |
| Automated reporting or deployment | Dedicated integration user with a revocable Application Password. | HTTPS, server-side secret storage, least capabilities, and token revocation at retirement. |
When a task spans content and infrastructure, split it between accounts or people. For example, an Editor can approve copy while a technical operator deploys a theme change. Combining both responsibilities in one permanent Administrator account makes mistakes and malicious changes harder to detect and contain.
Common access failures and precise fixes
“The client says the role cannot do the job.”
Ask which exact button or screen is missing, then identify the capability behind that action. Confirm that a plugin has not changed the normal role behavior. Add only the required capability through a documented custom role or keep that step with an internal operator; do not jump straight to Administrator.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“A contractor needs Administrator for one maintenance task.”
Prefer a staging copy, a supervised screen-share, or a time-limited account. If production Administrator access is unavoidable, record written approval, create a backup, require MFA, monitor the session, and remove or downgrade the account immediately after the change. Review what was altered before returning the site to normal operation.
“An Application Password was pasted into a ticket or repository.”
Assume it is compromised. Revoke that token, create a replacement in the protected secret store, inspect recent API activity, and search for copies in logs, commits, exports, and screenshots. If the integration user had excessive capabilities, reduce them before issuing the replacement.
“The only administrator lost their second factor.”
Use the preplanned recovery method or the monitored emergency administrator account. Do not turn off MFA across the site as a shortcut. After access is restored, enroll a replacement factor, rotate any recovery codes that may have been exposed, and verify that the emergency account was not left enabled for routine use.
“A former agency account is gone, but something still looks wrong.”
Check non-WordPress access: hosting, SSH, SFTP, database, DNS, deployment systems, repositories, API providers, and shared passwords. Review user creation, plugin and theme changes, scheduled jobs, and Application Password usage. Preserve logs and backups while you investigate, and rotate secrets that cannot be revoked individually.
A practical minimum policy
For a small site, the following baseline is both achievable and defensible:
- Named account for every human; no shared Administrator login.
- Least-privilege role selected from a written task description.
- Unique generated password of at least 20 characters in a password manager.
- MFA for every administrator and, where possible, every Editor and other privileged user.
- FIDO2/WebAuthn security key offered for phishing-resistant authentication.
- Separate integration identity and revocable Application Password for each software client, transmitted only over HTTPS.
- Current WordPress core, plugins, and themes, with abandoned extensions removed.
- Restorable backups and a tested rollback path before high-impact changes.
- Access register reviewed on a recurring schedule and after every role or staffing change.
- Immediate offboarding covering WordPress, hosting, server, repository, and shared secrets.
This policy keeps the blast radius proportional to the work. A client can publish without controlling plugins; a reporting tool can use the API without inheriting a person’s password; and a departed contractor can be removed without guessing which systems they once touched.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
