Who Still Has the Keys

Do you know who can log in to your website, your domain, and your accounts? Most small organizations don't, and that is how a former contractor ends up with an administrator login years after the project ended.

This 12-page guide gives you a simple way to find out. We walk you through listing every system you depend on, checking who has access, removing what shouldn't be there, and setting up a short routine so it stays that way.

What's inside:

- A step-by-step audit with the places people forget (domain registrar, old SFTP users, API keys, application passwords)

- WordPress roles in plain English and access rules that work for small teams

- A full offboarding checklist for staff, volunteers, board members, and contractors

- A quarterly review routine

- Three worksheets: system inventory, access register, and keys and shared logins

Made for owners, office managers, and directors. No security background needed. Instant PDF download.

This is general guidance and not legal or compliance advice.