Extra holiday help is a relief in November and December. A shared WordPress login or a copied email password feels like the fastest way to get someone started. The problem is that the same shortcut often stays in place long after the seasonal person is gone. One password still works for the whole site. An old mailbox still receives customer replies. A temporary person can still log in from a phone they no longer use.
Most small businesses do not need complicated security tools. They need separate logins, the right level of access, and a clear plan to turn everything off in January.
Start with separate logins instead of shared ones
A shared WordPress username and password means every change looks the same in the activity log. You cannot tell who updated a product, published a page, or installed a plugin. If that person leaves, you also have to change the password everywhere it was used.
Create a separate WordPress user for each seasonal person. Give them only the role they actually need:
- Editor if they will write or update pages and posts.
- Shop Manager if they will handle orders on a WooCommerce site.
- Author if they only need to create content that someone else publishes.
Avoid Administrator for temporary help. That role can change settings, add plugins, and create other users. Most seasonal tasks do not require it.
For email, give each person their own mailbox instead of handing out the main business address password. A personal mailbox (first-name@yourdomain.com or similar) keeps their sent mail and replies separate. If you need several people to see the same incoming messages, use a shared inbox or a group address that forwards to the right people. The shared address receives mail. Individual mailboxes send and reply under their own names.
These steps match the same principle used in A Quick Test to Make Sure Every Staff Mailbox Still Sends and Receives. Confirm each new mailbox can send and receive before the person starts answering customers.
Set the access the same day you hire them
- Create the WordPress user and assign the limited role. Send the login details through a secure method, not a plain text message that sits in a chat history.
- Create the individual mailbox (or add them to the shared inbox). Have them sign in on the device they will actually use and send a short test message to an address you control.
- Show them only the pages or tools they need. A shop manager does not need the theme settings. A content person does not need the billing area.
- Turn on two-factor authentication for the WordPress account and the email account if the option is available. A second step (phone code or authenticator app) stops most casual password reuse problems.
- Note the start date and the planned end date in a simple list you keep outside the website. That list is what you will use in January.
If you use Microsoft 365 or Hosted Exchange, the same pattern applies. Create a proper user account with the correct license and permissions instead of sharing one mailbox login across several people.
Remove access as soon as the work ends
The most common leftover problem is access that is never turned off. A seasonal person still has a WordPress login in March. Their mailbox still receives order notifications. An old phone still has the account saved.
Plan the removal before you create the accounts:
- Set a calendar reminder for the first week of January (or the day after their last shift).
- Delete or disable the WordPress user. Do not just change the password and leave the account sitting there.
- Remove the person from any shared inbox or group. If they had their own mailbox, decide whether to keep it for records or archive and close it.
- Change any passwords they were given for third-party tools (shipping, inventory, or social media) if those passwords were shared.
- Check the WordPress user list and the email account list one more time to confirm nothing remains.
A short note in your records (“seasonal access removed on this date”) helps if you ever need to show what was done.
A short version you can keep
- Give each seasonal person their own WordPress login with the smallest role that still lets them do the work.
- Give them their own mailbox or a clear shared-inbox setup instead of the main business password.
- Test that each new account can send and receive before they start.
- Put a reminder on the calendar for the first week of January to remove or disable every temporary account.
- Confirm the WordPress users and mailboxes are actually gone after the reminder.
These steps take less time than cleaning up a shared password that has been in use for months. Separate accounts and a clear end date keep the doors open only while the extra help is actually needed. KartHost can create the WordPress users and mailboxes with the correct roles and permissions when you are ready, so the setup matches the way you want seasonal access to work.
