When an Employee Leaves: Revoking Access to Your Site, Email, Google and Social in a Single Day

An employee leaving isn't just an HR matter. It's an access matter. As long as your former colleague still has the password to your website panel, your email, your Google Business Profile or your Facebook page, your business stays exposed: they can change a price, reply to a client in your name, delete a review or, worst case, take full control.

The good news is that a clean disconnect isn't complicated, but it needs to be done in order and, ideally, in a single day. This isn't about distrust; it's about hygiene. Below is a concrete plan, in the order that matters most, plus the mistakes that quietly leave doors open.

Before anything else: list every account

You can't revoke an access you forgot existed. Your first move, first thing in the morning, is to write down every place the person had access:

• the website panel (WordPress, hosting, domain)
• the company email and any aliases
• Google Business Profile and Google Ads
• social media (Facebook, Instagram, TikTok, LinkedIn)
• work tools (Canva, WhatsApp Business, CRM, invoicing, Drive)

Think about indirect access too: a work phone linked to accounts, a 2FA code that lands on their number, a password saved in the browser on the company laptop. If you're not sure whether they had access somewhere, assume they did and check. Checking twice is cheaper than finding out a month later.

The right order: start with the keys that open everything

Not all accounts are equally dangerous. Start with the ones that, once lost, cause the most trouble:

1. Email. It's the master key, because almost every other password resets through it. Change the password, check for hidden forwarding rules and remove them.

2. Domain and hosting. Whoever controls the domain controls both the website and the email. Check who is listed as owner.

3. Google Business Profile. This is where your local reputation lives. Remove the person from managers and make sure the primary owner is you, not them.

Only after these do you move to social media and work tools. If you reverse the order and start with Instagram, someone with bad intentions can reset everything through email while you're busy elsewhere.

Change passwords and cut the 2FA tied to the person

Real revocation means two different things, and many people confuse them.

First: removing the user. Wherever the platform allows separate accounts (Google Business, WordPress, Facebook pages via Business Manager), simply delete their access. It's clean and doesn't disrupt the rest of the team.

Second: changing the password. Where everyone uses a single login and password (many social accounts, free Canva, old mailboxes), the only fix is to change the password.

Watch out for two-factor authentication. If the former employee's phone number or authenticator app is set as the recovery method, they can get back in even after you change the password. Check and remove any recovery method tied to them: phone number, backup email, trusted device.

Don't forget the hidden access that does the most damage

The dangerous part isn't the password you know about. It's the access you forgot:

• Active sessions. Many platforms have a "log out of all devices" button. Use it, otherwise the person stays logged in on their phone even after you change the password.

• API keys and integrations. If you use an invoicing system, a chatbot or a tool that sends automatic emails, there may be a key the former employee generated. Regenerate it.

• Connected apps. In your Google or Facebook account, check the list of third-party apps with access and remove anything you don't recognize.

• Passwords saved in a browser or a shared manager.

Also wipe the work phone or laptop: remove the accounts before handing it over or reusing it.

How to avoid this panic in the future

The best time to prepare for an employee leaving is when you hire them, not when they go. A few simple rules save you a day of stress:

• Give access via separate accounts, in their name, not the shared company password. When they leave, you delete one user.
• Keep an up-to-date list of who has access to what.
• Don't set an employee's personal phone number as a recovery method on company accounts.
• The primary owner of the domain, Google Business and your pages should always be you.

If you feel unsure who has access to what, or that your site and accounts are held by someone else, we can run a check and put your access in order, remotely. At MPO Web Studio we work remotely across the country and explain in plain terms what you own and what needs to be moved to your name. You can message us on WhatsApp anytime.