Creating and Managing User Accounts

Setting up your website begins with getting the right people access. Whether you are creating your own admin account, inviting team members, or setting up customer accounts for an online store, this guide walks you through every step of account creation and management.

1. Types of User Accounts

There are two broad categories of accounts on your website:

2. Setting Up Your Admin Account

Your admin account is created during your website's initial setup. After launch, secure it properly:

1. Change the default admin username

   If your platform defaults to "admin" as the username, change it immediately. Automated attacks commonly target this username.

2. Set a strong, unique password

   Use a password manager to generate a password of at least 16 characters. Never reuse passwords from other services.

3. Use your business email address

   The admin account should use a business email (e.g., yourname@isusoworks.ca) rather than a personal Gmail or Yahoo address.

4. Enable two-factor authentication

   This is your most important security step. See our 2FA guide for setup instructions.

3. Inviting Team Members

To give a colleague or contractor access to your website backend:

1. Go to Users in your dashboard

   Navigate to Users > Add New or Team > Invite Member.

2. Enter their name and email

   Use their professional email address. This is where the invitation and system notifications will be sent.

3. Assign the correct role

   Choose the minimum role needed for their work. See our User Roles guide for a detailed breakdown of permissions.

4. Send the invitation

   Click Invite or Add User. The team member receives an email with a link to set their password. The link typically expires after 24-48 hours.

4. Customer Account Registration

If your website has an e-commerce store, membership area, or requires login to access certain content, customers can create their own accounts. Configure this in Settings > Accounts or Settings > General:

• Allow Registration: Enable this to show a registration link to visitors
• Default Role: Set new customer accounts to Subscriber or Customer role only
• Email Verification: Require customers to verify their email before their account is activated. This prevents fake or mistyped email addresses.
• Account Page: Create a dedicated "My Account" page where customers can view order history, update their address, and change their password

5. Password Resets and Account Recovery

When a team member or customer cannot log in:

Self-Service Password Reset

Most platforms include a "Forgot Password?" link on the login page. The user enters their email, receives a reset link, and sets a new password. This is the preferred method as it does not require admin involvement.

Admin-Initiated Reset

If the user no longer has access to their email, an admin can manually set a new password from Users > Edit User. After resetting, notify the user through a secondary channel (phone or another email address).

6. Deactivating and Deleting Accounts

• Deactivate (preferred for team accounts): Changes the account status to inactive. The user cannot log in but their content history is preserved. Useful when someone goes on extended leave.
• Delete: Permanently removes the account. You will be prompted to reassign any content they authored to another user. This action cannot be undone.
• Customer account cancellation: Customers may request account deletion under privacy laws (e.g., GDPR, PIPEDA). Accommodate these requests promptly and document that you did so.

7. Summary

A well-managed user system keeps your website secure and your team organized. Key takeaways:

• Secure your admin account with a strong password and 2FA from day one
• Invite each team member with their own account and the lowest role they need
• Require email verification for customer self-registration
• Remove or deactivate accounts when team members leave
• Conduct a user audit every quarter