Here’s a quick WordPress tip. (And really, it applies to all sorts of other systems too.)
Each site editor should have their own user account, and each user account should belong to an individual.
Particularly at small organizations, I often see shared or generic user accounts like “marketing” or “staff.” However, this is a bad idea.
Here are four reasons why:
- Security – A shared password is a big flashing red warning sign that your system isn’t as secure as it could be since many people need it and who knows how they’re storing it. In my experience, shared passwords also tend to be less complex. Furthermore, giving each user their own account allows you to follow the security principle of least privilege: each user should only have access to the features they need. ((I also finds that this often improves the usability of a tool. In WordPress, if a person doesn’t need to be an Administrator, making them an Editor reduces the available functions in the menu by about half, making it much easier for them to find what they need.))
- Logistics – If a user forgets their shared user account’s password, where does the reset email go and how do they make sure everyone with access knows it has changed? ((Worse yet, how does that user prevent the next user from resetting it again because now they don’t know the password. This is a vicious cycle, folks.)) There is no good answer to this question.
- Staff Administration – If someone leaves an organization or site, it’s easy to delete a single user. It’s much more complicated to remove their access to a shared account.
- Attribution – CMSes often use user accounts to track and display content creation and editing. This is useful for site visitors to know who wrote something and useful for edit-tracking in the case of a site audit or internal collaboration.
Most user accounts were never intended for shaing, so they don’t make sense when used that way. A group of people can’t fill out a Last Name field or single Twitter handle. ((In WordPress, each user gets to choose their own color scheme. Who gets to choose it for shared accounts. Probably overheard somewhere: “Ok this is getting ridiculous, who keeps setting the “admin” account to use Ectoplasm!))
So don’t give Jane Smith and her colleagues ((Especially not Janice in accounting (contains foul language).)) “admin” (for many reasons) or “marketingteam.” She should get “jane” or “smith” or “smithjane” or “jsmith” or “techwizard.” Whatever it is, it should belong to her. If your organization has a standard email address scheme, that’s an easy thing to reuse (e.g. jsmith@example.org).
As best I can tell, there are no advantages to sharing user accounts when considering the above. (If you think there are, yell at me in the comments!) It may feel easier at first to share accounts, but it rarely ends well. Trust me, I’ve been been on both ends of this one.
A Quick Note to WordPress Users
If you decide to take my advice and convert your WordPress site to use individual user accounts, you should delete your old users but do so with EXTREME caution. By default, when you delete a user, you delete all the content they created. Seriously. It’s a terrible default but it is what it is.
So when deleting an account, make sure to attribute the content to a user who will be around for a while.
