In the early stages of a web development agency, operations are often defined by speed. When a team consists of two or three people, access management is frequently relegated to the status of a "habit" rather than a formal business process. It is common practice to share admin credentials because it saves time, grant company-wide access to contractors because site-level configuration feels burdensome, and leave former collaborators in the system because offboarding isn’t deemed an immediate priority.
However, these tactical shortcuts—often dismissed as minor efficiencies—eventually calcify into structural templates for every subsequent project. By the time a client identifies an unauthorized change or a former contractor is found to still hold keys to a live environment, the pattern of "access sprawl" has likely permeated the agency’s entire portfolio.
Client access management is a "silent" operational risk: it scales alongside your agency without drawing attention to itself, only to surface at the most inopportune moment. To survive the transition from a boutique shop to a scaled operation, agencies must treat permission modeling with the same rigor as their development workflows.
The Chronology of Access Sprawl
Access sprawl typically begins with a single, seemingly benign decision. A project manager, pressed for time, shares an admin password with a client to expedite a review, reasoning that the ten minutes required to set up a dedicated, restricted account are better spent on billable development.
This initial act sets a precedent. Soon, a contractor is granted "Company Developer" status across the entire agency account because creating site-specific permissions feels like an unnecessary hurdle during a hectic onboarding call. At this stage, the risks are theoretical. But within 12 to 18 months, an agency managing twenty client sites may inadvertently host a dozen users with elevated permissions that were never explicitly authorized.
The danger is cumulative. Each unchecked permission becomes a latent vulnerability—a dormant account that, if compromised, provides a lateral pathway into sensitive client data or infrastructure. The issue is rarely negligence; it is the natural consequence of prioritizing immediate convenience over long-term structural integrity.
Decoding the Dual-Layer Permission Ecosystem
A critical error made by many agencies is the failure to distinguish between the two distinct layers of access: the hosting environment and the application dashboard. At Kinsta, these are handled by separate systems that must be managed in tandem.
The MyKinsta Hosting Layer
MyKinsta utilizes a robust role-based access control (RBAC) system featuring four company-level roles and two site-level roles.
- Company Roles: These are high-level, encompassing administrative functions, billing management, and global site oversight.
- Site Roles: These are the primary tools for containment. By granting access at the site level rather than the company level, agencies can ensure that a client or contractor only interacts with the specific environment they are tasked with improving.
The WordPress Application Layer
WordPress roles—such as Administrator, Editor, or Author—function entirely independently of the hosting platform. A common "permission trap" occurs when an agency grants a user both Site Administrator access in MyKinsta and WordPress Administrator access simultaneously. This gives the user unrestricted control over both the server’s configuration and the website’s content/plugins.
For security and operational stability, the rule must be: grant the minimum access necessary for the specific task at hand. A client updating a blog post does not need server-level permissions; a contractor debugging a theme does not need access to the agency’s billing dashboard.
Supporting Data: The Cost of Manual Management
Manual management is the antithesis of scalability. When permissions are handled on an ad-hoc basis, the likelihood of human error increases exponentially.
Consider the "contractor offboarding" scenario. Removing a user from the MyKinsta dashboard is a necessary first step, but it is insufficient. It does not automatically revoke API keys or rotate SSH/SFTP credentials. These are distinct security artifacts that, if left untouched, remain valid entry points.
Key Security Checklist for Offboarding:
- Activity Log Review: Filter the logs by the departing user’s name. This provides a granular audit trail of their last actions, allowing the agency to verify that no malicious or accidental changes were made before their access is fully severed.
- API Key Revocation: Navigate to Company Settings > API Keys to identify and purge keys generated by the former user.
- SSH/SFTP Rotation: Regenerate credentials at the site level to ensure that any previously cached connection methods are rendered useless.
Agencies that rely on institutional memory rather than a written access policy inevitably suffer from "permission rot." A simple, standardized table that maps project roles (Owner, Senior Dev, Contractor, Client) to specific permission levels is the most effective antidote to this drift.
Official Perspectives: Shifting the Agency Mindset
Industry leaders in the digital space, such as the Organic Media Group, emphasize that clear access structures are not just security features—they are tools for operational efficiency. By providing clients with the specific tools they need and nothing more, agencies reduce the volume of support tickets and minimize the risk of accidental site breakage.
"I can throw somebody new in there, and they can manage a couple of these accounts with no problems," a representative from Organic Media Group notes. This scalability is only possible when the underlying infrastructure is predictable. When a new hire or a new contractor joins, they should inherit a clear, pre-defined scope of access rather than being granted "admin-by-default."
The Strategic Implications of Access Hygiene
The way an agency manages access sends a signal to its clients. A chaotic, over-privileged environment suggests a lack of process, which can erode client trust. Conversely, a clean, scoped environment demonstrates that the agency treats the client’s infrastructure with the same level of care as its own.
The Power of Transferability
When a project reaches its natural conclusion, the most professional offboarding step is not just removing users, but transferring the site itself. Kinsta’s "Transfer Site" functionality allows agencies to hand over full ownership to the client’s own account. This effectively severs the agency’s liability and ends the "access sprawl" by moving the asset entirely out of the agency’s hosting ecosystem.
Quarterly Audits as a Baseline
To move from habit to process, agencies should institutionalize a quarterly access review. This involves:
- User List Reconciliation: Export the full user list from Company Settings > Users and cross-reference it against active project contracts.
- Credential Refresh: Rotate keys and verify MFA status for all remaining users.
- Infrastructure Cleanup: Remove any sites or environments that are no longer in active development.
The Role of 2FA and Modern Authentication
In the modern security landscape, multi-factor authentication (MFA) is the baseline. Agencies should enforce 2FA across the entire team. Because Kinsta supports both email and authenticator app verification, there is no technical barrier to achieving 100% 2FA adoption. This single step serves as a critical safety net should a set of credentials be compromised through phishing or other social engineering tactics.
Conclusion: Process Over Habit
The transition from a small team to a mature agency is paved with the need for systemic discipline. Access management is not a bureaucratic burden; it is a fundamental pillar of relationship infrastructure. By adopting a rigid, policy-driven approach to permissions—using site-level scoping, regular audits, and proper offboarding protocols—agencies protect their reputation and their clients’ assets.
The objective is to reach a state where the agency is no longer a collection of individuals sharing passwords, but a professional entity operating with standardized, secure, and transparent protocols. When a contractor can only access staging, and a client is empowered to update their content without the danger of altering server-level settings, the agency is no longer just "building websites"—it is managing a secure, scalable business.
For agencies ready to formalize their operations, leveraging the tools provided by the Kinsta Agency Partner Program ensures that these best practices are supported by dedicated resources, co-selling opportunities, and a platform built to handle the complexities of multi-site management at scale. The goal is simple: ensure your agency’s growth is defined by your expertise, not by the vulnerabilities accumulated along the way.
