The short answer: never send your agency, freelancer or web developer your password. Almost every platform a small business uses (your website, Google Business Profile, Google Ads, Analytics, Facebook, Instagram, your email marketing tool and your online store) has a built-in way to invite another person with their own login. You add them as a user, partner, manager or collaborator, give them the lowest level of access that gets the job done, and remove them when the work ends. You stay the owner the whole time.
This guide explains why invited access beats a shared password, what the common access levels mean, and where to find the step-by-step guide for each type of account. It is written for any business owner working with any agency. It is also exactly how we ask our own clients at Ambition Business Solutions to give us access.
Why is invited access better than sharing a password?
Invited access keeps you in control. When someone logs in with their own account, you can see who they are, limit what they can touch and shut off their access in a few clicks without changing anything for yourself or your staff. A shared password does none of that.
- You keep ownership. Your business owns the account, not whoever happens to know the login. If you part ways with a vendor, nothing has to be recovered.
- Two-step verification keeps working. When you share a password, the codes still go to your phone, so you end up texting codes back and forth or turning two-step verification off. Both are bad ideas.
- You can limit the damage. A person who only needs to run ads does not need the power to delete the account or change billing.
- There is a record. Many platforms log which user made a change, which matters if something goes wrong.
- Removing access is clean. You remove one person instead of changing a password everyone else uses.
- It follows the platform’s rules. Many platforms’ terms say each person should use their own login, and some lock accounts that show logins from unfamiliar places.
What do the different access levels mean?
Most platforms use some version of three tiers: owner, manager and viewer. The names change from platform to platform, but the idea is the same, and the rule is simple: give the lowest level that lets the person do the work.
- Owner (sometimes called primary owner, super admin or account owner): full control, including billing, adding and removing users and deleting the account. This should be you, and ideally one other trusted person inside your business.
- Admin or manager: can do the day-to-day work, such as editing content, running campaigns or answering reviews, but usually cannot remove the owner or transfer the account. This is the right level for most agencies.
- Editor, standard or limited user: can change some things but not settings or users. Good for a writer or a freelancer with a narrow task.
- Viewer or read-only: can see reports but change nothing. Good for a bookkeeper, a consultant or anyone you want to show results to.
A quick example of the difference: on Google Business Profile, a Manager can edit your hours and reply to reviews, while an Owner can also add or remove other people. Your agency almost never needs to be an owner.
Before you start: a quick checklist
Gather these few things first and each invitation takes only a couple of minutes.
- Make sure you can log in to each account yourself, as the owner or an admin.
- Turn on two-step verification on your own login if it is not on already.
- Ask your agency which accounts they need and what level of access for each.
- Enter the email address your agency gives you for invitations. Some agencies use one shared address for client access so nothing is tied to a single employee.
- Write down what you granted and when, so you know what to remove later.
How does the process work on almost every platform?
The menus differ, but the pattern is nearly identical everywhere. Once you have done it on one platform, the rest feel familiar.
- Log in to the account as the owner or an admin.
- Open the settings area. Look for a menu labeled Users, People, Team, Permissions, Partners or Access.
- Choose the option to add or invite a user.
- Enter the email address your agency gives you.
- Pick the access level. Start with manager, admin or a limited role rather than owner.
- Send the invitation. Your agency accepts it from their own login.
- Confirm with your agency that they can see what they need, then note the date in your records.
The guides below walk through the exact menus for each platform, with a link to that platform’s own help page so you can check the current steps.
How do you give access to your website and hosting?
On a WordPress site, you add your agency as a new user and choose a role, usually Administrator for a developer or Editor for a content writer. Hosting companies, domain registrars and website builders such as Wix and Squarespace each have their own contributor or team access. Our guide on how to give website and hosting access covers WordPress, Hostinger, GoDaddy, Wix, Squarespace, Cloudflare and Namecheap.
How do you give access to your online store?
Store platforms let you add staff or collaborators with permissions you choose, so an agency can work on products, pages or marketing without seeing payouts or owning the store. Our guide on how to give online store access covers Shopify staff and collaborator accounts, the WooCommerce Shop Manager role, Wix Stores and Squarespace Commerce.
How do you give access to ads and analytics?
Google Ads, Google Analytics, Search Console and Tag Manager each let you add a user with a role, and Meta ads are shared through partner access in your Business portfolio. Read-only access is often enough for reporting, while someone running your campaigns needs standard or admin access. Our guide on how to give ads and analytics access covers Google Ads, Google Analytics 4, Search Console, Tag Manager, Meta Ads and Microsoft Advertising.
How do you give access to email marketing and your CRM?
Email and CRM tools hold your customer list, so it pays to be careful here. Most let you invite users with roles that limit exports, billing or account settings. Our guide on how to give email and CRM access covers Mailchimp, Constant Contact, HubSpot, Klaviyo and, when it is truly needed, Google Workspace.
How do you give access to social media?
For Facebook and Instagram, you add your agency as a partner in your Meta Business portfolio instead of handing over a personal login. LinkedIn, TikTok, YouTube and Pinterest all have page or channel roles you can assign. Our guide on how to give social media access walks through each one.
How do you give access to Google Business Profile and other listings?
Your Google Business Profile is one of the most valuable things you own online, so add your agency as a Manager, not an Owner. Yelp, Bing Places and Apple Business Connect have their own user options too. Our guide on how to give Google Business Profile and listings access covers all four. If you want help getting the profile itself in shape, see our Google Business Profile optimization services.
Common mistakes
Most access problems come from a handful of habits that seem harmless at the time.
- Letting a vendor create the account in their name. If a web designer or ad agency set up your Google Business Profile, Analytics or domain under their own login, you may not truly own it. Ask them to make you the owner now, while the relationship is good.
- Giving everyone owner access. It feels simpler, but it means anyone can remove you. Keep owner access inside your business.
- Using a personal email for the owner login. Use a business address you control, so the account does not leave with an employee.
- Turning off two-step verification so a vendor can log in. If someone needs in, invite them instead.
- Forgetting to remove old vendors. Review your users a couple of times a year and remove anyone who no longer works with you.
- Inviting the wrong address. Copy and paste the email address your agency gives you rather than typing it from memory.
Here is a hypothetical scenario that shows why this matters. Say you run a landscaping company and hired a freelancer years ago who set up your website and domain using his own account. He has since moved on and does not answer messages. Now your domain is up for renewal and you cannot log in to renew it. Getting it back can be slow and stressful. If he had been invited as a user on an account you owned, you would simply remove him and carry on.
Keeping your accounts in your own name is also part of good website care. Our website maintenance plans include keeping logins, users and backups organized so you are never locked out of your own site.
Frequently asked questions
Is it ever okay to share my password with my agency?
No. Every major platform a small business uses has a way to invite another person. If a vendor insists on your password, treat that as a warning sign and ask why their own login will not work.
What access level should I give a marketing agency?
Usually manager, admin or standard access, depending on the platform. That lets them do the work without being able to remove you or change billing. Owner access should stay with you.
What if my agency created the account for me?
Ask them to add you as the owner, or transfer ownership to you, then step their own access down to manager. A good agency will be glad to do this.
How do I remove access when the work ends?
Go back to the same Users, People or Partners screen where you sent the invitation, find the person or company and choose remove. It takes effect right away and does not affect your own login.
Does giving someone access affect my search rankings or ads?
No. Adding or removing a user changes who can log in, not how the account performs. Nothing about your listing, website or campaigns changes until someone actually edits it.
Not sure which accounts you have, who owns them or what access your marketing actually needs? Book a free strategy call and we will help you sort it out, step by step, without ever asking for a password.
