Lock Down Your Store Admin: Logins and Permissions

The admin login is the front door to everything: orders, customer details, payment settings and the content visitors see. Most break-ins do not involve clever hacking. They involve a reused password, a shared login or a phishing message that looked convincing. The steps below take an hour or two and make a real difference. Examples follow Shopify’s help documentation, but the principles carry over to WordPress and most other platforms.

Step 1: give every account its own strong password

Use a different password for each account, including accounts that seem related.
Let a password manager create and remember them, so you only need to recall one master password.
Shopify notes that it locks accounts whose credentials turn up in known data leaks until the password is reset. You can check your own email address on the Have I Been Pwned website to see whether you appear in one.
Never hand out your own login to a colleague, freelancer or family member.

Step 2: turn on two-step sign-in, for yourself and your team

Two-step authentication asks for a second proof of identity after the password, so a stolen password alone is not enough. According to Shopify’s documentation, supported methods include an authenticator app, a security key, the built-in authenticator and passkeys. Existing users of text-message codes can keep them, but new setups use the other methods. You can also add a backup method.

Things worth knowing:

Each staff member sets this up on their own account. As the owner you cannot switch it on for them, so ask and check.
If you use Shopify Payments, two-step authentication must be active, and payouts may be put on hold without it.
Download your recovery codes and keep them somewhere safe that you can reach from another device. They are your way back in if you lose a phone.
Protect your email account the same way. Password resets go to your inbox, so whoever controls the inbox can often control everything else.

Step 3: one person, one account

Shared logins make it impossible to know who changed what and impossible to remove one person’s access without disturbing everyone. Add each person as a separate staff member instead. When a contractor finishes, remove their account the same day.

Step 4: give the smallest permissions that do the job

Shopify describes a group of sensitive permissions that open up private financial and customer data, such as editing billing methods or requesting customer data. Their advice is to grant these only to your most trusted people, and to spread sensitive tasks across several roles so that no single account becomes the one weak point. A part-time helper who answers customer emails does not need access to payment settings. On WordPress, the equivalent habit is choosing the lowest user role that lets someone do their work.

Put a recurring reminder in your calendar, perhaps quarterly, to review:

Who currently has a staff or collaborator account
What each person can do
Which apps and custom integrations are installed, and whether you still recognise each one

Step 5: learn to spot phishing

Shopify’s guidance says its support team will never ask for your password. Treat any message that does, whether by email, phone or text, as suspicious. Also be careful with unusual orders and draft orders. Shopify suggests confirming them with the customer before fulfilling, to avoid chargebacks later.

Know the login alerts

You may receive an email with a ten-digit code if a sign-in looks unusual, or an email telling you that a new device has signed in. Shopify’s help page explains that answering “this wasn’t me” should be followed by a password reset before you log in again. Do not ignore these messages, and do not approve one you did not trigger.

If you think your account was compromised

Contact the platform’s support straight away.
Secure your email account first, then change the store password.
Re-enable two-step authentication, using a different device if the old one may have been defeated.
Review login activity, staff accounts and permissions.
Check the activity log for changes you do not recognise, plus store contact details, uploaded files, installed apps, discounts and any marketing campaigns you did not start.
Verify suspicious orders with the customer.

When it is time to call a developer

Get professional help if you find changes you cannot explain, such as unknown apps, new code in your theme, odd redirects or discount codes you did not create. The same goes if you need a careful audit of every integration with access to store data, or custom roles built to match how your team works. You can read about what we can help with on our services page.