How to remove website access when an employee leaves, step by step
Taking someone out of the website builder is the easy part. The harder part is everything they connected along the way: a Slack webhook made under their name, a Google Sheet shared from their drive, form notices going to their inbox. To remove website access when an employee leaves properly, work through four layers in order: the workspace, the connected tools, the notifications, and a look back at what changed recently.
Before their last day
If the departure is friendly, use the notice period. Ask the person to list every website-related account they hold or created: the builder, the domain registrar, the payment provider behind your buy buttons, the CRM, any spreadsheet that collects enquiries, and any API key or webhook they generated. Ask them to hand over anything only they can reach. If the departure isn't friendly, do the workspace step first and the rest the same day.
The offboarding sequence
- Remove them from the Team workspace. An admin or the owner can remove a member; only the owner can remove an admin. Once removed, they lose access to the workspace's projects, including through the CLI or a connected chat assistant, which use their own account. Cancel any pending invitations they sent that nobody accepted, since those count as seats.
- Revoke review links they created. Client review links work for anyone who holds them until they expire (14 days by default). The owner or an admin can revoke any link; revoke those still active and make new ones if a review is under way.
- Rotate connector credentials they set up. Connector details are sealed and write-only, so nobody can read them back, but the leaver may still hold the original: a Slack webhook URL, an Airtable or Notion token, a HubSpot key. Create a new one at the provider under a business account, enter it in the connector, then delete the old one at the provider. Use "Send a test" to confirm the new one works.
- Check site functions. If a custom form calls an endpoint they built or host, move that endpoint under the business's control and generate a new signing secret.
- Move form notices. The "Email me when a form is sent" setting sends to the address shown beside it. If enquiries were forwarded from there to the leaver's mailbox, change the forwarding, and check any rules in their mailbox that copied enquiries elsewhere.
- Reclaim shared data. Make sure Google Sheets or Airtable bases that receive submissions are owned by a business account, not the leaver's drive, which may be deleted with their account.
- Review recent changes. Open version history and preview the versions saved in their last weeks. Restore an earlier one if anything was changed that shouldn't have been, then publish.
- Change passwords to anything shared. The registrar, the payment provider, social accounts linked from the site. Make sure two-factor sign-in on each is tied to a device the business keeps.
A checklist to keep
| System | Action | Done by |
|---|---|---|
| Anticode Team workspace | Remove the member; cancel stale invitations | Admin or owner |
| Review links | Revoke active links they made | Admin or owner |
| Connectors (Slack, Sheets, Airtable, Notion, HubSpot, Mailchimp, Kit, webhooks) | New credentials, old ones deleted at the provider | Workspace owner |
| Form notice email and forwarding | Point at a shared inbox | Owner |
| Domain registrar | Password and two-factor changed | Owner |
| Payment provider | Remove their user; check the payment link still opens | Owner |
| Version history | Last month's versions previewed | Publisher |
How you know it's done
The leaver no longer appears in the workspace's member list. A fresh test enquiry arrives in every connected tool through credentials the business created. Form notices reach a shared inbox. Nothing in recent versions surprises you. Repeat the same list, in the same order, for every departure; it's quicker the second time.
What Anticode doesn't cover
Anticode can remove someone from a workspace and lets you replace connector details, but it can't revoke keys at Slack, Google or HubSpot for you, and it doesn't keep an activity log of who made each edit beyond what version history shows. The submissions access log records the last 200 reads, exports and deletes of form data, which is worth a look if the person had access to enquiries. Your registrar, payment provider and CRM have their own user lists to clean up. For setting up a workspace that makes this easier, see setting up a team website workspace and team workspaces.
Questions people ask
Does removing someone from the workspace stop their CLI or chat-assistant access?
It stops access to the workspace's projects, because those tools act as their own account. Anything left in their personal account stays theirs.
Can they still see form submissions after removal?
Not in Anticode. They may still see copies in tools they connected, such as a sheet in their own drive, which is why those should be moved.
Do I need new API keys when an employee leaves?
For any key or webhook they created or saw, yes. Make new ones under a business account and delete the old ones at the provider.