The shared login (for Reetta)

This page is for Reetta, who decides who has access, and Katja, who publishes the site. Staff don't need it for everyday editing.

San Francisco chose one shared admin login over separate limited accounts. It's simpler to run. The trade-off is weaker security, and no limits on what anyone can change. Here are the risks, then the habits that keep them small.

Security risks

• The password is the only lock: Best practice is two-step login, where a code from a phone app is needed on top of the password. Webflow's two-step login is off unless someone switches it on, so by default anyone with the password is in.
• One person can lock everyone out: Anyone logged in can switch on two-step login in Account settings. The codes then come from an app on that person's phone, and nobody else can log in without them.
• People who leave keep access: A former colleague or freelancer can still log in until the password is changed. Nothing tells you they did.
• The password spreads: Shared passwords end up in Slack threads, notes and browsers on personal laptops. Every copy is a way in.
• One slip exposes everything: If anyone falls for a fake login page or reuses the password elsewhere, the whole account is exposed.
• It opens more than the site: The same login reaches site settings, domains, form data and billing.

Editing and management risks

• Nothing is locked: The login that adds a blog post can also delete a collection, change a style used on every page, or remove the code that runs the cookie banner and analytics.
• No review before going live: Publish now sends an item straight to the site. There's no approval step.
• A whole-site publish ships more than you see: It sends every Designer change made since the last publish, including half-finished work or an accidental drag, plus any items queued for it.
• No record of who did what: Every change shows the same name, so tracing a mistake back to a person is guesswork.
• People overwrite each other: Two people editing the same item at the same time can undo each other's changes without noticing.
• Some fixes cost more than the mistake: A deleted item usually comes back only by restoring a backup, which rolls back the whole site. Account-level changes (password, two-step login, domains, billing) aren't covered by backups at all.

Habits that keep the risks small

1. Reetta keeps the list of who has the login, and shares it only through the password manager.
2. Change the password whenever someone with access leaves the company or the website work.
3. Only Katja publishes the whole site, after checking the test site. Everyone else uses Publish now.
4. Agree two-step login as a team before anyone switches it on, and decide whose phone or which shared app holds the codes.
5. Before a big change, Katja saves a backup in the Designer with Cmd/Ctrl + Shift + S.