Do not share an administrator account
When multiple people operate a website together, independent operator accounts should be created for different members and roles should be assigned according to job responsibilities. This can reduce password sharing and make it easier to adjust permissions and track records when personnel changes or abnormal operations occur.
Roles and Operators
First create a role and select the functions that allow operations, then create an operator and bind the corresponding role. Product editing, order processing, content operation and system configuration do not necessarily require the same permissions.
role management Operator management View operation records
principle of least privilege
- Content staff are only given product, page, blog and necessary media rights.
- Customer service is only given the necessary permissions to handle customers, inquiries or orders.
- Payments, refunds, system setup, key and operator management are left only to the clearly responsible person.
- Temporary collaborators use separate accounts and deactivate them promptly after the task is completed.
Account and key security
- Use unique, strong passwords that are not reused across multiple services.
- Passwords, verification codes, payment vouchers and API Token are not written into public documents or general group chats.
- Third-party accounts should be held by corporate entities as much as possible, and recovery methods and person-in-charge information should be saved.
- When an abnormality in the account is discovered, personnel leave the company, or equipment is lost, the account will be deactivated immediately and relevant credentials will be replaced.
Change current account password
Regular inspection
- Check monthly for operators, roles, and third-party connections still in use.
- Review whether the high-privilege account still requires the current scope.
- Check for abnormal logins, batch modifications, deletions, refunds, and configuration changes.
- Important changes retain the change description, person responsible and verification results.
Safety reminder:Permission adjustments affect whether people can access data and perform actions. The account identity, responsibilities and required scope should be checked before modification, and super permissions should not be granted for a long time just for convenience.