Give every person their own account and the smallest role that lets them do their job. Sharing one administrator login is the most common cause of "we don't know who changed it".
Adding a user
- Go to Users → Add New.
- Enter a username and email address — both must be unique on the site.
- Choose a role and click Add New User.
The roles
- Administrator — full control including plugins, themes and other users. Give this to as few people as possible.
- Editor — publish and edit anyone's posts and pages.
- Author — publish and manage their own posts only.
- Contributor — write posts but cannot publish them or upload images.
- Subscriber — profile only; used for membership and comment features.
Housekeeping
Review Users → All Users periodically. Remove accounts for people who have left, and treat any administrator you do not recognise as a sign of compromise. When deleting a user, WordPress asks whether to delete their content or reassign it — usually reassign.
