Old credentials that were never revoked are a frequent route into hosting accounts, sometimes years after the person's involvement ended.
THE CHECKLIST
cPanel: delete their FTP accounts. Change the main cPanel password if they ever had it.
- Email: delete or reset the password on their mailbox, and convert it to a forwarder if you still need mail sent there.
- Website: delete or demote their administrator account. Do not just change the password.
- Database: remove any database user created for them.
- SSH: remove their authorised key.
- Client Area: remove any sub-account or contact access.
- Third parties: revoke access to your domain registrar, Cloudflare, payment gateway, analytics and any API keys you issued.
- Cron jobs: check for scheduled tasks they added.
ALSO WORTH DOING
Take a backup at the point of handover. Review recent file changes. Check for new administrator accounts you did not create. Change any shared password they knew, even if you think they never used it.
None of this implies wrongdoing. A former contractor's own computer may be compromised later, and their saved credentials for your site become an attacker's credentials. Revoking access closes that path entirely.
