Skip to main content
Cookbook Security

Safely Offboard a Former Developer or Admin with AI

Demote the departing account, reassign their content so nothing is orphaned, and kill their old credentials.

Difficulty Intermediate
Time ~15 min
Tools rest_api

Prerequisites

A connected site, a recent backup, and the username or email of the person leaving.

The prompt
A developer or admin named [their username or email] has left and I need to offboard their account safely on [your-site-url]. Do not break plugins or lose their content.

Confirm I have a recent backup before you make any change. If I do not, stop and tell me to take one.

1. Show me the account first: their user ID, role, email, how many posts and pages they authored, and any application passwords on the account. Do not change anything yet.

2. List my other administrator accounts so I can confirm which one should inherit their content. I want to keep [your username].

3. After I confirm, reassign every post and page they authored to [your username]. This is reversible, so show me the list before and after.

4. Lock the departing account: change its role to Subscriber, reset its password to a long random value, and revoke any application passwords so old logins and API tokens stop working. If I tell you to fully delete it instead, walk me through doing that in wp-admin with content reassigned.

5. Give me the final step to run myself: rotating the site's secret keys and salts (in my host dashboard or wp-config) to force every existing session to log out, since that cannot be done from inside WordPress.

At the end, list every change you made and every account you touched so I can spot-check.

Already connected to WPVibe?

Skip the copy-paste. Just ask your AI for the “Safely Offboard a Former Developer or Admin with AI” recipe, or describe the task, and WPVibe runs these steps on your own site.

A freelancer wraps up the project, or an employee moves on, and their administrator account just stays behind. It can still log in, it still carries whatever application passwords and API tokens they set up, and it still owns every post and page they built. Removing it keeps getting put off because deleting an admin who authored half your content feels risky, and nobody is sure what quietly breaks when that account disappears.

Connected to your site, the AI reviews your admin and editor accounts, then reassigns everything the departing person authored to an account you keep, so no content is left orphaned. It demotes their account to a role that cannot change the site, resets its password, and revokes its application passwords so old credentials and tokens stop working. Every step is reversible and shown to you first: it reassigns authorship rather than deleting anything, and it lists the account’s content and credentials before it touches them.

Take a backup first, then paste the prompt and name the person leaving and who should inherit their work. The AI walks the account back to Subscriber, moves the content, and cuts the credentials, listing each change for you to spot-check. The one thing it cannot do from inside WordPress is rotate your secret keys and salts to force every open session to log out, so the prompt hands you that as a final step to run in your host panel or wp-config.

Outcome

The former developer account is demoted with revoked credentials, and all their content belongs to an account you keep.