Social media account access mistakes: who holds the keys?

Key takeaways

Losing access to a business social media account usually comes from three mistakes: only one admin, logins held by a former employee or agency, and accounts registered to a personal email. Make the business the owner, keep at least two admins from inside the business, and give staff and agencies role-based access.

• At least 2 admins from inside the business on every account.
• Register accounts to a business email, not a personal one.
• Give agencies partner access, not your password.
• Remove access the day someone leaves.

Why is account access a marketing mistake?

Account access is a marketing mistake because the page, its followers, reviews and history are business assets. If the only admin leaves, falls out with you or loses their phone, the business can lose all of it. Recovery through platform support is slow and not guaranteed.

• The most common social media marketing mistakes small businesses make
• Who owns the content your social media agency makes?

What are the common access mistakes?

The common mistakes are one admin, shared passwords, accounts set up on a former employee's email, agencies creating pages under their own business account, and nobody removing access when people leave.

• One person as the only admin.
• A shared password in a group chat.
• Personal or ex-staff email as the login.
• Agency-owned page or ad account.
• No list of who has access.

How do you fix account access?

Keep a simple list of every account, its login email and its admins. Move logins to a business email. Add a second internal admin. Use platform business tools, such as Meta Business Suite, to give staff and agencies roles rather than passwords. Turn on two-factor authentication for every admin.

• Social media security mistakes that get accounts hacked

When is giving an agency full access reasonable?

Giving an agency admin access is reasonable while they run the account, as long as the business also stays an admin and owns the page and ad account. The test is simple: if the agency vanished tomorrow, could you still log in and run everything?

How do you audit account access in ten minutes?

Audit access by opening the settings of each business account and listing every admin, the login email and whether two-factor authentication is on. Then mark anyone who has left, any personal email logins and any account with only one admin. Those three marks are the fixes, in that order.

• Admins who have left the business.
• Logins on personal email addresses.
• Accounts with only one admin.
• Agencies with ownership rather than roles.

What does this look like in practice?

A pattern we see: a business page created years ago by a former marketing assistant, still the only admin, now unreachable. The fix is slow. Adding a second internal admin and moving logins to a business email takes ten minutes and prevents it.

• See client work
• Social Media Marketing for UK businesses

Access checklist

• List every account and its admins.
• Use a business email for logins.
• Keep two internal admins.
• Give roles, not passwords.
• Remove access when people leave.

• Instagram bio mistakes that stop people enquiring
• Social media security mistakes that get accounts hacked

Next step

Open the settings of each business account today and write down every admin. Anyone you do not recognise or who has left should be removed.