In a lot of small property offices, the website has one login. The password is written on a sticky note, or saved in a WhatsApp group called "Office", and everyone uses it: the owner, the two agents, the part-time photographer, the nephew who helped set it up.
It works until somebody leaves. Then a person who now works for a competitor in the same market still has the password to your website and, often, to every enquiry you have ever received.
One person, one login
The first rule is simple. Every person who works on the site gets their own login, with their own email address and password. No sharing.
This gives you three things a shared password cannot:
- You can remove one person without changing everyone else's access.
- If your system keeps a history, you can see who added, changed or deleted something.
- Nobody can say "it wasn't me" when a listing goes missing.
It also limits the damage when something goes wrong. If an agent's phone is lost or stolen, you remove one login and everyone else carries on working. With a shared password, one lost phone means changing it for the whole office, and hoping nobody used it in the meantime.
If your current website only allows one login, that is a real limitation. It belongs on your list of questions to ask any website provider before you buy, or before you renew.
Give each person only what they need
Security people call this "least privilege": give each person the smallest amount of access that lets them do their job. In plain words, the photographer does not need to see your leads, and the accountant does not need to delete listings.
A reasonable split for a small office in Indore might look like this:
- The owner: everything, including billing, settings and who has access
- An office manager: listings, enquiries and website content
- Agents: add and edit listings, and work on enquiries
- A photographer or data-entry help: add listings as drafts, nothing more
- An outside accountant: invoices only, if your system allows it
Better systems let you set this per person rather than all or nothing. On ours, for example, there is a role that can add properties as drafts but cannot publish them or see enquiries. Whatever you use, ask the provider to show you how access levels work before you sign.
Leads are the crown jewels
Your enquiry list is the most valuable information your business holds. It is also the easiest thing to walk out with.
Decide deliberately who can see every enquiry and who should only see their own, if your system supports that. Decide who can download the full list as a spreadsheet. For most offices, the answer to that second question should be the owner and perhaps one trusted manager.
The same thinking applies to enquiries that arrive on phones and WhatsApp rather than through the website. We cover how to keep those in one place in using WhatsApp for enquiries without losing track.
Keys that stay with the owner
Some logins should never be handed to staff at all, however trusted they are:
- The domain registrar account, where your web address is registered
- The email account for your domain
- Billing with your website provider
- Ownership of your Google Business Profile (you can add others as managers)
If any of these are currently in an employee's name, or an ex-employee's, fixing that is urgent. The same goes for a developer who set things up in their own account. When an outside developer or agency does need access for a job, give them their own login for the duration, and remove it when the work is finished. We explain why ownership matters so much in who owns your leads and listings if you switch providers.
The day someone leaves
Have a short routine for the day someone leaves, and follow it that same day, not next week.
- Remove their website login.
- Change any shared password they ever knew, including email and Wi-Fi.
- Reassign their open enquiries to someone else.
- Check that the listings they managed still show a phone number that works.
- Remove them from any WhatsApp Business account or group used for enquiries.
None of this is about assuming the worst of people. Most departures are friendly. It is simply that access nobody remembers giving is access nobody remembers taking away.
This week, write down every login your business uses, from the website to the domain to Google, and next to each one, write who has it. Then turn on two-step verification, where a code is sent to your phone as well as asking for the password, on your email and domain accounts. It is an hour's work, and you will probably find at least one surprise.
