Team Access
- Introduction
- Roles
- Which plans include team management
- Inviting someone
- Accepting an invitation
- Changing a role or site permissions
- Permission reference
- Using WordPress Login
- Transferring ownership
- Removing someone or leaving an account
- Working in several accounts
- Security notes
Introduction
Everyone who works on your sites gets their own Staatic login. You invite them by email, they choose their own password, and you decide what they can reach: the whole account, every site, or only the sites you select.
People with the right site permissions use Login in the Staatic dashboard to open WordPress Admin of a Staatic Cloud site, so nobody has to share a WordPress password.
The team is managed on the Team tab of the Account page (Account > Team).
Roles
Each person has one role in the account.
| Role | Allows | Team seat |
|---|---|---|
| Owner | Everything an administrator can do. Only an owner can close the account or transfer ownership. | Yes |
| Administrator | Manages the account, its subscription, team and every site. | Yes |
| Member | Works on every site, without managing the account or team. | Yes |
| Collaborator | Works only on the sites you select, with the permissions you set per site. | No |
The person who registers the account is its owner. An account has one owner; ownership moves with Transfer ownership.
Administrators and members have every site permission on every site, including sites added later. A collaborator has no access to the account, the subscription or the team, and sees only their own sites.
Which plans include team management
Owners, administrators and members hold a team seat. Collaborators never take one.
| Plan | What you can add |
|---|---|
| Starter (Staatic Cloud or self-hosted) | One team seat, held by the owner. You can invite collaborators. |
| Professional and higher | Administrators and members, as many as you need, and collaborators. |
| Free trial | The same as Professional, until the trial ends. |
There is no charge per person.
On a plan with one team seat, the Team tab shows “1 of 1 team seats used”, and the invitation form marks Administrator and Member as Professional. To add administrators or members, upgrade to a Professional plan or higher.
Moving to a plan without team management removes nobody. Everyone keeps their role and access, but you cannot add administrators or members, or turn a collaborator into one, until you upgrade again.
Inviting someone
Owners and administrators can invite people.
- Go to app.staatic.com and log in with your account details.
- Click Account > Team.
- Click Invite team member.
- Enter their Email address and choose a Role: Administrator, Member or Collaborator.
- For a collaborator, select the sites they should work on. You need at least one site.
- Click Send invitation.
We send an email titled “You are invited to join account name on Staatic”. The invitation is valid for 7 days.
Open invitations are listed under Pending invitations on the Team tab, with who sent them and when they expire. From there you can:
- Resend an invitation. This sends a new email with a new link; the link in the previous email stops working.
- Revoke an invitation. The link stops working. You can invite the same address again later.
Note: you cannot invite someone as owner. Invite them as an administrator, then transfer ownership.
Note: a collaborator starts with every site permission on the sites you selected. If they should only edit content, turn off Site Management after they accept.
Accepting an invitation
The invited person clicks View invitation in the email.
- No Staatic login yet: they click Create a login, enter their name and choose a password of at least 8 characters. Their email address is the one the invitation was sent to, and it counts as verified. They do not have to accept the terms again; the account owner already did.
- Existing Staatic login: they sign in with the invited email address and click Accept invitation. The account is added to their login, next to the accounts they already belong to. See Working in several accounts.
An invitation works only for the email address it was sent to. If someone is signed in with a different address, they are asked to sign out and sign in with the invited one.
An invitation can no longer be accepted when it has expired or been revoked, or when the person who sent it can no longer manage the team. In that case, send a new one.
Changing a role or site permissions
Owners and administrators can change the role of anyone except an owner, and the site permissions of a collaborator.
- Click Account > Team.
- Open the person and click Edit.
- Under Role, choose Administrator, Member or Collaborator.
- For a collaborator, set the permissions per site under Site-specific permissions. For an administrator or member, every permission shows as included in their role.
- Click Save changes.
You cannot change your own role. Ask the owner or another administrator.
A collaborator’s permissions apply to the sites they are given. When you add a new site, a collaborator has no access to it until you give it.
Permission reference
These are the permissions per site. Administrators and members have all three on every site; a collaborator has the ones you set for each of their sites.
| Permission | Allows |
|---|---|
| Site Access | Access the site in the dashboard and WordPress Admin. |
| Site Management | Manage the site, its backups and integrations, and advanced WordPress access such as SFTP and database credentials. |
| Form Moderation | Review and classify form submissions. |
What each permission opens on a Staatic Cloud site:
| Access | Required permission |
|---|---|
| WordPress Login and HTTP Basic Authentication credentials | Site Access or Site Management |
| SFTP credentials | Site Management |
| Database credentials and phpMyAdmin Login | Site Management |
| WordPress backups, imports and integrations | Site Management |
| PHP version and origin rules | Site Management |
| Deleting the site | Site Management |
| Form submissions | Form Moderation |
Common examples:
| Use case | Suggested role and permissions |
|---|---|
| A colleague who manages the account and its billing | Administrator |
| A developer who works on every site | Member |
| A freelance developer for one client site | Collaborator with Site Management for that site |
| A client’s content editor | Collaborator with Site Access for their site |
| Someone who answers contact forms | Collaborator with Form Moderation for that site |
Using WordPress Login
Authorized team members can open WordPress Admin from the site details page.
- Go to app.staatic.com and log in with your account details.
- Click Account > Sites. Then click on the View Icon next to the relevant site.
- Click the WordPress tab.
- Click Login to open WordPress Admin.
The Login button creates a short-lived authenticated link to WordPress Admin. If the link expires or does not open WordPress correctly, return to the Staatic dashboard and click Login again.
WordPress Login is separate from direct WordPress admin credentials. It does not copy the team member’s Staatic password into WordPress.
When a team member uses WordPress Login, Staatic chooses the WordPress account based on the permissions that team member has for the site.
| Team member permission | WordPress login behavior |
|---|---|
| Site Access | Staatic uses a WordPress user with the same email address when one exists. If no matching WordPress user exists yet, Staatic creates a WordPress user for that team member with the Author role. |
| Site Management | Staatic signs the team member in as the WordPress user with the highest role on the site, usually an Administrator. If several users share that highest role, Staatic picks the one whose email address matches the team member’s Staatic email address (ignoring upper/lower case and surrounding spaces). If none of them matches, it picks the oldest of those accounts. Grant this permission only to users who should be trusted with administrative site operations. |
To sign in to your own WordPress administrator account rather than a shared one, give that account the same email address as your Staatic login.
To give someone a role other than Author, such as Editor, create their WordPress user with that role and their Staatic email address before they first click Login.
On a multisite network, someone with Site Management on a subsite but not on the main site signs in with their own WordPress user, as administrator of that subsite only. They never sign in as a network administrator.
Users with Site Management can also restore the initial WordPress admin account when direct WordPress login credentials are needed.
Transferring ownership
Only the owner can transfer ownership.
- Click Account > Team.
- Open the actions of the person who should become the owner, or their detail page, and click Transfer ownership.
- Tick I understand that I become an administrator and click Transfer ownership.
You keep managing the team, the sites and the subscription as an administrator. Only the new owner can close the account or transfer ownership again, including back to you.
A collaborator who becomes owner takes a team seat. On a plan with one team seat, make an administrator or member the owner instead, or upgrade first.
Removing someone or leaving an account
To remove someone, owners and administrators click Account > Team, open the person’s actions and click Remove from account. The owner cannot be removed; transfer ownership first.
The person loses access to the account and its sites straight away. Their other accounts are not affected. If this was their only account, their Staatic login is deleted too.
To leave an account yourself, open your profile and go to Accounts, then click Leave next to the account. You keep your login and your other accounts. You cannot leave:
- an account where you are the only owner. Transfer ownership first, or close the account.
- your only account. Close it instead, or ask one of its owners to remove you.
To come back after leaving, an owner or administrator has to invite you again.
Working in several accounts
One Staatic login can belong to several accounts, for example your agency’s account and a client’s own account, with a different role in each. You sign in once.
When you belong to more than one account, the account switcher in the header shows the current account and your role in it. Click it and choose another account to switch. The dashboard then shows that account’s sites, team and subscription.
Your profile lists your accounts and your role in each under Accounts. Your name, email address, password, language and 2-step verification belong to your login and apply in every account.
Security notes
Follow these recommendations when managing team access.
- Give each person their own login. Do not share your Staatic password or two-step verification codes.
- Grant only what a person needs: a collaborator with the permissions their sites require, rather than a member or administrator.
- Use Login from the Staatic dashboard instead of sharing WordPress admin passwords when possible.
- Revoke invitations you no longer need, and remove people who no longer need access.
- When offboarding someone who used WordPress Login, also review the WordPress Users screen and remove or downgrade any WordPress account they no longer need.
- Treat copied passwords, SFTP credentials, database credentials and generated login links as sensitive.
- Turn on 2-step verification for your own login, and ask your team to do the same.