Why the owner login should stay with the owner
The owner account can do things no helper should be able to do by accident. At Kinsta, only the Company Owner can request account closure or transfer ownership, and only the Owner can cancel the plan. At WP Engine, the Owner role is the one that can delete sites, move sites between accounts and close the account. At Liquid Web, the Owner has unrestricted control, including cancelling the account.
Separate logins also leave a trail. Each person signs in with their own credentials and second factor, and access can be removed without changing the owner's password. Liquid Web notes that users cannot be deleted once created, only deactivated, which still ends their access.
Remember that hosting users and WordPress users are different. Kinsta's documentation makes the point directly: WordPress users are managed in WP Admin, not MyKinsta. A VA who writes lessons needs a WordPress Editor account, not hosting access.
Roles, scope and two-factor by host
| Host | Roles | Limit to one site | Billing-only role | Two-factor |
|---|---|---|---|---|
| Kinsta | Company Owner, Company Administrator, Company Developer, Company Billing; Site Administrator, Site Developer | Yes: Site Administrator (all environments of assigned sites) or Site Developer (staging only) | Yes: Company Billing, no site access | Applied to all users (email or app); admins can see each user's method |
| WP Engine | Owner; Full (with or without billing); Partial (with or without billing) | Yes: Partial users work only in environments the Owner selects | No pure billing role; Partial (with billing) is limited to assigned environments but can still access Billing and make billing changes such as buying extensions | Email MFA on by default; Okta Verify, authenticator app, or security key/biometric; SSO users get MFA from their identity provider |
| DigitalOcean (teams) | Owner, Biller, Billing Viewer, Member, Modifier, Resource Viewer; custom roles also exist | Predefined roles are team-wide; scoping is not described on the roles page | Yes: Biller (full billing, no resources) or Billing Viewer (read-only) | Authenticator app or SMS (not VoIP numbers) with single-use backup codes; owners can require secure sign-in for all members |
| Liquid Web | Owner, Secondary Owner, Purchaser, Technician | Not described; roles are account-wide | No; Purchaser also has support and server management | Authenticator app, enabled per user; no enforcement setting described |
| SiteGround | Collaborator; client (white-label, GoGeek or Cloud only) | Yes: a collaborator sees only the site or service shared with them | Not described; collaborators cannot see billing | Not described on the collaborator pages; Login Recovery uses the admin email or phone |
Which role to give whom
The Kinsta Site Developer role is the tightest fit for a contractor: it covers standard and premium staging environments for the assigned sites, cannot push staging to live, and has no access to live analytics, user management, migrations or DNS. At WP Engine, Partial (no billing) cannot create WordPress environments or take transfer actions, which keeps a contractor inside the environments you chose.
| Person | Kinsta | WP Engine | DigitalOcean | Liquid Web | SiteGround |
|---|---|---|---|---|---|
| VA editing lessons | WordPress user only | WordPress user only | WordPress user only | WordPress user only | WordPress user only |
| Freelance developer, one site | Site Developer (staging, cannot push to live) or Site Administrator | Partial (no billing) on chosen environments | Modifier (cannot delete resources) or a custom role | Technician (support access, no billing changes) | Collaborator on that site |
| Agency running everything | Company Developer | Full (no billing) | Member | Secondary Owner | Collaborator on each site |
| Bookkeeper | Company Billing | No exact match; avoid Full (with billing) | Billing Viewer, or Biller to pay invoices | No exact match | No equivalent described |
Two-factor details that matter when something goes wrong
Kinsta: only the Company Owner can ask Kinsta to disable 2FA for another user, and only if that user belongs to just that one company. Kinsta support cannot add users on your behalf.
WP Engine: email MFA is enabled by default. If you lose your phone and cannot finish login, WP Engine warns that you will be locked out and that verifying the account through support can take a long time, and its MFA page recommends setting up multiple authentication factors as a backup. With SSO turned on for your email domain, WP Engine stops prompting for MFA and leaves it to your identity provider.
DigitalOcean: backup codes are single use and can be downloaded as a text file; regenerating them invalidates the old ones. When owners require secure sign-in, members without Google, GitHub or 2FA are blocked from the team until they switch.
Liquid Web: the secret key shown with the QR code is the only way to recover 2FA without contacting support; otherwise support must verify your identity and disable it manually. Each user also needs a support passphrase to talk to support.
Offboarding checklist
- Remove or deactivate the person's hosting user (Liquid Web: deactivate, since users cannot be deleted)
- Remove their WordPress account or downgrade it, and reassign their posts
- Rotate any SFTP, SSH or database passwords they used, and delete their SSH keys
- Revoke API tokens they created
- Check the activity log for changes in their last week (Kinsta has a company activity log)
- Confirm the owner account has two working second factors and stored recovery codes
Questions before you decide
Does WP Engine have a billing-only user?
Not exactly. WP Engine's roles are Owner, Full (with or without billing) and Partial (with or without billing). Partial (with billing) is limited to the environments you assign but can still open the Billing section and make billing changes such as buying product extensions, and Full (with billing) has access to every environment, which is far more than a bookkeeper needs.
Can I force everyone on my DigitalOcean team to use 2FA?
Yes, in effect. DigitalOcean lets team owners require secure sign-in, which means 2FA or Google or GitHub sign-in. Members without one are prompted and cannot access the team until they switch.
Can a Kinsta Site Developer push staging to live?
No. Kinsta's user management documentation says the Site Developer role can work in standard and premium staging environments for assigned sites but cannot remove a staging environment or push it to live.
Can a SiteGround collaborator see my invoices?
No. SiteGround's knowledge base says collaborators cannot see the owner's personal information, billing details or private support history, and only see the services shared with them.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Kinsta docs: User management Accessed 30 Oct 2026
- WP Engine support: User Portal users Accessed 30 Oct 2026
- WP Engine support: Multi-factor authentication Accessed 30 Oct 2026
- WP Engine support: SSO for the User Portal Accessed 30 Oct 2026
- DigitalOcean docs: Predefined team roles Accessed 30 Oct 2026
- DigitalOcean docs: Require secure sign-in Accessed 30 Oct 2026
- DigitalOcean docs: Two-factor authentication Accessed 30 Oct 2026
- Liquid Web help: User roles Accessed 30 Oct 2026
- Liquid Web help: Creating an authorized user Accessed 30 Oct 2026
- Liquid Web help: Enable two-factor authentication Accessed 30 Oct 2026
- SiteGround KB: What a collaborator can do Accessed 30 Oct 2026
- SiteGround KB: Collaborator vs client Accessed 30 Oct 2026
- SiteGround KB: Lost access to account Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.