Account Security Best Practices for Publlish
Learn how to keep your Publlish account and connected social media channels secure — strong passwords, team access control, what to do if an account is compromised, and credential management for agencies.
Your Publlish account has access to your social media channels — which means securing it is as important as securing the social accounts themselves. This guide covers the key security practices for your Publlish account and the connected social channels it manages.
Publlish Account Security
Use a strong, unique password Your Publlish password should be unique — not reused from another service. Use a password manager (1Password, Bitwarden, LastPass) to generate and store strong passwords. A strong password is at least 16 characters with a mix of letters, numbers, and symbols.
Enable two-factor authentication (2FA) If Publlish offers 2FA, enable it. This requires a second verification step (typically a code from an authenticator app) when logging in, making it significantly harder for an attacker to access your account even if they have your password.
Check Settings → Security or Settings → Account for 2FA options.
Use your work email, not personal email, for Publlish Your Publlish account is a work tool — connect it to your work email. This makes it easier to manage access when people join or leave your team and ensures you receive account notifications in the right inbox.
Log out on shared devices If you ever access Publlish on a shared or public device, log out when you're done. Never save your Publlish password in a shared browser.
Team Access Security
Apply the principle of least privilege Give every team member only the access they need — no more. A junior content creator doesn't need Admin access. A client doesn't need Editor access. Restrict roles to what each person genuinely requires. Team permissions guide →
Audit team access regularly Every month, check Settings → Team and verify:
- All active members have appropriate roles
- Anyone who's left the team has been removed
- No former contractors, freelancers, or clients still have access
Removing access immediately when someone leaves is especially important for social media tools — you don't want a departed employee to have publishing access to client accounts. Removing a user →
Don't share Publlish logins Each team member should have their own Publlish account and their own login. Shared logins make audit trails meaningless and make it impossible to remove one person's access without affecting others.
Restrict Admin access tightly Limit Admin role to the minimum number of people who genuinely need it — typically account owners and senior managers. Admins can access billing, change team permissions, and disconnect channels. That level of access should be reserved for people who need all of it.
Social Media Credential Security
Never share social media passwords via Slack or email If you need to share credentials for a channel connection, use a secure password manager with sharing functionality (like 1Password Teams or Bitwarden for Business). Avoid pasting passwords in chat messages or emails.
Use dedicated agency social accounts where possible For agencies, connect client social channels using a dedicated account that has been granted admin access to the client's Page — not your personal social media account. When you or a team member leaves, removing that person's access doesn't break the Publlish connection.
Document which credentials were used for each connection Keep a secure record (in your password manager, not in a spreadsheet) of which account was used to connect each channel in Publlish. When a connection breaks or needs refreshing, you'll know exactly which login to use.
Refresh connections after any security change Any time you change a password on a connected social account, immediately go to Publlish and refresh the connection for that channel. Refreshing a channel →
What to Do If Your Publlish Account Is Compromised
If you suspect unauthorised access to your Publlish account:
- Change your Publlish password immediately — go to Settings → Account → Change Password
- Check Settings → Team for any team members or invites you don't recognise — remove any suspicious entries
- Check your connected channels — look for any channels that shouldn't be there
- Review recent activity — check your post history for any content that was published without your knowledge
- Contact Publlish support — report the incident and request a security review of your account
If the compromise extends to connected social channels, also change passwords for those platforms and revoke any suspicious third-party app access in each platform's settings.
What to Do If a Team Member Leaves Under Bad Terms
If a team member leaves adversarially:
- Remove their Publlish access immediately — Settings → Team → Remove
- Check channels they may have connected — identify any channels connected with their credentials and refresh those connections using a different account
- Review the post queue — check for any drafts or scheduled posts they may have created that you want to review before they go live
- Change social media passwords for channels they had direct access to — then refresh those connections in Publlish
Frequently Asked Questions
Does Publlish support two-factor authentication? Check Settings → Security in your Publlish account for current 2FA options. If 2FA is important to your security requirements, confirm its availability with Publlish support.
Can I see a log of who did what in my Publlish account? Activity logging depends on your plan. Higher-tier plans may include audit logs. Check Settings for available log features.
Is it safe to give a client Viewer access to their content calendar? Yes — Viewer access is read-only. Clients with Viewer access cannot edit posts, change settings, or access other clients' channels (as long as you've restricted their channel group access correctly).
What if a former employee still has access to the connected social media accounts directly? That's outside Publlish's control — contact the relevant social platforms to revoke their access directly in each platform's admin settings.