What are some best practices for user exit strategy?

Question

We have a key employee who is resigning. I would prefer to retain her attribution for stories she has posted for our institution. My first thought was to create a custom "resigned" user role and move her account there. Then I began to consider the various methods a user (whether actual employees or not) may exit as a contributor.

• Resignation
• Death
• Termination
• Temporary Leave
• Internal Promotion
• Position Change
• Asked to have Attribution Removed
• Asked to have Content Removed

My first inclination is to move the user into a logical role. This would preserve both the frontend and backend attribution. It would also allow a simple method for reinstating users upon their return. In addition, there could be some benefit in a report on the history of user activity as well.

---

Update:

I decided to start with creating one “additional” role, resignee. A funny looking word that spellcheckers don’t seem to know about yet. But it covers the primary and most likely issue, an employee that has resigned, perfectly. I can add “additional” roles as situations present. I am calling it an additional role because I also created an array custom alternatives to the default list. (And this is an option in the WordPress user editor) Ignore the business prefix (blurred) and you can see I ended up using former as a prefix. Now an employee and leave the institution and we can demote their account to it’s corresponding former role. This will maintain system context and public attribution. So the account could be former-editor + resignee.

Side note: the prefix also kept the custom roles grouped in the editor and code.

It was working great until an employee wanted to assign a lot of backdated articles to a former employee. That special role was not selectable in the front-end for attribution since it shared the same privilege as a subscriber, that being read only. I had to add the custom array to the selection loop. Now the users are back to attributing work as needed.

Still open for some semantics and logic ideas.

Answer 1

Although you could create another class of users, I'd just do the following:

• Change their password to something really strong and random

• Change their email address to an invalid value (or maybe a variation of yours) so they can't do a password reset.

• Maybe change their description/info to show that they are a 'past employee' or whatever generic/polite term you want to use

That way, their articles will still be visible and attributed to them, but the person will no longer be able to add, since you have changed their password.

And, if they have any other access to your site (FTP, hosting, remote access, network access, etc), deleting those accounts is important. Act as if the person would do damage to your site in any way, and block those actions, even if they are leaving on good terms. Disgruntled and ex-employees can have nefarious intents....and better to be safe than sorry.

And I would do all of this sooner than later. No need to give them the opportunity to be nefarious.

Answer 2

WPBeginner has an article describing use of the "User Blocker". It sounds like just what you need.

Good luck!