Motta Industries Blog

Most small business websites are not broken by hackers or failed servers. They are broken by well-meaning people in a hurry. Someone pastes a press release straight from a word processor and the formatting spills across the page. Someone deletes a block that turned out to hold the booking form. None of these people meant any harm. They simply were never shown how the site works.

Training the people who update your website is one of the cheapest forms of protection you can buy. This guide covers how to decide who edits what, how to set up the editor so mistakes are harder to make, how to design training that sticks and how to keep the whole arrangement working after the first session.

Why editing mistakes happen

Modern content management systems give editors a lot of power. Page builders and block editors let almost anyone change layouts, colors, fonts and spacing. That flexibility is useful, but it means a person who only needs to update opening hours can also accidentally restyle the entire footer.

The WordPress project has written about this tension directly. In a May 2023 post on curating the editor experience on the WordPress Developer Blog, the author noted that with each release the editor’s design tools give users more power and flexibility, but that power can make it tough to keep a site on brand visually and on track with an organization’s content guidelines, and the more people working on the site, the tougher that job gets. The post describes how developers can restrict settings by user permissions and post type, and notes that some industries call these curation techniques governance.

That word is worth borrowing. Governance sounds formal, but for a small business it simply means agreeing who can change what, setting up the tools to match, and teaching people how to work inside those limits.

Most mistakes fall into a few groups:

• Layout damage. Moving, deleting or restyling blocks, columns and sections that hold the page together.
• Broken function. Removing forms, embedded maps, booking widgets or tracking code that look like ordinary content.
• Heavy media. Uploading huge images or videos that slow pages down.
• Navigation changes. Editing menus, page addresses or redirects without understanding what links to them.
• Account risks. Shared passwords, accounts that stay active after someone leaves and logins stolen through fake emails.

Each group has a fix that combines settings and training. Settings reduce what can go wrong. Training explains what remains.

Decide who edits what

Before anyone opens a training session, write down what each person actually needs to change. A typical small business might end up with a list like this:

1. The owner approves new pages and major changes.
2. A front desk or office manager updates hours, staff bios, closures and announcements.
3. A marketing coordinator writes blog posts and updates promotions.
4. An outside developer handles layout, plugins, themes, integrations and anything technical.

Then match roles to that list. Most content management systems offer roles with different permissions. In WordPress, for example, an editor can manage all posts and pages, an author can publish their own posts, and a contributor can write drafts that someone else must approve. Only a small number of trusted people should hold administrator accounts, because administrators can install plugins, change themes and remove other users.

Give each person their own account. Shared logins make it impossible to know who changed what, and they turn every departure into a security problem.

If you are unsure which roles your platform offers or how your site is configured, a review of your content management system setup is a good first step.

Set up the editor so mistakes are harder

Training works best when the tools help. A well-configured site guides people toward the right action and makes the wrong one difficult.

Lock what should not move. Many editors let developers lock blocks so they cannot be moved or removed, or limit a section to content changes only. A header, a contact form or a pricing table can be protected while the text inside stays editable.

Use patterns and templates. Instead of building every new page from scratch, editors can start from an approved layout for a blog post, service page or event announcement. They fill in content without touching structure.

Limit design choices. Restricting color palettes, font sizes and spacing options to your brand presets prevents a slow drift into a patchwork of styles. The WordPress post above describes filters that let a developer adjust which settings appear based on a block’s location, the user’s role or the type of content being edited.

Turn on revisions and backups. Revision history lets you roll back a bad edit in seconds. Regular, tested backups protect against bigger accidents.

Most of these protections are configuration work rather than custom code, and they are a natural part of professional WordPress development.

Design training that matches the real work

The most useful training looks like the work people will actually do. A lecture about every menu in the dashboard is forgotten within a week. A session where someone updates a real page on a practice copy of the site is remembered.

The team behind GOV.UK, which trains large numbers of government staff to publish on a single shared website, described this shift in a November 2018 post about redesigning cross-government content learning. Getting a publishing account required learning how to write user-centred content and how to use the publishing system. The original course was a two-day classroom session that could not scale, and learners were asking for more practical activities and more use of digital tools. The team replaced it with an online module people could complete at their own pace, followed by a half-day classroom session focused largely on hands-on practice with the publishing tool using real-world scenarios. They reported being able to support four times as many people with no additional trainer time.

A small business does not need a training department, but the same principles apply:

• Separate writing from mechanics. How to write a clear page is one skill. How to use the editor is another. Teach both.
• Practice on a safe copy. A staging site lets people make mistakes without consequences.
• Use real tasks. Have each person complete the exact updates they will do in their role.
• Keep it short. A focused hour on three common tasks beats a full day on everything.
• Check the result. Before granting publishing rights, review a practice page together.

Build a simple editing guide

Training fades. A short written guide stays. Keep it to a few pages and write it for the people who will use it, not for developers.

A useful guide covers:

• How to log in, including multifactor authentication and what to do when locked out.
• Step-by-step instructions for the most common tasks, with screenshots from your own site.
• Image rules, such as preferred sizes, file types and how to write alternative text.
• Writing rules, including tone, heading structure, link wording and how to format dates and prices.
• What not to touch, such as menus, plugins, forms or code blocks.
• Who to ask when something looks wrong.
• How to undo a mistake using revision history.

Store the guide where people can find it, and update it whenever the site changes.

Include security in the training

Website editors hold the keys to a public channel, which makes their accounts attractive to criminals. Many attacks begin not with clever code but with an email.

In October 2023, CISA, the NSA, the FBI and MS-ISAC published joint phishing guidance on stopping attacks at the first stage. Among its recommended mitigations, it advised organizations to implement user training on social engineering and phishing attacks and to regularly educate users on identifying suspicious emails and links, not interacting with them and the importance of reporting incidents. It also recommended prioritizing phishing-resistant multifactor authentication for administrator and privileged user accounts.

For a website team, that translates into a few habits worth teaching:

• Never log in to the website from a link in an email. Type the address or use a bookmark.
• Be suspicious of urgent messages claiming to come from your hosting company, domain registrar or developer.
• Turn on multifactor authentication for every account, and especially for administrators.
• Report odd emails and unexpected login alerts right away, even if you clicked something.
• Never share passwords, and use a password manager.

These points take ten minutes to cover and can prevent the most damaging kind of website incident.

A fictional example

Consider a fictional veterinary clinic with four people who update its website. The office manager posts holiday hours and closures. A veterinary technician writes monthly pet care articles. The owner approves anything that changes services or prices. An outside developer maintains the site.

Before any training, the clinic’s homepage had been rearranged twice by accident, and an oversized photo had made the services page slow on phones. The developer set up individual accounts with matching roles, locked the header, footer and appointment form, created templates for announcements and articles and limited colors to the clinic’s palette.

Each staff member then spent an hour on a staging copy practicing their real tasks, with a one-page guide for reference. Login security and suspicious emails were covered in the same session. The office manager now posts closures in minutes, the technician publishes articles through a draft-and-review step and the layout has stayed intact.

Keep it working over time

Training is not a single event. People change roles, new staff arrive and the site itself changes. A few routines keep the arrangement healthy:

• Review accounts quarterly. Remove people who have left and adjust roles that no longer match.
• Refresh training after major changes. A redesign, new editor or new plugin means new instructions.
• Watch for drift. Periodically review recent pages for formatting, image size and consistency.

Ongoing website maintenance is a natural place for these checks. Updates, backups and security reviews already happen on a schedule, and adding an account review and a quick look at recent content takes little extra time.

A training checklist

Use this list before giving anyone publishing access:

• Each person has their own account with the least access their role needs.
• Administrator accounts are limited and protected with strong multifactor authentication.
• Structural blocks, forms and navigation are locked or restricted.
• Approved templates exist for common page types.
• Design options are limited to brand presets.
• Revisions and tested backups are enabled.
• Each editor has practiced real tasks on a staging copy.
• A short, current editing guide is available.
• Staff know how to spot and report phishing.
• Account and training reviews are on the calendar.

A website that many people can safely update is a stronger website. With the right settings, practical training and a little ongoing attention, your team can keep content fresh without breaking what already works.