Why sending a password is a bad idea
A Yandex account rarely stands alone. It is usually linked to email, Metrica, an ad account and sometimes a Disk full of contracts and price lists. Share the password and the contractor gets the keys to your company's digital life, not just Webmaster.
There are practical problems too. If two-factor protection is on, a shared password turns into a stream of confirmation codes in a messenger. When you change contractors, you must reset the password, relink the phone and sign in again everywhere. And with one shared login you can never tell who changed what in the site settings.
How to give access to Yandex Webmaster by delegating rights
The right way is delegation. The site owner, who has already verified the site in Webmaster, enters the login of another Yandex account, and the site appears in that person's list. Nobody sees your password, and you keep managing access from your own cabinet.
Yandex renames menu items from time to time, so look for the meaning rather than the exact label: in the settings of a specific site there is a section about access rights.
- Ask the contractor for the login of their own Yandex account, ideally a work one rather than personal.
- Sign in to Webmaster with the account the site is verified under.
- Open the site and go to the access rights section in its settings.
- Enter the contractor's login and confirm the delegation.
- Ask them to check that the site shows up in their list and the data opens.
When delegation is not possible: their own verification code
Sometimes the site was verified long ago by an employee who has left, and nobody can sign in to that account. In that case the contractor adds the site to their own account, receives a meta tag, a file or a DNS record, and you or your developer place it on the site. It works, but it leaves someone else's verification codes in your code, and you will have to remove them by hand.
If this is your situation, also verify the site under a company account, so ownership never depends on a contractor.
How to close access when the work ends
This is the step most companies forget. Open the same rights section and remove the contractor's login. Then check the site itself: look for their meta tag in the page code, a verification file in the root and a TXT record in DNS. While those remain, they can verify ownership again.
If the contractor worked with your password, the order is different: change the password, check linked phone numbers and the backup email, end all active sessions and turn on two-factor protection. Only then give new people access, and do it through delegation.
Metrica and Google Search Console are separate
Access to Webmaster does not open Yandex Metrica, and the reverse is also true. Metrica supports guest access: view only, or view with editing. An SEO specialist usually needs view only, unless they set up goals themselves.
Google Search Console follows a similar logic: the owner adds a user by Google account address and picks a permission level. Set both up on the same day, otherwise your contractor sees only one search engine. If you want traffic from Tashkent and the regions, you need data from both.
House rules that prevent trouble
A few habits spare you from spending weeks regaining access to your own data after a specialist leaves. If you order a turnkey website, build this into the launch: when markdev develops a site, the property is verified under the owner's account, not the contractor's.
- Verify the site under a company account, not an employee's personal one.
- Make sure at least two people in the company can access that account.
- Give contractors access only through delegation.
- Keep a simple list of who has access to which service and since when.
- Revoke rights on the same day you change contractors.
- State in the contract that access and data belong to your company.
What to check right now
Open the access list in Webmaster and see who is on it. If you find former employees or contractors you no longer work with, remove them. It takes a few minutes.
If you need a website that is set up correctly from day one, from search engine verification to analytics, talk to the markdev team about the task and we will suggest where to start.
FAQ
Can I give someone access to Yandex Webmaster without sharing my password?
Yes. The site owner delegates rights to the login of the contractor's Yandex account in the site settings. No password is shared, and access can be revoked at any time.
What if the site is verified under a former employee's account?
Try to recover that account first. If you can't, verify the site again under a company account using a meta tag, file or DNS record, then delegate rights to the people who need them.
How do I know a contractor no longer has access?
Remove their login from the access rights, then check your site code and DNS for their meta tags, verification files and TXT records, and delete any you find.
Does a contractor need access to Yandex Metrica too?
For analysis, guest view access is usually enough. Editing rights are only needed if the specialist configures goals and the counter themselves.
Let’s look at your task for free
Leave your contact — in a 15-minute call we’ll show where leads get lost and what to fix first.