How to Give a Developer Access to WordPress Safely

A developer has agreed to fix something on your site, and their first message asks for “the login”. The easy answer is to send yours. It is also the answer that leaves you with the least control, because from that moment two people are using one identity and you cannot take it back without changing your own password.

There is a better way to give a developer access to WordPress, and it does not slow the job down. They get their own account, with the access the task needs, for as long as the task lasts. Setting that up takes a few minutes. Hosting access needs a little more thought, and closing it all off afterwards is the step most owners forget.

First, find out what the job actually needs

“Access” can mean four different things, and many jobs need only one of them. Ask the developer which they need and why; it is a normal question and they will be used to it.

If the site loads and the work is inside WordPress, a dashboard account is normally enough. When the site is offline or throws a critical error, the dashboard may refuse to open, and then file access is the only way in.

Choosing the role for the developer’s account

For technical work, the role is usually Administrator. Installing, updating and removing plugins, changing themes and editing settings all need it, and giving a lower role just leads to a second request a few minutes later.

For content work, such as building a new page or fixing layout on existing pages, Editor is often enough. Designers and copywriters rarely need more. The trade-offs for each role are covered in the hub on managing WordPress users, and if neither fits there is the option of a custom role.

Whichever you choose, the account should carry the developer’s name and their own email address, not yours and not a generic “dev” address that next year’s contractor will also use.

How to give a developer access to WordPress with their own account

1. Log in as an administrator and go to Users → Add User (on some versions “Add New User”).
2. Use a username that identifies the person or their company, for example “rahul-devstudio”. It makes the activity obvious in any log and easy to spot when you tidy up.
3. Enter their email address and pick the role.
4. Leave Send User Notification ticked so they receive a link to set their own password. That way the password never passes through your inbox at all.
5. Click Add User, then tell the developer the email is on its way.
6. Write down the date and what the job is. You will use that note when the work ends.

Each field on that screen is explained in more detail in the guide to creating a new WordPress user.

Temporary login links

For a short job, a temporary-login plugin can be neater. Plugins such as Temporary Login Without Password create an account with a special sign-in link and an expiry period you choose. When the period ends, the link stops working. You send the link instead of a password, and there is nothing for the developer to remember or save.

Two cautions. Anyone who has the link can use it until it expires, so send it privately and keep the expiry short. And check the plugin’s own screen afterwards to confirm the temporary account is gone, rather than assuming it.

Hosting and file access, separately

Hosting access is more powerful than a WordPress administrator account. Someone with your main hosting login can usually delete the site, its database and its backups, and may reach your email accounts too. Treat it accordingly.

• Look for a separate user first. Many hosts let the account owner invite another person or create a limited user. The name varies by host, so check the help pages or ask support.
• For files only, create an FTP or SFTP account. Hosting panels such as cPanel and Plesk let you add extra FTP users, and you can often limit one to the website’s own folder. Delete it when the job ends.
• If you must share the main login, change its password once the work is done, and check that the account’s contact email and phone number are still yours.

Sending these details by plain email or chat is how they end up exposed years later. A password manager with a sharing feature, or at least a one-time secret link, is much safer. Our post on sharing logins safely is written for agencies, but the methods apply just as well to an owner briefing a freelancer.

While the work is happening

You do not need to watch over the developer’s shoulder, but a few habits protect you.

• Agree on a backup before changes start, and know who is taking it and where it is stored.
• For anything risky, ask whether it can be done on a copy first. A staging site lets a developer test updates or redesign work without touching the live site.
• Ask for a short written list of what changed when they finish: plugins added or removed, settings altered, files edited. You will want it the next time someone works on the site.

This is the same principle that runs through the whole WordPress help guide: know what changed, who changed it and how to undo it.

Closing access when the job is done

Work tends to end quietly, with a last email and an invoice, so this part is easy to miss. Tie it to the day you pay the final invoice.

1. Remove or downgrade the WordPress account. If the developer may come back soon, change the role to Subscriber or “No role for this site”. Otherwise delete it. If they created any pages or posts, choose to attribute that content to your own account when WordPress asks; the details are in deleting a user without losing their content.
2. Check for accounts you did not ask for. Look at the Administrator count on the Users screen. A developer sometimes creates a second account for testing and forgets it.
3. Delete the FTP or hosting user, or change the main hosting password if it was shared.
4. Remove any temporary-login plugin you installed only for this job.
5. Look at the plugin list. Anything new should be on the developer’s list of changes. If it is not, ask.

If instead the developer is leaving after looking after the site for a long time, the job is bigger than closing one account. Domains, hosting ownership and licences all need to move to you, and that is covered in taking over a website from another developer.

Frequently asked questions

Does a developer need my hosting login to fix a WordPress error?

Not always. If you can still open the dashboard, many fixes can be done from a WordPress administrator account alone. File access becomes necessary when the site will not load, when the dashboard is broken, or when the fix involves files WordPress cannot edit, such as server settings.

Does the developer need a separate login for my staging site?

Usually, yes. In most setups a staging copy has its own user list, copied from the live site at the moment the copy was made. An account you created after that will not exist on staging, so add it there too or refresh the copy. When the job ends, remove the account from both sites.

Is it safe to use a temporary login plugin?

It is reasonable for short jobs, as long as the plugin is well maintained and you keep the expiry short. The link works like a password, so share it privately. After the work, confirm the temporary account has been removed and delete the plugin if you no longer need it.

What if the developer is overseas and their login gets blocked?

Some security plugins block logins from certain countries or after failed attempts. If the developer is locked out, check your security plugin’s settings or blocked list before creating another account. Allow their address only for the duration of the work if the plugin offers that option.

Some owners would sooner hand the fix to a team that works from its own accounts and takes a backup before touching anything. That is how our WordPress bug fixing service works, from ₹1,499 per incident onwards, and you are told what is wrong and what the fix involves before work goes ahead.

Next in this series: Delete a User in WordPress Without Losing Their Posts