How to Give Your Developer Access to WordPress (Safely!)

Whether you’re getting support for an issue or bringing on a new developer onto the team, there comes a time when you’ll need to give a developer access to your website. But you need to figure out how to do this without compromising your site’s security.

Bad practices like giving developers your admin username and your own password are prevalent and can result in you being taken advantage of. On the other hand, most developers just want to do their job without jumping through hoops.

There’s a right and a wrong way to give developers access to WordPress, and we want to help you do it right. This article will walk you through how to give developer access to WordPress efficiently and safely.

Why secure access is important

There are many times that you may need to give a developer access to WordPress. Maybe you’ve run into a serious bug and have hired a support team to solve it. Maybe you’ve contracted a temporary developer to add a particular feature. Or maybe you’re bringing on a full-time developer to the team.

Whatever the case, you now need to give someone, more than likely a stranger, admin access to your WordPress site. Without the proper precautions, this can end poorly.

Some purported developers are actually scammers, more than willing to take over your user account and lock you out of it. They may embed malware and spam into your website, or leave in backdoors that allow them to gain access later. They’ll likely demand a ransom to restore your account and revert your trashed website to its former state.

It’s not always a case of bad intentions. Sometimes a legitimate developer will make a mistake and break functionality on your website, or misunderstand your instructions and make unwanted changes. It may be accidental, but it’s no less of a problem.

That doesn’t mean you should never give a developer access to your website. It just means you need to take the proper precautions first.

On the other hand, being too strict and not providing the proper permissions will just make legitimate developers’ lives harder. You’ll need to strike a balance.

The don’ts of WordPress developer access

Before we go into some of the suggested ways of how to give developer access to WordPress safely, there are a few things you should never do. However you go about this, don’t do any of these:

1. Don’t give out your username and password – One thing you definitely should not do is give developers access to your personal admin account. This is very risky and could result in your account being hijacked. They could also use your credentials to hack into your other online accounts, especially if you reuse passwords.
2. Don’t send credentials over unencrypted channels – Be wary when sending out account credentials over insecure channels. These can be intercepted by third parties. And even if you do use secure chat or email channels, if your account is breached later, bad actors could find and use the login credentials for malicious purposes.
3. Don’t leave access open indefinitely – If you’re giving a developer temporary access, remember to close the account once they’re finished. Open accounts, especially ones with elevated privileges, are a major liability as they can be brute-forced.
4. Don’t trust random code – If a developer adds custom code to your site or installs plugins from outside the official WordPress repository, it’s worth having someone look over the code to make sure there’s nothing malicious hidden inside.

How to safely give a developer access to WordPress

Many might feel inclined to provide developers with admin privileges when granting access to their WordPress sites. However, this can cause issues down the line. As such, creating a custom developer role that follows the principle of least privilege is much better.

Take the time to understand what tasks the developer will need to carry out so we can ensure that the right capabilities are assigned to the developer. You can easily create a custom developer role using Melapress Role Editor – which even comes with a pre-configured developer role straight out of the box.

Step 1: Create a dedicated role

Following the principle of least privilege, we need to ensure we only provide the developer access to what they need to do the job – no more, no less. The best way we can do this is through a custom role.

As mentioned earlier, Melapress Role Editor is one such plugin we can use to create custom roles. Developed in-house here at Melapress, it is a feature-reach plugin designed with ease of use in mind. The plugin is completely free and comes with a pre-configured developer role straight out of the box.

To install the plugin:

1. In the WordPress dashboard, head to Plugins > Add New Plugin
2. Search for Melapress Role Editor as shown in the screenshot below, click on Install, and then Activate

Once the plugin is activated, we will be redirected to the plugin’s main page. Here we will be presented with the option to either create a new role or view existing roles.

Since the plugin does come with a Developer role, we will choose the Show me all the roles on this website option.

Next, locate and click on the Developer role to view all capabilities assigned to the role.

You can disable any of the allowed capabilities by toggling the switch to the off position. On the other hand, if you want to grant capabilities not currently included, simply toggle the switch to the on position.

Step 2: Create the account

Once the role has been created, we can decide whether we want to create dedicated user accounts or provide access via a temporary login. We will discuss these two options next.

Option 1: Use a temporary login plugin (best option)

Rather than creating a dedicated user account for developers – and having to remember to delete it later – you can instead use a plugin to create temporary accounts that will delete themselves.

While this isn’t suitable for long-term developers, it’s great if you just need some support or a quick new feature.

1. Head to Plugins > Add New and install the Melapress Login Security plugin.
2. Head to Login Security > Temporary Logins.
3. Click Create temporary login and enter the necessary information, including expiry time and role
4. Click Submit when done.
5. Send your developer the temporary login link.

This way, the temporary developer account will be deleted without any input necessary from you.

Option 2: Create dedicated user accounts

Now that we’ve set up the Developer role, we can go ahead and create a user account for the developer.

1. Navigate to Users > Add User
2. Fill in all the necessary details, and select the Developer as the role
3. Send the developer their username and password over a secure channel, or tick the Send User Notification box so they’re automatically notified

Step 3: Create an SFTP Account

Finally, you should also create a dedicated FTP account for your developer if they’ll need to access your WordPress website files. You’ll need to access your hosting control panel; we’ll use cPanel for this example.

1. Log in to cPanel and scroll down to FTP Accounts.
2. Create a new FTP account for your developer. If you want to limit access or revoke access, you can set the Directory to your WordPress root or another subdirectory.
3. Send FTP account credentials to the developer through a secure connection.

WordPress developer access best practices

You now know the steps for providing developers access to your WordPress site, but there are still some important best practices to cover. Stick to these tips before giving anyone you don’t know admin rights.

Hire trustworthy developers

It’s important to hire developers you can trust. Dedicated platforms like Upwork can track developer references and rating and help you avoid scammers, or you can search on LinkedIn or other WordPress platforms.

Reliable developers often have a professional website and a portfolio showcasing their previous work, as well as a large contact and client base that can serve as references.

Beware of red flags that may indicate you’re dealing with a scammer. A lack of verifiable references, poor communication, pressure to make quick payments, and pushing you to grant access to your personal admin account can all be bad signs. Also be wary of people who “cold contact” you offering to fix your website.

Always conduct a thorough interview, ask for examples of past projects, and verify their credentials before handing over any sensitive info.

Backup your website

One of the most important things you can do to minimize potential damage is to backup your website right before you hand over access to a developer. This way, if something goes wrong – either accidental damage or purposeful vandalism – you can just roll back your website to a working version.

Your website host may come with their own manual backup solution, so check your hosting dashboard. Otherwise, you can use a WordPress plugin like UpdraftPlus to create a manual backup.

1. Go to Plugins > Add New and install UpdraftPlus.
2. Navigate to Settings > UpdraftPlus Backups.
3. Click Backup Now, configure the settings (make sure both database and site files are included), and click to confirm.
4. Once you have a backup, you can restore it at any time. Keep the downloaded zip file somewhere safe.

Create a staging site

Besides creating a backup, it’s also good practice to create a staging site. This creates a copy of your site that developers can work on without affecting your live website. Once the developer is finished, you can review the changes and port them to your live site.

Your hosting provider may have a built-in way to create staging sites in their dashboard, or you can install a plugin like WP Staging.

1. Install WP Staging from Plugins > Add New.
2. From WP Staging > Staging Sites, click Create Staging Site. Enter the necessary info then click Start Cloning.
3. Click Open Staging Site; you can then send developers there to work.

Set up audit logs

Even if you hire a trustworthy developer with plenty of references, keeping an eye on their actions is just best practice. If anything does go wrong, you’ll be able to easily track down the cause of the issue. And if the developer is malicious, you can see exactly what changes were made and revert them.

For this, you’ll need an activity log plugin like WP Activity Log.

1. From Plugins > Add New, install WP Activity Log, or install the premium version after purchasing it from Melapress.
2. In WP Activity Log > Log Viewer, click Filter View at the top and type in the developer account’s username. Or just keep an eye on any critical-severity log entries.
3. In WP Activity Log > Reports, you can generate a full report of a particular user’s actions rather than needing to filter the list of all actions. Filter by a specific User and anything else you wish to filter by, then click Generate Report. You’ll find your new report in the Generated & saved reports tab.
4. Optionally, set up notifications in WP Activity Log > Email & SMS Notifications. This will alert you to any dangerous actions the developer might take, or just send you a summary of their actions each day.

Remove access when no longer needed

Once your developer has completed their work, you should promptly remove access to any user accounts and FTP accounts they were using. This way, no one else can break into these high-privilege accounts to use them for their own nefarious purposes.

1. If you created an account rather than a temporary login, navigate to Users > All Users, find the account, and click Delete
2. Log in to your hosting panel (cPanel in this example). Scroll down to FTP Accounts and open it. Locate the developer FTP account you created and click Delete

Safe and secure developer access

Granting your developer access to WordPress doesn’t have to be a security risk. Best practices like backing up your website, using temporary login plugins, removing unused accounts, and setting up audit logs can all ensure your site stays safe and secure even if you do run into a fake developer.

Installing security plugins like WP Activity Log and Melapress File Monitor can help you keep an eye on developers as they do their work. You can keep your site safe and look out for unwanted changes, while giving legitimate developers space to do their work efficiently.