How to safely give an agency or freelancer access to your site
Sooner or later someone from outside will need access to your site, a designer, a developer, an agency. The natural reflex is to send the administrator login and password. It is convenient but risky: you give full power, you do not know who really logs in, and once the work is over you often forget to revoke it.
The principle of minimal access
Give as many privileges as are actually needed for the task, no more:
- A separate account for each person, never shared. Then you can see who did what.
- A role matched to the task: a designer working on content does not need full administrator rights.
- Access for the duration of the work: once it is over, you remove or block the account.
Never send passwords by plain email
A password in an email or messenger stays there forever and can leak. Better: create an account for the other person (they set their own password) or pass the details through a secure channel. On top of that, enable two-factor login on accounts with higher privileges.
After the work is done, do a simple review: remove accounts you no longer need and change the passwords to key access points. A sudden, unknown administrator is one of the first symptoms of a problem.
Access to hosting and the domain is a separate matter
An account in the site panel is not the same as access to hosting and the domain. The latter are the "keys to the kingdom", make sure they stay with you. A contractor can work without owning your domain.
We will arrange access safely
As part of our care service we keep accounts and privileges in order, hold credentials in an encrypted vault and make sure no open doors are left after each engagement.
Want to sort out who has access to your site? Get in touch.