how do i give someone access to my website, safely?

web · 2026-09-20 · 3 min

access is not one thing. your website has at least three doors — the site itself, the hosting, the domain — and most people who ask for access need only the first one. hand over the keys to all three and you have handed over the business.

the safe pattern is the same everywhere: a separate account, the smallest role that lets the person do the job, and a way to remove it when the job ends. never your password.

decide what they actually need

a copywriter needs to edit pages, not install plugins. on wordpress that is the editor role; on a builder it is usually a collaborator seat. a developer needs file or database access, which means a separate sftp account or ssh key, not your hosting login. an agency doing seo needs analytics and search console, which you can grant without giving them the site at all.

write down what you gave and to whom. a line in a notes app is enough, and it will save you an afternoon in two years.

the three doors

the site: create a user with their own email. on wordpress, users > add new, role editor or author. on wix and squarespace, invite a collaborator. the point is that the activity log shows their name, not yours.

the hosting: avoid sharing the main panel account. most providers let you create a sub-account or a separate sftp user restricted to the site folder. if they need to deploy, a git-based host like netlify or vercel gives them a deploy key instead of a password.

the domain: this is the one to keep. the registrar account controls where the site points and whether you keep the name. if someone needs to change dns, create a limited user at the dns provider (cloudflare supports this) rather than handing over the registrar.

removing access

when the work ends, delete the account, rotate the passwords you shared, and check the dns records for anything you did not add. removing an editor is one click; discovering a year later that a former collaborator still has ftp access is a different afternoon. the same discipline is what makes a disappearing freelancer a nuisance instead of a disaster: what if the freelancer disappears.

faq

should i just give my password?

no. a shared password cannot be traced, cannot be revoked without locking you out too, and usually unlocks more than the person asked for. separate accounts exist for this.

can someone work on my site without access to the domain?

yes, and that is the normal arrangement. the domain stays with you; site and hosting access are enough for almost every job.

what if the freelancer needs everything?

give time-boxed access, keep the registrar and the billing in your name, and change the credentials the day the project closes.