Should I give my web developer my username and passwords?
Modified: October 28, 2022
I know, best practices always preach “Don’t share your password with anyone”.
If you need to hire a web developer though, the first thing they ask for are usernames and passwords to your website accounts.
Should you give your username and passwords out when you hire a web developer to build or edit your website?
Well, If you want them to complete the work you are requesting, yes. Otherwise it’s impossible for them to do their job. Recently I had someone that wanted to hire me to make changes to their website, but they would not give me access to the website code.
I understand the hesitation, but compare it to taking your car to a mechanic to have maintenance done.
Do you have to give them the keys? Yes.
Do you trust them? You have to.
Hopefully you have done your due diligence with the company by asking for referrals and reading reviews online about their services first.
Is there a chance they will disappear with your car? Sure, I guess there always is.
This post is mainly addressing hiring a freelance web designer/developer.
Most likely you had hired someone to build your site and now time has passed. It needs updates, website fixes or redesigned. The original web designer has gone out of business or won’t return your calls, so you searched online for someone to work on your website.
You do your due diligence, by reading reviews, reviewing their website for experience and contacting them, ultimately deciding to hire them to work on your website.
They will most likely request multiple different types of logins associated with your website since there are different parts and services associated with creating a website on the Internet.
I’m not saying that a freelance web developer needs to have access to everything associated with a website, but they will need specific logins to complete tasks.
Typically I ask for the following usernames and passwords:
FTP Access
cPanel Access or your hosting account control panel login
WordPress admin access ( administrator role )
Often people do not know what FTP access is or, or have never needed to use it. So I tend to ask for cPanel access to be able to then FTP into the account.
Do you have to give them these logins? If you want the work to be completed, yes.
How to protect your usernames and passwords.
There are definitely ways that you can protect yourself if you are not comfortable giving this information out.
Know how and where to change your account passwords. If you need to block access from the developer at any point you can change the password.
Create temporary usernames and passwords rather than the main account logins.
Never send logins over an email. I always provide secure web forms that stores logins sent to me in a database so they are never exposed over email. I even built this website to securely send logins to me online.
Take advantage of tools your web host provides to make sharing more secure. GoDaddy offers a way to delegate access to parts of your account.
When the work is complete, revoke the logins that you created or change the passwords.
So yes, you need to share access to your accounts for a web developer to be able to complete the tasks you request. There are ways to protect your self though. Be smart.
Automatic updates sound great. They just happen. You don’t have to think about it. There are some significant downsides to enabling automatic updates though.
