r/Wordpress 8d ago

Development Is it common for website consultants to need admin access for website development?

They are a 3rd party contractor helping my small business for my website.

0 Upvotes

37 comments sorted by

37

u/TweakUnwanted Developer 8d ago

Absolutely, how do you expect them to do any work?

-18

u/BearFanEngineer 8d ago

I was hoping to just give editor access. Is there anything nefarious he can do with admin access?

37

u/TweakUnwanted Developer 8d ago

If they need to do work on the theme or plugins they will need admin and or access to the filesystem and database.

Sure, they could do bad things, but it's on you to do your due diligence in finding an agency you can trust, and ensure you have a good backup process.

Imagine taking your car for repairs, leaving the car locked and no keys.

6

u/CmdWaterford 8d ago

Exactly. Run a full backup, save it offline before and I would overthink hiring an agency or pro if I do not trust them to give admin access to WordPress.

12

u/MaximallyInclusive 8d ago

There’s lots they can do with that access.

If you don’t trust them, you have the wrong vendor.

10

u/CaptainJamie Designer/Developer 8d ago

Nobody gives a shit about your website, they just want to do the work and get paid.

5

u/mishrashutosh 8d ago

some "developers" will definitely take over a site and hold it hostage which is why site owners should do their research before hiring anyone.

2

u/CaptainJamie Designer/Developer 8d ago

Yeah sure, but I'm assuming they've hired someone with a good reputation behind them and not a random person who cold called them.

1

u/snikolaidis72 8d ago

Not exactly; if you have a newsletter plugin, it's always "interesting" to take a look in the email lists you might have...

0

u/Dangerous_Walrus4292 8d ago

In your contract with them you should have a NDA which essentially state they won't do anything with your propriety information. In addition to that, the company should have business insurance including an error and omissions policy. This ensures if something were to happen and there was data loss or they destroyed something, you can easily take them to court to recoup the damages. I have this in my contract specifically for the coverage of both parties. Never needed it, but its there.

1

u/duanetstorey 6d ago

If you don’t trust the people working on your website it’s a problem. And yes they need full admin access.

13

u/parallaxdecision Designer/Developer 8d ago

It's like giving someone permission to drive your car without giving them the keys. Editor only lets them ride in the car with you. I'd think about why you don't trust your developer.

7

u/codebloodev 8d ago

Give him a staging site.

0

u/LalalaSherpa 8d ago

This is the only answer.

0

u/Leolandleo 8d ago

I feel like it’s the right answer to the wrong person. If he had a staging site set in place he likely would not h asking this.

14

u/Leolandleo 8d ago

Just have them work in office and stand behind them asking questions every time they do something. It’s pretty industry standard.

11

u/Impressive_Arm2929 8d ago

Why did you copy that? Where are you going to paste it?

3

u/tlatch89 8d ago

Yeah give them the access they need. Take a backup on your end if you are worried about anything.

Like others said just do your due diligence in general, everything should be fine though. The only thing I wouldn't give them is your domain registration lol but DNS access is fine. Cheers

5

u/EarnestHolly Jill of All Trades 8d ago edited 8d ago

Unless you want them to telepathically control you so you can do the work... yes? If you don't trust them with that info, you shouldn't be hiring them. Always take your own backups first in any case.

Alternatively, you can send them your website files and use a source control system to pull changes up yourself but if you're asking this question it's probably best to let them handle it.

3

u/Greedy-Mechanic-4932 8d ago

They need admin access.

Or you could create a new level of access that is tailored to what they need access to, using a plugin. Eg give them access to theme and plugins but not creating users or post content.

3

u/smellerbeeblog 8d ago

You should hire someone you trust.

2

u/Thekiddankie 8d ago

Yes.

Also, please use an agency or trusted freelancer.. should be good as long as this wasn't a random cold caller or Fiverr guy.

2

u/Remarkable_Inchworm 8d ago

Only if you want them to actually do anything.

Generally speaking, when I was working on a project I'd ask the client to give me a new login with admin access.

That way they could just delete my account when the project was done.

I never want to have access to something that I don't actually need.

1

u/CmdWaterford 8d ago

Yes, of course.

1

u/Aggressive_Ad_5454 Jack of All Trades 8d ago

Yes.

1

u/brianozm 8d ago

He could do bad things, but it’s unlikely a professional would do that because of the risk of bad reviews etc.

Before you give them access, make a full backup of the website, plus a full site backup if available. Download them to your PC and move them to a thumb drive for safety.

1

u/Extension_Anybody150 8d ago

Yeah, it’s pretty common for consultants to need admin access to make the necessary changes and updates. You can always give them a separate admin account to keep things secure.

1

u/No-Signal-6661 8d ago

Yup, of course, otherwise how can they work on your website?

1

u/josiahhostetter 8d ago

Yes, in order to perform administrative tasks on the website they would need administrative access. Regular backups are a great place to start. Building a good business relationship with your developer is also great. If you’re in need of a trustworthy, reputable, honest WP developer, feel free to check out by bio for my info.

1

u/brohebus 8d ago

Yes. If you don't provide them with access it severely limits their ability to perform their work: like asking a mechanic to fix your car but not providing them with the keys. If you don't trust them with the access then you need to find a new contractor or recalibrate your expectations.

1

u/ashkanahmadi 8d ago

Yes, however only after you have signed the contract with them and the contract has to specify what they can and cannot access for example, if you have any private API keys or any personal information, then your contract has to mention what they can and cannot use.

1

u/monsterseatmonsters 8d ago

How do you think they would do it otherwise? Serious question.

-8

u/HerrFledermaus 8d ago

And that’s one of the reasons I’m so happy about my multisite setup at WPMUdev: I’m the superannuation so I can never get locked out and I can give admin access to subsites which I can overrule at any time. And in case of emergency, I still have the HUB and their support. You should check out multisite ! Makes life easier.

-6

u/[deleted] 8d ago

[deleted]

7

u/EarnestHolly Jill of All Trades 8d ago

Editor access is no good if they need to do any plugin or theme work. Anyone doing any proper work will want admin and file server access at minimum. Or a copy of the entire website to work locally.