I'm looking to farm out some Wordpress site tweeks to an existing personal blog site. One ad requires cPanel access to the server and Admin access to the Wordpress site. Many ads don't list any requirements, so I assume that would be a surprise later.

I understand why they're requesting this access, because I installed and developed the site from the start. Since it's a personal website/blog, I never really had to get deep into role/permissions. At that level, they could also change my access, download my content/db, and anything else I could do.

Any suggestions for granting "development" access without "owner" access? This post What are the differences in capabilities between the super-administrator and administrator? notes that a super-admin is only on a multi-site install, which this is not.

And just to be clear, the work I'm asking for fixes the front end of a custom content type plugin I made.

  • So you want someone to work on your WordPress' code? cPanel shouldn't really be required, but after that it doesn't matter. You can't really only give them partial access to the code (unless you export the plugin, they install it on their site, fix it, export it back to you) – kero Jul 9 '17 at 16:37
  • 'm not worried about the Wordpress site really. I can back it up. Its just that I don't want to get into a relationship only to have it go sour to the point its an excuse to sub-standard work. All just because I forgot some detail of permissions. I'm really a weekend warrior of PHP. I built the site. Added the functionality I wanted, and then promptly forgot everything. I really appreciate the response, and I hope it helps someone else, too. – xtian Jul 9 '17 at 17:07
  • Check with your hosting provider, they may offer a dev environment (sand) of your site, and the appropriate account types /access to it for third party access. – hwl Jul 10 '17 at 0:35
  • obliviously a developer can add backdoors, and therefor there is no reason to lie to yourself and pretend that a developer is not an "owner". paranoia just makes your life harder. if you do not trust someone, just do not work with him – Mark Kaplun Jul 10 '17 at 1:42
  • @MarkKaplun LOL. But seriously. I would then need a change audit. Maybe a followup question would be how can I take a snapshot of the current state, give the dev access, then compare to see they only opened the files they're supposed to! – xtian Jul 15 '17 at 12:35

The WordPress Codex describes the different user roles baked into the core software (https://codex.wordpress.org). Just search Roles.

If you want to see for yourself what each role is capable of accessing just establish new user accounts at those user role levels then sign out of your administrator account and sign back in as each new user. You will see what that role access looks like. then you can sign back in with your admin account and delete them.

Yes, the super-admin role is for a multi-site installation - that role has admin access to all of the sites in the installation, while each separate site has an admin role that can modify only that site - within the parameters set by the super-admin.

A WordPress developer will need at a minimum an admin access account to the WordPress installation in order to make coding changes to the theme that you specify. cPanel access is not totally necessary if you set up an ftp account within your hosting that the developer can use to access files. When you have terminated your agreement you should delete the ftp account and the WordPress admin account. You would probably also want to change your own admin account password just in case.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.