How could I take a "snapshot" of the current state of my WordPress site, then grant Admin access to a freelancer, and finally, check they only changed the files they are hired to fix? (no back door code tucked away somewhere else)

I thought about a git repo, but that's located inside the install directory. So theoretically, it's open to tampering. I could have a remote git clone and test against that-I guess. Not sure if there are other ways...?

  • If they tampered with the git repo it would be pretty easy to tell. Git was built to ensure data consistency, if history is tampered with it will know immediatley via cryptographic means. Combined with the fact git is distributed, so you can push and pull to external repositories, and those repos will kick up a huge fuss if a tampered repo tries to push changes to them – Tom J Nowell Jul 15 '17 at 23:10
  • Is git your recommendation? – xtian Jul 15 '17 at 23:20
  • I just don't know if git will say where the problem occurred or if the whole check would fail. You know what I mean? The difference between "x has changed" versus some catastrophic failure of git, which, by itself, wouldn't be 'proof' of anything but the failure of git to work normally. Correlation is not causation. – xtian Jul 15 '17 at 23:23
  • I'm not sure what you mean there, git is version control software. Add everything and create a commit before your freelancer does anything, then look at the history that happened afterwards to see what changed. I honestly don't see where the problem is, if the freelancer goes into the .git folder and tries to mess with the files then it'll be super obvious, any git command will raise alarm bells, every git subcommand does a verification and integrity check. If your freelancer can modify git without git knowing they're in for a nobel prize – Tom J Nowell Jul 15 '17 at 23:51
  • @TomJNowell I see this is on Hold. I can't be the only person on Stack who would like to hire someone to make a simple edit, for a budget price, and wants a way to audit the security. And you offered an answer, so I'm confused why the Hold. – xtian Jul 16 '17 at 15:18

By using version control and reading the history.

Add everything to a git repository and have the freelancer work via git. Don't allow them to use the built in WP edit files screen, use a modern flow using services such as GitHub/BitBucket/etc or a private git repository.

What if The Freelancer Added a Backdoor?

It will show up in git history, the only way to be sure is to check by reading the changes. But if you're this distrustful of the freelancer maybe you should find another one? It already sounds like your business relationship is stretched thin

What if The Freelancer Tampers With Git

Git hashes aren't random, and there's a lot of cryptographic data integrity checks and science that has gone into Git. Tampering with history this way will be easy to catch, and difficult to pull off

There's even a command called git fsck that will check your git repos object database for connectivity.

What if I don't trust either of those?

Compare it to a backup taken before they got access and read the diff.

  • From my host: "Unfortunately, the git repo push/pull is not supported in shared hosting plan. If you wish to have it, you need to purchase the VPS or Dedicated hosting plan with us." So that's not an option. This is a personal, no-revenue generating website. I don't know the freelancer because I haven't met them yet. But for my budget, to make what's a new CSS template, I'm not guaranteed integrity as service. If you know what I mean. – xtian Jul 16 '17 at 15:12
  • You can download everything, then add it to a local git repo, then repeat with the end result. Shared hosting is not the most useful hosting, aside from it being cheap. There is also managed hosting, e.g. WP Engine hosting is git based, amongst others, a VPS/Dedicated is not necessary. Also note that there's comparing backups – Tom J Nowell Jul 17 '17 at 12:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.