0

I hired a developer to edit a specific plugin in my website. As we all know he can't edit the code of that plugin without giving him key-master/administration permeation.

He can at any time to delete my account and take the whole control of my website, I made a plan B and made a backup for my whole website, If anything goes wrong I will delete my whole website from cpanel and make a setup from the backup.

My question is: How I can make myself un-deletable, or made a second door for myself to access my website if he decide to delete my account?

  • 1
    This question has nothing to do with wordpress.com so I removed the tag. wordpress.com is a hosted service – Tom J Nowell Aug 3 '17 at 14:57
  • 2
    I would also strongly advise against editing plugins via the built in editor, a single typo and the whole site could go down because of a syntax error – Tom J Nowell Aug 3 '17 at 14:58
  • @narzan Use an isolated test/local install for developing the plugin! – birgire Aug 3 '17 at 15:05
1

Of course,someone can editing code plugins via the editor and build the shell or somethings like that but I don't they can able to hack your database. Just simple, you can permit developer with specific user role. But I think the best way is using an isolated local install for developing the plugin: xampp,etc...

  • Is it possible to isolate a key-master from deleting an account? – narzan Aug 3 '17 at 17:40
  • Not sure. but I think you can make plugin to prevent delete account through user_id default 1 and prevent edit this plugin on server with unix permission! No one can delete your account and edit this plugin if he can't get access to your server lol .I don't keymaster role in default wordpress but bbpress has it. Of course if I developed the website and wanna freelancer or developer make specific plugin. I think git, maven,svn or simliar tools like that, they permit you can manage developer, see fixed code. – Rei Aug 4 '17 at 10:27
2

If you don't provide the developer access to your database, you will always be able to create a new admin-user directly in the wp_users table.

So basically you can use the database as a backdoor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.