How to Give Someone Access to Your WordPress Website Safely

If a developer, editor or marketing person needs to work on your WordPress site, give them their own account instead of your password. It takes a couple of minutes and keeps you in control.

Step by step

1. Log in to your WordPress dashboard and go to Users, then Add New.
2. Enter a username and the person’s own email address, or a new email address you control for this purpose.
3. Choose the role that matches the work (see below).
4. Let WordPress send them a link to set their own password, so you never see it.
5. Ask them to turn on two-factor authentication if the site has it.

Which role to choose

• Administrator: full control, including plugins, themes and users. Only for trusted people who need to change the site’s structure.
• Editor: can publish and manage all posts and pages, but cannot install plugins.
• Author: can write and publish their own posts.
• Contributor: can write posts but not publish them.
• Shop Manager: available with WooCommerce for managing products and orders.

Developers often need the Administrator role to install or configure plugins. If you are cautious, ask whether the work can be done on a staging copy first.

Do not share these

Your own admin password, your hosting login and your email password should stay private. If the developer also needs server access, use your host’s team or sub-user feature.

Check who has access

Under Users, review the list from time to time and remove accounts you do not recognise. Unknown administrators are a warning sign. Read the signs your website has been hacked.

Remove access when the work is done

Delete the user, and when WordPress asks, assign their content to another user so nothing is lost. Change any shared keys, such as API keys, if they were used.

Need a safe pair of hands?

We work this way with every client. See our website maintenance and security service or read why you should never share passwords.