Never Share Your Passwords: How to Give a Developer Safe Access to Your Website

Every week, business owners are asked to send a developer, designer or marketing agent their website password, hosting login or even bank details. It feels like the quickest way to get work started. It is also one of the most common ways accounts get hijacked. You should not need to share a password with anyone to get website work done.

Why sharing passwords is risky

• A password gives full access, including the ability to lock you out.
• You cannot see what was done with it, or who else has it.
• Passwords sent by email or chat can be intercepted or forwarded.
• If you reuse the password elsewhere, other accounts are at risk too.

What to do instead: delegated access

Almost every platform lets you invite another person with their own login and limited permissions. You can see what they do, change their role and remove them whenever you like.

• WordPress: create a new user with only the role needed. See how to give someone access to WordPress safely.
• Shopify: use staff or collaborator accounts. Read the Shopify guide.
• Wix: invite collaborators with a role. Read the Wix guide.
• Hosting and domains: use the team, sub-user or delegate access in your provider’s account settings.
• Stripe and PayPal: use team roles and API keys, never your login. See Stripe and PayPal.

Give the least access needed

Choose the lowest role that lets the work be done, for a limited time, and remove the account when the job ends. Ask your developer what access they need and why.

Turn on two-factor authentication

Even with delegated access, protect your own accounts with 2FA. Our guide to two-factor authentication explains how.

Never share these

• Bank account details or card numbers
• One-time codes sent by text or authenticator app
• Recovery codes and backup phrases
• Your email password, because it can reset everything else

What we do at BzLogics

We never ask for your passwords. We work through limited, delegated access, and we ask you to create a separate user with a new email address so you stay in control. If anyone claiming to be us asks for a password or a code, do not share it and contact us directly using the details on this website. See our maintenance and security service.