Give your web developer or a security company access to your website (cPanel, FTP or WordPress)

If a web developer, designer or website security company (for example a malware clean-up service) needs to work on your site, there are a few ways to let them in. The right one depends on what they need to do and how long they'll need access. This guide explains each option, and how to tidy up afterwards.

Quick guide: which option should I use?

• They'll be looking after your hosting on an ongoing basis: invite them as a user on your client area (Option 1).
• They need full cPanel access for a one-off job: ask us for your cPanel login details, pass them on, and change the password when they've finished (Option 2).
• They only need to upload or edit website files: create an FTP account just for them (Option 3).
• They only need to work inside WordPress (plugins, themes, content, a security plugin): create a WordPress user for them (Option 4).

Give people the least access they need to do the job. It's always easier to add more later than to clean up after too much.

Option 1: Invite them as a user on your client area

This is the best option for a developer who looks after your site regularly. They get their own login, can open cPanel from your service page without knowing your cPanel password, and you can remove them with one click.

1. Go to My Account → User Management (https://www.hooplahosting.co.nz/client/account/users).
2. Enter their email address under Invite New User.
3. Choose Choose Permissions and tick only what they need. For a developer this is usually services and support tickets. They don't normally need invoices or payment methods.
4. Click Send Invite.

Only the account owner can invite users. There's more detail in Give a team member, developer or staff member access to your client area.

Option 2: Share your cPanel login for a one-off job

Some security companies and developers ask for a cPanel username and password so they can scan or fix the site. cPanel on our shared hosting doesn't let you create a second, full cPanel login, so the way to do this is to share the account's own login for the duration of the job.

1. Open a support ticket from Support → Open Ticket and ask for your cPanel login details.
2. We'll add them to the ticket's secure sensitive data area rather than putting them in an email. Log in to the client area, open the ticket and click View or Edit Sensitive Data to see them. See How to send and receive logins securely.
3. Pass the details on to your developer or security company using a secure method they provide (many have an encrypted form for this).
4. When the work is finished, change your cPanel password. Go to Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services), open your hosting service and click Change Password.

For your security, we only send login details to the account owner or an authorised user on the account. We can't send them directly to a third party, even if you ask us to.

Option 3: Create an FTP account for file access only

If they only need to upload or change files, an FTP account gives them that without access to your email, databases or the rest of cPanel. You can also limit it to a single folder.

1. Open your hosting service from Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services) and click Log in to cPanel.
2. Under Files, click FTP Accounts.
3. Enter a username and a strong password (the Password Generator button helps).
4. In Directory, choose the folder they should be able to reach. For example, public_html for your main website, or a narrower folder if they only need part of it.
5. Click Create FTP Account, then send them the details securely.

They'll connect with an FTP program such as FileZilla. See Upload your website with File Manager or FileZilla for the connection settings.

Option 4: Create a WordPress user for work inside WordPress

Many jobs, including installing and configuring a security plugin, can be done entirely from the WordPress dashboard.

1. Log in to your WordPress dashboard. See Log in to your WordPress dashboard if you're not sure how.
2. Go to Users → Add New User.
3. Enter their username and email address, and choose the role they need. A developer or security service usually needs Administrator. Someone just adding content only needs Editor.
4. Click Add New User. WordPress will email them a link to set their own password.

Give them a username that makes it obvious who they are, for example the company's name. That way you'll recognise it later when you check your users.

When the work is finished

• Remove access you no longer need. Remove the client area user, delete the FTP account in cPanel and delete or downgrade the WordPress user.
• Change shared passwords. If you shared your cPanel login, change it as described in Option 2.
• Check your WordPress users now and then. If an administrator appears that you didn't create, or keeps coming back after you delete it, your site may still be compromised. See My WordPress website has been hacked: what to do.

Please don't share your client area password. Anyone with it can change your payment details, cancel services or lock you out of your account. Use Option 1 instead.

Not sure which option suits your situation? Open a support ticket and tell us what your developer needs to do, and we'll point you in the right direction.