Collaborating with freelancers can greatly enhance your WordPress site, whether it involves creating content, designing layouts, or fixing technical issues. However, granting access to your site comes with risks. To ensure your website’s security remains intact, follow these guidelines:
Understand User Roles and Permissions
WordPress offers various user roles to manage access levels. Assigning the right role can help limit potential risks:
Assign Appropriate Roles:
- Editor: Ideal for managing content without administrative control.
- Author: Can create content but not publish it directly.
- Contributor: Can create content but not publish it.
- Subscriber: The most basic access, where the user can only view content.
Avoid Full Admin Access:
This should be a last resort. Admins have the ability to change site settings, install plugins, and even delete other users, including you. If there is something a user needs to do that requires higher-level permissions, use a role management plugin to create a custom role with limited capabilities.
Create Separate Accounts
User Account Creation:
Never share your credentials. Instead, always create a new user account for the freelancer. This method ensures:
- Your account is clearly distinguished from theirs.
- Access can easily be revoked after the project.
Temporary Access Options:
For one-time tasks, utilize plugins that enable temporary admin access. These plugins automatically revoke permissions after a set time.
Limit File Access
If a freelancer needs file access, follow these precautions:
FTP Accounts:
Create a separate FTP account restricted to some directories, such as wp-content. That will help to avoid unauthorized access to sensitive files like wp-config.php.
Access via CPanel
Do not share the CPanel credentials. In case of need, create limited FTP accounts that can be deleted after the project is finished.
Monitor and Revoke Access
Review Users Regularly:
Check user lists regularly to ensure only active collaborators have access. Remove unused accounts ASAP.
Change Passwords:
Once the freelancer has completed their work, change your admin password and remove the user account.
Use Temporary Login Plugins
For more security with convenience, check out these plugins:
Temporary Login Without Password
Features
- Create secure self-expiring login links.
- Expiration periods can be set, such as one day or one week.
- Login activity is tracked.
Use Case
- Perfect for support or review type tasks that just need quick access.
Temporary Login
Features
- Create secure temporary URLs for admin access.
- Links automatically expire after set amount of time.
- Use Case: Great for resolving technical issues quickly.
Revoke Temporary Admin Access
Once the project is done, revoke access by:
- Logging into Your Dashboard: Access your WordPress admin area with your credentials.
- Navigating to Users: Go to Users to view all accounts.
Removing or Modifying User Roles
- To delete: Hover over the user’s name and click Delete.
- To modify: Change the user’s role to a lower level and click Update User.
Protect Sensitive Data
- Principle of Least Privilege: Assign freelancers the minimum permissions based on their work.
- Monitoring of User Activity: Log changes by a freelancer using logging plugins.
- Regular Access Reviews: Perform regular access reviews to make sure no unwarranted permissions are granted.
This is how you can confidently take these steps toward secure collaboration with freelancers for your WordPress website without putting your site at risk.
