Giving Contractors Hosting Access Without Sharing Your Main Password

Your developer needs FTP. Your designer needs WordPress admin. Your SEO person wants "just quick cPanel access." The easy answer is to text them your main password and deal with it later. Later is usually a Friday night outage, a plugin they installed without telling anyone, or a contractor who still has keys six months after the project ended.

You can give people what they need on Canadian hosting without handing over the keys to everything. It takes five minutes of setup and a habit of revoking access when the work is done.

Start with the smallest door, not the biggest

Full cPanel or root SSH is rarely the right first move. Most contractors need one of these:

• Files in public_html or a theme folder (SFTP or FTP)
• WordPress admin to edit content, not install plugins
• Database read-only for reporting, or a single staging copy
• DNS or email changes at the registrar (often better handled by you, with a checklist)

Match the account to the task. A freelancer uploading CSS does not need MySQL root. A marketing contractor does not need shell.

cPanel and reseller: separate users, not shared logins

On cPanel hosting, create a sub-account or FTP/SFTP user scoped to one directory. Point them at /public_html or /public_html/wp-content/themes/your-theme, not the whole account home.

For WordPress, add a user with the Editor or Author role instead of Administrator. Editors can publish and change pages; they cannot install plugins or change themes unless you want them to. If they truly need plugin access, use a staging site and a separate admin there, not production.

Write down who has which login in your runbook. When the contract ends, delete the FTP user and remove the WordPress account the same day. "We will do it next week" is how forgotten access piles up.

VPS and dedicated: SSH keys beat passwords

On a VPS, avoid sharing the root password or your personal sudo user. Create a Linux user per person (or per firm) with:

• SSH public key authentication only, no password login
• sudo limited to what they need, or no sudo at all if they only deploy via Git
• chroot or filesystem permissions so they cannot read /etc, other sites, or your .env files

Tools like deploy users with ForceCommand internal-sftp in sshd_config give file access without a full shell. Agencies that deploy with Git often only need a single git user and a post-receive hook, not interactive SSH.

Rotate keys when staff change. One key per laptop, labeled in authorized_keys with a comment like agency-jane-2026, makes audits bearable.

Staging beats "be careful on prod"

If a contractor needs to try plugins, run migrations, or test a new PHP version, give them a staging subdomain or clone on the same server (or a small second VPS). Production stays locked down; experiments happen where a mistake only embarrasses you, not your customers.

Sync staging from production on a schedule you control. Do not let staging send live email or hit production payment gateways. We see that go wrong more often than brute-force attacks.

When you must use a shared panel password

Sometimes a legacy host only offers one cPanel login. If you are stuck:

• Change the password the day they finish, and again if the relationship sours
• Enable two-factor authentication on your own admin paths first
• Turn on login notifications if your panel supports them
• Back up before they touch anything, and know how to restore

Treat that as a temporary bridge while you move to scoped users or a better host, not a long-term plan.

Canadian hosting and privacy

If contractors are outside Canada, their access still touches your server in Beauharnois or Toronto. That is fine for many sites, but regulated clients sometimes care who can see files and logs. Scoped accounts make it easier to answer "who had access in March?" without admitting that everyone shared one password.

Offboarding checklist (copy this)

1. Remove FTP/SFTP users and SSH keys
2. Delete or downgrade WordPress users; force logout if the plugin allows it
3. Revoke API keys they used (Stripe, SendGrid, Cloudflare, etc.)
4. Check cron jobs and "must-use" plugins they may have added
5. Scan admin users and panel sub-accounts you forgot about
6. Update your internal doc: access removed, date, who confirmed

Bottom line

Sharing your main hosting password is fast and expensive. Separate users, tight directories, SSH keys, and staging give contractors room to work while you keep production yours. Set it up once, revoke on schedule, and sleep better when the project ends.

Need help splitting production and staging on a Canadian VPS, or hardening cPanel for an agency workflow? Talk with Swift Host. We do this for clients every week.