Grant a Freelancer Access to Your WordPress (Without Sharing Your Password)

Why shared logins are a trap

When multiple people use one password, you lose audit trails and can’t revoke access without locking everyone out. Use individual accounts with roles and time-boxed access instead.

Safe setup (5–10 minutes)

• Create a new user for the freelancer with the least privilege needed (Editor for content; temporary Admin only if absolutely required).
• Require MFA on their account and yours. If they need help building a memorable but strong login secret, send this: How to Create Strong Passphrases You’ll Actually Remember.
• Never email passwords. For any credential handoff, use one-time, expiring delivery with a separate access code. How-to: The Safe Way to Share Passwords in 2025 (No Email).

Scope the work (and reduce risk)

• Define tasks (content, theme tweaks, plugin updates) and grant only the role needed.
• Use staging for risky changes; deploy after review.
• Verify links they send (brief domain checks). Guide: Stop Phishing at the Source: Verify Links Like a Pro.

Handoff and cleanup (don’t skip)

• Downgrade or remove their account at project end.
• Rotate any shared secrets (hosting, SFTP, API keys). Dev handoffs: How to Share API Keys and .env Files with Developers (Safely).
• Sweep threads for leaked secrets and clean up. Quick guide: Audit Your Old Messages for Leaked Secrets (90-Minute Sweep).

Useful external references

• WordPress: Roles & Capabilities 🔗
• Two-Factor plugin (official directory) 🔗

Related reading

Client onboarding without shared logins: Secure Client Onboarding (Checklist)

Incident response if something leaks: The Simple Incident Playbook for Leaked Passwords

One-time links vs. encrypted email: What’s Safer in 2025?

Bottom line

Invite people, don’t share passwords. Pick the smallest role that works, add MFA, and cleanly remove access at the end.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.