How to Give a Developer Temporary Access to Your Hosting Account Without Sharing Your Main Password

When you hire a developer or freelancer to work on your website, the easy option is to just hand over your main control panel password. The safer option is to give them only the access they actually need, and to be able to take it back the moment the work is finished without having to change anything else on your account.

Which method to use depends on what the developer actually needs to do.

Never send your main control panel password over email or chat, even to someone you trust. If that message is ever forwarded, leaked, or read by someone else, your entire hosting account is exposed, not just your website files.

If they only need to edit website files

Most developers only need to upload or edit files inside your website's folder. For this, create a dedicated FTP account that is restricted to that one folder, instead of giving out full control panel access.

In cPanel

1. Log in to cPanel and open FTP Accounts under the Files section.
2. Enter a username for the developer and a strong, unique password.
3. Under Directory, set the path to the specific folder their work covers, for example your website's root folder or a subfolder for one app, not the whole account.
4. Set a reasonable disk quota, then click Create FTP Account.
5. Share only the FTP hostname, username, and password with the developer. They can connect with any FTP client.

In DirectAdmin

1. Log in to DirectAdmin and open FTP Management.
2. Click Create FTP Account.
3. Choose Custom and set the path to the specific folder they need, rather than the full account.
4. Set a username and password, then save.

When the work is done, delete the FTP account rather than just handing out a new password later. It takes a minute and guarantees the access is fully gone.

If they only need to work on a database

If a developer is fixing or building something that touches your website's database directly, don't give them your main database user. Create a separate database user and attach it to only the one database they need.

The steps are the same in both cPanel and DirectAdmin's MySQL management tools: create a new database user with its own username and password, then assign that user to the specific database involved with only the privileges required (in most cases, All Privileges on that single database is fine, since it still cannot touch your other databases). Once the work is finished, delete that database user.

If they genuinely need full control panel access

Some jobs, like server-level configuration or troubleshooting across your whole account, really do need full cPanel or DirectAdmin access. In that case:

• Reset your control panel password to a new, temporary one right before sharing it.
• Share that temporary password directly, ideally over a call or a message you'll delete, not a permanent written record.
• As soon as the work is confirmed complete, log in and change the password again immediately, even if the developer seemed trustworthy.

This way, even if that temporary password is written down somewhere or reused, it stops working the moment you reset it again.

If a developer asks for your domain registrar or billing account login too, be especially cautious. Website file and database access almost never requires that. Keep billing and domain management separate from website development work.

For the full walkthrough on restricting an FTP account to one directory, see How to Restrict an FTP Account to a Specific Directory.