Ok. So your business is growing and you need to hire somebody to work on your site to make further improvements. That’s great. Before you go ahead it’s worth taking some time to plan things out.



There are a few things to consider before sharing all your passwords.

That is especially true when you’re about to do something new that may have a devastating effect on your business it always pays off to reflect and plan things out no matter the urgency.

Discuss with your team members or more tech savvy friends what you’re trying to achieve and gather feedback. It’s always a good idea to bounces ideas off of somebody. This process will reveal some blind spots that you haven’t considered.

If you don’t have anybody to call or if they are too busy you can post questions in the following groups/sites


Considering options

All depends on the work that you need done so here are several options.

Content Writer

If your need someone to write content for your site then giving them contributor role should suffice. Then you will need to approve the their articles.

If the person needs more access you can check for a role plugin that you can use to cherry pick which permissions that the person needs.


Web Development / Design

Sometimes come with a page builder plugin that means that if the user has access to manage themes (possibly editor) he/she should be able to do their job.

The person may be more effective if there are using FTP program because they know how to use it and the transfer of files is happening quicker.

The thing is FTP access is not that secure. A bad person (and technically savvy) can cause lots of damage because if he/she uploads some programs they can bypass the FTP protection.

To mitigate that risk it’s batter to use either a separate hosting account or a Staging Server such as qSandbox.


Another thing is to clear is any orders or client related info.


Action steps

  1. Set up a staging site
  2. Clean up any client specific info
  3. Create WordPress account
  4. Create FTP/SFTP account
  5. Give clear directions & inspect work


1.Set up a staging site

The first step is to set up a staging site. This involves cloning your existing site to a new location.

Ideally, this should be another hosting account so things are separate or use a staging server such as qSandbox. That way the files and database will be physically separate and any damage would contained.

Why do it in the first space? Can’t the person just fix my site directly?


Yes and No. Do you like risk?

How confident are you in the new person’s capabilities?

Has he/she proven themselves yet?

Are you running a promotion/marketing campaign? Can you handle downtime due to a mistake or missed detail?


Also the benefit of a staging environment is enormous. You can proof read the new content, design. After you see the work done you will have even more ideas what to further improve.

I suggest that you take an incremental approach in improving things.

Make changes and post them on your site. Then plan the next step(s).

Yes, it’s scary to publish new work for the fear of being criticized but if the changes will improve any of site’s organization, speed, checkout process it’s worth getting to the users as soon as possible.


How to do it?

There are tons of video tutorials on YouTube how to do this.

You can use plugins such as Duplicator, All-in-One WP Migration or any other backup plugin.

If you have some technical knowledge but not enough WordPress knowledge you may be tempted to go directly into the control panel and dump the database and archive files.

That would work too BUT you will have to do some extra work using additional plugins (e.g. search and replace) or wp-cli. The reason is that the way WordPress stores data internally.

You can’t and should not do a direct search and replace in the database. This will corrupt data. Using a plugin for the migration is a wise choice because it will take care of data as well by replacing old links (e.g. example.com) to point correctly to staging.example.com.

One more thing that’s super important is to block access to the staging site so it’s not *accidentally* indexed by search engines or targeted by spammers. You can use an under construction plugin or similar to achieve the same result.

Yes, WordPress has an option in the settings to discourage search engines from indexing the site. It’s up to the search engine to respect those rules or not. Additionally, you may forget about the settings and sometimes that’s get transferred to the live site and then your site will disappear from search results.


2. Clean up any client specific info

You can do that either manually by going to WP-Admin > WooCommerce > Orders and delete everything there. After that create 1-2 fake orders.


3. Create WordPress account

To create a user go to WP-Admin > Users > Add New and enter username & pick the appropriate role. If you trust the person you can make them admin.


4. Create FTP/SFTP account

In your control panel there should be a section that you can go to in order to create an FTP account.


5. Give clear directions & inspect work

The quality of the work will 100% depend how clear you are with the goals.

So use whatever you can to clearly communicate what your business needs

You can use documents, videos, audio to communicate their message.

Some business owners come up with a solution of their own and hire somebody to implement it for them. I suggest that you find an experienced developer/designer who can give you honest feedback on your current solution. If you have evaluated just one solution you are most likely going with less optimal one. Ask for side effects and potential holes in the current solution before the person starts implementing it.

After you’ve decided which road to take. Create documents and store them in a cloud service provider such as Dropbox or similar and grant access to that folder only by inviting them via email to that folder only.

Having the documents in the cloud makes sure that they are always up-to-date rather than emailing them back and forth. Also you can remove the access anytime and the dropbox should delete the files from that subcontractor’s computer when they no longer need access to them.

Things can get messy in a cloud folder as well so it’s better to use YYYY-MM-DD-something naming convention for files so the most recent one is at the bottom.

After the work is done. Inspect it. Share feedback. It’ll be better to share it via email & a video recorded message. That way you will not only explain but also show where you need things improved.



Are you looking for ways to give a web developer access to WordPress/WooCommerce website without disclosing private information?

Maybe you were also looking for how to give a web developer limited access to WordPress/WooCommerce website?



Free WordPress Sandbox

Do you want to get a free test/Sandbox WordPress site? Join Now


If something needs correcting in this article, you have an idea or suggestion always let us know