Doing this properly protects both of you.
WHAT TO ASK FOR
Their own cPanel credentials, ideally created for you rather than shared Or a dedicated FTP account limited to the relevant directory Or sub-account access on their Client Area with appropriate permissions
WHAT NOT TO DO
Accept a shared password sent by email or messaging. If something goes wrong afterwards, nobody can establish who did what.
FOR CLIENT AREA ACCESS
Account > Contacts lets the client add you with specific permissions: services and cPanel access without billing, typically.
This is the cleanest arrangement. You can open tickets and reach cPanel legitimately, and the client can revoke it in one action.
BEFORE YOU START WORK
Take a backup. If something breaks during your work, you want a known-good state, and so does the client.
Note what you changed as you go.
WHEN THE WORK FINISHES
Ask them to remove your access, or remove the FTP account yourself Confirm in writing what you changed
WHY THIS MATTERS
Former developers' credentials are a common route into hosting accounts, frequently because the developer's own machine was later compromised.
