Who can do what.
WHAT TO GIVE THEM
Their cPanel login, always. It is their account and their data.
Withholding it to retain control creates a dispute later and is bad practice.
WHAT THIS MEANS
They can break things. Some will.
That is the trade, and taking a backup before they begin is the mitigation.
FOR WORDPRESS
An administrator account for them, and a separate one for you.
Never share a single login. Actions must be attributable.
DOCUMENTING WHAT THEY SHOULD NOT TOUCH
A short note: edit content freely, ask before installing plugins or changing settings.
Most clients respect that if told.
WHEN A CLIENT BREAKS SOMETHING
Fix it, note what happened, and charge if it is substantial and outside the agreement.
Do not withdraw their access as a response.
ON OFFBOARDING
They keep the account and the data. You remove your own access.
THE PRINCIPLE
The client owns their site, their domain and their data. You provide the service.
Anything that obscures that will be resented eventually.
