Temporary access.
WHAT TO GIVE
The minimum needed for the work Their own account, not yours Time-limited, where possible
WHAT NOT TO GIVE
Your main hosting credentials Your registrar access Administrator access for a content task
WHY NOT YOUR OWN CREDENTIALS
They gain access to everything: email, billing, domains.
And you cannot revoke it without changing your own password.
FOR A DEVELOPER
An administrator account in their name A separate FTP account limited to the relevant directory Database access if genuinely required
WHAT TO AGREE
What they need access to and why When it ends That they will not share it
WHEN THE WORK ENDS
Remove the access.
Same day.
WHAT PEOPLE FORGET
Contractor accounts from years ago, still active.
Audit for them.
WHAT ELSE TO CHECK
Whether they added their own accounts or keys.
