3rd party access to wordpress [SOLVED]

Hi,

If it's setup correctly, then they wouldn't be able to view files higher up in the directory structure.

You don't need to give FTP access for WordPress. Your users can do everything through WP dashboard itself. File uploads, install and delete plugins/themes, etc.

Their rights depend on the privileges you grant them.

Normally, they will only be able to change/affect WordPress according to those rights. Unless their login details are the same as your ftp/hosting details (and they maliciously figure it out), they will not be able to make changes elsewhere.

You can further lock-down their privileges with plugins such as WordPress › User Role Editor « WordPress Plugins and WordPress › Role Scoper « WordPress Plugins

Normally, your site admin (host site) login - which is, usually, the same as your FTP credentials, can not and should not be the same as any WP blog's login.

The site admin (host site) user name and pw are created when you sign up for your hosting package.

The WP username and pw are created by YOU when you install WP.

Any WP user, even if having admin role and capabilities - can only mess around with the WP admin panel.

HOWEVER, since one can upload a lot of stuff directly from the WP admin panel to the server - I still wouldn't give those login credentials to people I don't trust!

If I have administrator access to your WP Dashboard, and the plugin or theme editors are still enabled, I can wreak havoc with your web server, because I now have direct file-editing capability.

I can go to a theme file, insert my own script, and call the theme file directly from a browser. Or I could upload and activate my own plugin or theme that does nasty things.

Do NOT give admin privileges to anyone you don't trust implicitly.

As others have said, yes.

To elaborate on what others have mentioned, for instance, depending on your server & PHP configuration, a rogue administrator could upload a php shell like the one found here and execute all kinds of commands.

He could for instance:

• Get your database username and password
• Navigate to your mail directory and read your emails, or download them for later reading. (this alone can open up lots of trouble and wreak havoc on your life outside of your web site)
• Modify your web site(s) to include a tracking code so that he can spy on your search engine traffic.
• Modify .htaccess to route traffic to another web site.
• Post links or other content on your site that can be undetected by you because it is only visible to people outside of a range of IP addresses that includes yours.
• Hide a backdoor (web shell script) that allows him to access your hosting account at any time he chooses.

Yes. It depends on the host and how they've got PHP and some other things set up. I'm able to do everything I've mentioned above (just testing it out on my OWN site ) on an account I have with a pretty standard cPanel hosting provider.

So make sure you trust anybody that's going to work on your site. I wouldn't, for example, go to fiver and hire some guy that you're unfamiliar with, and give him administrator access.

I really appreciate the responses here. This has been a real eye opener for me! I do want some 3rd party wordpress assistance but I don't know anyone with the requisite skills well enough. I'm considering the following method in an attempt to reduce risk:

1. Open a separate hosting account
2. Install WP
3. Take a snapshot of the public_html folder.
4. Give access to 3rd party
5. Use a diff tool to compare the original snapshot and the current puplic_html directory.
6. Look for changes to .htaccess or other unexpected changes (perhaps additional files?)
7. Once satisfied, migrate WP installation to main hosting account.

I realise this doesn't solve all the security issues pointed out by SteveJohnson and mojojuju but at least it prevents them from interfering with other websites since they are on a dedicated 'development' hosting account containing one site at a time.

Well, number 3 and 5 will NOT solve anything.
What if they injected some "ugly" stuff in your database?

BTW, you never said why would you offer full access to your blog to people you don't trust?
For theme development - you don't need it; just let them do the work on their server and give you the finished product.
For adding content you can give them a way lower level of access.

You either don't understand the basics of a CMS (content management system) or... I don't know what to think.

The whole idea of a CMS is to have the engine (aka WP core files), the layout (aka theme) and the content (aka entries in the MySQL database) ABSOLUTELY SEPARATED!

Coder and/or graphic designers, who would work on your theme/design - are crappy writers. Why would you let them write your content?
On the other hand: once a CMS is set up properly, adding content would be exactly like typing posts here - meaning you can do it or a VA can do it for $2 per hour... no need to pay $100/hr a developer to type your blog posts.

That's why I am completely confused about your idea of having a developer "adding content". It just doesn't make sense! (It did at the time of having the whole website done with separate HTML files...)

You may want to revise your plan and the tasks requiring a "developer". Don't pay job development (coder/designer) fees for simple typing jobs

For what they're worth, my thoughts on the matter:

I stated earlier that you shouldn't give admin access to anyone you don't trust. You didn't give all of the details in your OP.

That said, if you can't fully trust a developer who's doing work for you, you need to find someone else that you CAN trust.

Developing a theme is not an easy task, especially if it's a custom one. Any hoops that a developer has to jump through adds to the time of completion - and time is money.

If you would come to me as a developer with a workflow such as you are proposing in post #15, I would tell you to go fly a kite.

Beyond that, with a theme, I could 'inject' whatever nasty stuff into your database that I would like, should I choose to do so.

Find someone you can trust, and cut down on the paranoia a bit - it'll shorten your life