# Giving a developer or agency access to your WordPress site

Give each outside person their own WordPress user. A writer needs no more than the Editor role. Work on plugins, themes or code takes Administrator.

Updated: November 10, 2026

Add each outside person to WordPress as a user of their own, with a role that matches the work. Your own login stays with you. With a separate user, the site shows which user wrote each post, and when the work ends you delete that user and nothing else. This is the same rule as for any vendor, covered in [letting a vendor use your company's accounts](/guides/outsourcing-access).

This covers WordPress that you host yourself or through a web host, as documented on WordPress.org. A site on WordPress.com works differently. Its roles add a Viewer role for private sites. The person who created the site, the site owner, keeps a few powers other Administrators lack, such as transferring the site. WordPress.com also lets you label a user as an outside contractor or agency.

## The six roles, and where the line falls

WordPress.org's documentation describes six built-in roles. Each role has a list of capabilities, WordPress's word for the tasks it allows. Those lists sort the roles like this.

| Role | Whose posts it can publish | Can it upload files | Plugins, themes, users and settings |
| --- | --- | --- | --- |
| Super Admin | Anyone's, on every site of a multi-site network | Yes | Yes, for the whole network |
| Administrator | Anyone's | Yes | Yes, on a single-site install |
| Editor | Anyone's | Yes | No |
| Author | Only their own | Yes | No |
| Contributor | Nobody's. Writes drafts that someone else publishes | No | No |
| Subscriber | Nobody's. Has a profile and can read | No | No |

The line that matters for outside help runs between Editor and Administrator. An Editor's capabilities cover content: editing and publishing posts and pages, their own and everyone else's, managing categories, moderating comments and uploading files. An Administrator has those and adds the ones that change how the site works.

| Capability group | Editor | Administrator on a single site |
| --- | --- | --- |
| Publish and edit everyone's posts and pages | Yes | Yes |
| Moderate comments, upload files | Yes | Yes |
| Change site settings and theme options | No | Yes |
| Switch themes, activate plugins | No | Yes |
| Install, update, edit or delete plugins and themes | No | Yes |
| Add, edit, promote or delete users | No | Yes |
| Export and import site content | No | Yes |

On a network of sites, WordPress reserves installing and editing plugins and themes, and creating and deleting users, for the Super Admin.

## Which role for which kind of help

A writer or content agency that posts articles for you fits Author or Editor. Use Contributor if you want to approve each post yourself, because a Contributor can't publish. A Contributor also can't upload files, so someone else has to add the images.

A developer who installs a plugin, edits the theme or updates WordPress needs Administrator. There is no built-in role between the two. You can build one: WordPress.org's Roles and Capabilities page names the code functions that add or remove a capability or a role, and lists plugins that manage roles. Plan that change with your developer.

An Administrator can do everything you can, including adding and deleting users. Two habits limit the exposure. Give the role for the length of the job and lower it to Editor or delete the user afterward. And keep your own Administrator user separate, so that you can remove theirs. The Administrator that WordPress creates at installation may be a user an earlier agency set up. Make sure you can sign in to it before anything else.

## Adding the user

1. In the dashboard, go to Users, then Add User.
2. Enter a username and the person's email address. Both are required, and no two users can share an email address.
3. Leave Send User Notification checked. WordPress fills in a password and emails the person a link to set their own, so you don't need to send them one.
4. Choose the Role from the list.
5. Select Add User.

WordPress 6.8 and later use these labels. Earlier versions call the screen and its button Add New User, and the menu item Add New User or Add New. WordPress.org's page for this screen still shows an older "Send Password?" checkbox. On a multisite network, the form has no Send User Notification box, and by default the person gets an email they have to confirm.

Use the person's own work email address, not a team address at the agency. If the agency sends three people, add three users. That keeps each person's posts under their own username. When one of them leaves the project, you delete that user and the other two keep working. The Users screen lists every user with their role and the number of posts they have written.

The Role list on Add User starts at the New User Default Role from Settings, then General. If an earlier setup left that at Administrator, change it before you add anyone in a hurry.

## Removing the user when the work ends

On the Users screen, hover over the person's row and select Delete. You can't delete the user you're signed in as. If the user owns content, WordPress then asks what should be done with it.

One option deletes all of that content along with the user. The other attributes it to a user you pick from the list. Choose it when the person wrote content you want to keep.

Do this on the day the contract ends, and look through the whole user list while you're there. Users from earlier projects stay on the list until someone deletes them.

## What the WordPress user list doesn't cover

Roles control what a person can do inside the WordPress site. A developer may ask for more than that: the hosting control panel, a file transfer login, the database, or the domain registrar. Each of those is a separate account, and deleting the WordPress user leaves them open.

Before the project starts, write down every login you give the developer and how you gave it. Where the service lets you add a user for them, do that. Where it offers one login for the whole company, you're sharing a password, and it has to be changed when the developer leaves. [What to check when a vendor says its team uses one shared login](/guides/outsourcing-access/when-contractor-uses-shared-id) covers the questions to ask.

At the end, close each one in turn. The [checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end) gives the order.


## Frequently asked questions

**Should I share my WordPress admin login with a web developer?**

No. Give the developer a user of their own under Users, then Add User, and choose a role. When the work ends you delete that user, and your own login never changes.

**What WordPress role does a developer need?**

Installing, updating or editing plugins and themes takes the Administrator role on a single site. Someone who only writes and publishes content can work as an Editor.

**What can an Editor not do in WordPress?**

The Editor role covers content. That means writing, editing and publishing posts and pages across the site, whoever wrote them, and moderating comments. It leaves out installing plugins or themes, changing site settings, and managing users.

**What happens to a developer's posts when I delete their user?**

You get a choice at the delete step, provided the user owns content. You can delete it all along with the user, or attribute it to another user you choose. Pick the second if the person created pages you want to keep.

**Does removing the WordPress user remove their hosting access?**

No. WordPress roles control what a person can do inside the site. A hosting account, file transfer login or domain registrar login is separate and has to be closed where it was given.

## Sources

- [WordPress.org Documentation: Roles and Capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)
- [WordPress.org Documentation: Users Add New Screen](https://wordpress.org/documentation/article/users-add-new-screen/)
- [WordPress.org Documentation: Users Screen](https://wordpress.org/documentation/article/users-screen/)
- [WordPress core 7.1.4: wp-admin/user-new.php (the Add User screen and its help text)](https://github.com/WordPress/wordpress-develop/blob/7.1.4/src/wp-admin/user-new.php)
- [WordPress core 7.1.4: wp-admin/users.php (the Users and Delete Users screens)](https://github.com/WordPress/wordpress-develop/blob/7.1.4/src/wp-admin/users.php)
- [WordPress core 7.1.4: wp-includes/pluggable.php (the email sent to a new user)](https://github.com/WordPress/wordpress-develop/blob/7.1.4/src/wp-includes/pluggable.php)
- [WordPress core 6.8: wp-admin/user-new.php (the Add User labels)](https://github.com/WordPress/wordpress-develop/blob/6.8/src/wp-admin/user-new.php)
- [WordPress core 6.7.11: wp-admin/user-new.php (the Add New User labels)](https://github.com/WordPress/wordpress-develop/blob/6.7.11/src/wp-admin/user-new.php)
- [WordPress.com Support: User roles in WordPress](https://wordpress.com/support/invite-people/user-roles/)

## How Junify handles this

**Doing this by hand** You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.

**With Junify** WordPress gives each person a user, so do that inside the site. Junify is for logins around the site where the service gives you only one, as can happen with a hosting account or a domain registrar. Your admin adds that login to Junify. The developer verifies on their own phone and signs in without seeing the password, and each use is recorded by person. When the project ends, your admin removes the developer, and the password stays the same.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=bpo&from=guide&cluster=outsourcing-access&slug=wordpress-developer-agency-access)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Giving an outside developer access to App Store Connect and Google Play Console](/guides/outsourcing-access/app-store-connect-google-play-developer-access): Invite the developer by their own email with a limited role. Keep the Apple Account Holder and the Play Console owner inside your company.
- [Giving an accountant or bookkeeper access to QuickBooks Online without sharing your login](/guides/outsourcing-access/quickbooks-online-accountant-bookkeeper-access): Invite an outside accounting firm from the Accountants tab, or add a bookkeeper as a user with a role. Keep the primary admin role with the business owner.
- [Checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end): Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.