Why does my web developer need my FTP login details?

Mac
1

My web developer is asking for my FTP credentials to work on my site, and I’m unsure if this is normal or safe. They said it’s required to fix some bugs and update files directly on the server, but I’m worried about security and possible misuse. When is it actually necessary to share FTP access, what precautions should I take, and are there safer alternatives like limited accounts or temporary access?

2

FTP feels scary the first time someone asks you for it, but once you’ve actually used it a couple of times, the whole thing makes a lot more sense.

Why people even bother with FTP instead of just using WordPress

WordPress gives you a nice, friendly dashboard. Click buttons, install plugins, edit posts, done. But all of that is built on top of actual files sitting on your server.

FTP is basically you saying:
“Skip the pretty interface. Let me into the engine room.”

With FTP, you connect straight to the files that make your site run. No detours through wp-admin, no waiting for some half-broken plugin to load the dashboard. You open your FTP app, log in, and you’re staring at the same folders your hosting account is serving to the world.

That’s why people who build or fix sites all day are obsessed with FTP. When you know what you’re doing, it’s just faster and more predictable.

Setting up WordPress with FTP vs without it

I didn’t really appreciate FTP until I set up WordPress a few different ways:

  • With FTP:

    • Upload WordPress files to the server
    • Create database
    • Run the installer
    • Done in minutes

  • Without FTP:

    • Rely on 1‑click installers or whatever your host gives you
    • Hope the auto installer doesn’t jam halfway
    • Fight with permission errors when you try to install themes or plugins
    • Pray the built‑in file editor doesn’t white screen your whole site

You can avoid FTP completely and still get a site running, but the second something doesn’t go 100% smoothly, you end up wishing you had it set up from the start.

Why your developer keeps asking for FTP credentials

When your dev says “I need FTP,” it’s not them being lazy or dramatic. It’s usually because something like this has happened:

  • A plugin update nuked the site and now you get a white screen instead of the dashboard.
  • A theme file got corrupted, and you can’t even log in to fix it.
  • An auto-update failed halfway and left WordPress in a weird half-broken state.
  • File permissions or old leftovers from previous installs are causing odd bugs.

The WordPress dashboard can only help if the dashboard actually loads and the underlying files are in decent shape. If the problem is the files, you need something that can reach them directly.

FTP gives your developer the ability to:

  • Replace or repair broken files
  • Manually delete plugins or themes that are causing fatal errors
  • Upload fresh copies of WordPress core files
  • Clean out leftover junk, old backups, half-installed themes, etc.
  • Switch themes or disable problem plugins by renaming folders
  • Take backups of your files before changing anything risky

All of that can be done even when wp-admin is totally dead. That’s why they keep insisting on FTP access: it’s the “break glass in case of fire” door.

Why this is safer, not riskier, when something goes wrong

It sounds more dangerous to give someone full file access, but in practice, when things are already broken, it’s often the safest way forward.

With FTP, they can:

  • Make a copy of important files before touching them
  • Undo changes just by re-uploading a previous version
  • Avoid relying on half-loaded scripts or buggy plugins
  • Fix issues without hammering the database or spamming the server with failed requests

Trying to fix severe problems only from inside the WordPress dashboard is like trying to fix a car engine from the driver’s seat without opening the hood. Sometimes it works. Sometimes you’re just turning the key and hoping the weird noise goes away.

Managing FTP yourself on a Mac without going insane

If you’re on macOS and want to manage your own FTP instead of emailing your details around and hoping for the best, it helps to have a file manager that doesn’t make the process painful.

One option that’s pretty easy to live with is Commander One:
https://apps.apple.com/us/app/commander-one-file-manager/id1035236694?mt=12

The reason this kind of tool is nice:

  • You see your Mac’s files on one side and your server’s files on the other.
  • Drag-and-drop uploads feel like moving stuff between folders in Finder.
  • Replacing a broken file is literally: drag new file in, confirm overwrite.
  • You can quickly peek inside folders like wp-content, plugins, themes, etc., without touching the WordPress dashboard at all.

If you’re even mildly comfortable with files and folders on your computer, using FTP with a side-by-side manager like that feels way less “hacker-y” than it sounds.

If you’re still on the fence

If this all sounds like overkill and you’re not ready to dive in yet:

  • You can run your site without ever touching FTP.
  • But when something critical breaks, the person fixing it is almost always going to ask for it.
  • Learning just the basics (connect, navigate, upload, rename, delete) can save you from total panic someday.

There are tons of short tutorials online that show you how to connect via FTP, what folders to look for, and what not to touch. Try it on a test site or a staging site first if you’re nervous.

Bottom line: FTP isn’t some fancy developer flex. It’s just the direct doorway to your site’s real files, and when things go sideways, that doorway is what gets you out of trouble fast.

4 Likes
3

Short version: yes, it’s normal. No, you shouldn’t hand over your main hosting login and hope for the best.

@​mikeappsreviewer already covered why devs like FTP, so I’ll skip repeating the “engine room” analogy. I’ll push a bit on the safety side, because that’s where most people get burned.

1. What your dev can actually do with FTP

With FTP/SFTP access they can, in practice:

  • Edit theme and plugin files directly
  • Upload/remove entire folders
  • Replace core WordPress files
  • View config files like wp-config.php (which can expose DB credentials)

So yes, it’s powerful, but that’s also why they’re asking. Fixing bugs that live in code or file permissions needs file-level access.

2. Do not just send your primary hosting login

This is where I somewhat disagree with the casual “FTP is no big deal” angle.

Better options:

  1. Create a separate FTP/SFTP user

    • In your hosting control panel, create a new FTP/SFTP account.
    • Limit it to the site’s root folder only (usually something like /public_html/ or /www/yourdomain.com).
    • Do not give them access to everything on your server if you host multiple sites.

  2. Use SFTP, not plain FTP, if possible

    • Plain FTP sends login + password in clear text.
    • SFTP or FTPS encrypts the connection.
    • Most decent hosts support SFTP now; check your host’s docs.

  3. Set an expiration plan

    • Tell the dev up front: “I’ll change this password once the work is done.”
    • Actually do it. Rotate or delete that FTP user when the project is finished.

3. Red flags vs green flags

You’re right to be nervous. Look out for:

Green flags:

  • They’re fine with a limited FTP account.
  • They explain roughly what they’ll be editing: “mostly theme files and maybe a custom plugin.”
  • They suggest backing up first.
  • They’re okay with you watching log files or keeping a backup of the site.

Red flags:

  • They insist on full cPanel / hosting root login “because it’s easier.”
  • They refuse to work with a scoped FTP/SFTP user.
  • They get weird if you mention backups or version control.
  • They won’t tell you what they’ll touch, beyond “just trust me.”

4. How to keep yourself in control

A few practical things you can do:

  • Backup before they start

    • Files and database. Either with your host’s backup tools or a plugin.
    • That way if they mess up, you or another dev can roll back.

  • Ask for a short change log

    • Nothing formal, just: “Tell me which files you changed so I know later.”
    • This helps a ton if you switch devs in the future.

  • Use a staging site if possible

    • Many hosts offer staging. Let them work there first, then copy to live.

5. If you want to “own” the FTP side

If you don’t want to keep emailing logins:

  • Install an FTP/SFTP client on your computer.
  • Commander One on macOS is actually pretty nice here: side-by-side view, local on one side, server on the other, drag-and-drop, works well as an SFTP client.
  • You can then:
    • Download a copy of your site before changes
    • Quickly peek at what’s on the server
    • Even do simple file replacement yourself when your dev sends you updated files

That way, the dev can send you files or paths, and you control when they go live.

6. So should you give them the details?

If:

  • You trust the developer (contract, references, or you’ve worked with them before)
  • You create a limited SFTP/FTP user
  • You backup first
  • You plan to remove or rotate that access after the job

Then yes, giving them FTP/SFTP credentials is normal and reasonably safe.

If any of that feels off or they push for unrestricted access with no explanation, your hesitation is justified and you might want to reconsider who’s touching your site.

4

Short version: yes, it’s normal for a dev to ask, and no, you shouldn’t just hand over the keys without thinking about how.

@​mikeappsreviewer and @​techchizkid already covered why FTP/SFTP is so useful technically, so I’ll push on some slightly different angles and disagree a bit on the “just learn FTP and you’re fine” vibe.

You do not need to become an FTP pro to stay safe. You just need control.

Think of three layers:

  1. Who can log in
  2. Where they land
  3. When they stop having access

Your dev wants file-level access to fix bugs. Totally normal. But that doesn’t mean:

  • You give them your main hosting login
  • You leave that account active forever
  • You let them roam outside your site’s folder

If your host supports it, the safest approach is:

  • Create a separate SFTP user locked to that site’s directory only
  • Tell the dev “this is temporary; I’ll remove it when we’re done”
  • Take a backup first (files + DB) using your host or a plugin
  • Ask them to tell you roughly which files they changed

One thing I slightly disagree with from the “FTP isn’t a big deal once you use it” take: it is a big deal if someone goes rogue or just makes sloppy mistakes. A single bad edit in functions.php and your site is toast until someone fixes it again. That’s not fear mongering, that’s just how PHP works.

If you want to keep tighter control without drowning in tech:

  • Install an FTP/SFTP client on your computer
  • Use it mainly to download a copy of your site and to peek at what’s there
  • If your dev is okay with it, they can send you updated files and you upload them

On macOS, Commander One is genuinely handy for this. Two-pane layout, your Mac on one side and the server on the other. For someone non-technical, it makes SFTP feel like dragging files between folders, not like “hacking the mainframe.”

Red flags that would make me say “nope”:

  • They demand your main hosting / cPanel login
  • They refuse to work with a limited SFTP account
  • They can’t explain in plain english what they plan to touch
  • They push back when you mention backups or staging

Green flags:

  • They’re fine with a limited user
  • They’re specific: “I’ll be editing theme files and maybe disabling a plugin causing errors”
  • They suggest or at least agree to a backup
  • They’re okay with you deleting/changing the password after

So yeah, what they’re asking for is normal. Your hesitation is also normal. Give them access, but on your terms: scoped account, backup first, and a clear end point where you change or kill that login.