I need to hire a dev to do some work on my site, however as it is a very large one and valueable at the same time, i don't want to risk a dev stealing the work and mechanisms behind it.

I will need to grant him cPanel access however would prefer if they're not able to download any files.

What is the best way to prevent someone stealing my site, whilst giving cPanel access, or possibly the best way to limit the access for them?

  • 1
    Once they have cPanel access; they have full access. Why do they need cPanel access? Do they need access to all the files on the site or just part of it? The dev will need to download any files they are working on and probably need to at least download that "part" of the site. You can't realistically work on a live site, one file at a time, unless it's a very basic edit.
    – MrWhite
    Aug 4 '15 at 0:51

What you could do is use the WHM interface to create a new cpanel account and associate a new domain name with it. That would require you to order a domain name from a registrar and associate the IP address of your server with it along with about 24-48 hours for the domain name to work.

Then you can give your dev full access to FTP for that domain while you have your website running on the domain you already have it running on. That will prevent him from stealing scripts that produce the pages, however nothing will stop people from stealing source code and images that web browsers have successfully downloaded.

Another alternative is to email your dev pictures and/or a video of how your website should look and how things should operate in great detail without providing any source code and let him construct the site based on that.

  • I would suggest that a sub-domain would be cheaper and temporary. Either way, make sure that the site is not generally accessible via the Internet or it will get out into the wild. A web based login would suffice for this.
    – closetnoc
    Aug 3 '15 at 23:16
  • I was thinking of the second option with a seperate test domain/ftp access, however what scripts will this prevent from being edited? i can see how it would prevent access to php my admin etc. Aug 4 '15 at 9:47
  • 1
    If you just give him (aka the dev) his own web space and email your requirements to him then he begins with an empty folder in which he can upload his work. He can't modify your work unless you give him credentials to access your work. This means don't give him the credentials for FTP access to your site the scripts are on. Then he can't modify them. Aug 4 '15 at 20:28
  • 1
    The situation is a bit different because he will need to make amendments to wordpress etc. However off topic question: Is there anyway to see if one has downloaded a file on cpanel/ftp through some logs? If so which logs is it because there are so many! Aug 5 '15 at 23:58
  • 1
    You could ask your host, but otherwise the log files would really only deal with logging web access. In the end to give a dev access to your work requires a level of trust: if you don't trust a particular dev, you might need to find one you can trust.
    – Tim Malone
    Apr 30 '16 at 6:55

Giving cPanel access is as good as complete control over the source code.

I have been working on large scale project where more than 1000 coders involved. So, everyone will have access to their own piece of code (or their own module)

Similar way, You can create a FTP user, giving access only to the specific folder where he has work to do. For example, If work to be done is on Admin section, then give access only to admin folder for the newly created ftp user.


Hard to let a dev do their job without allowing access to all source code.

As others have said, cPanel access is the key to all info. Ok, well almost all but either way: Contract, contract, contract! Have them sign an NDA before the get go! Stiff penalties for breach of contract and NDA should be included in both documents. Have a notary public witness and stamp both documents. Can be done at your local bank.

Make sure they are within and will be staying within the realms of prosecution for your locale incase things go sour.

Find someone with outstanding ethics and someone you trust. cPanel access is almost absolute in ability to view all info. If you do not want your site secrets shown, don't hire a contract worker, make them an employee. Keep the law on your side and protect your investment!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.