Contractor wants access to ftp and admin question

I have hired a contractor to do some tweaks and adjustments to my site.
The contractor is asking for my ftp and admin info.
Says he needs access and also access to mysql.

I feel like I would be giving a stranger the keys to my house or bank account.

So how do you hire a contractor to work on your site, with out giving them access?

Thanks for any help.

You should be able to setup a FTP account limited to certain areas
mysql is another story...

You should also have a "copy" of your site like in a folder where this work can be tested and not on your live store

I've owned and worked on the site for two years. I've done all the work myself.
I have learned so much, and am grateful.
But I need some help that is beyond my experience.

I've always worked on a live site.
I have never figured out how to set up a test site.
How would I set up a test site? If I did set up a test site and then let him work on it, that does seem more secure.

How would I set up a test site?
Very similar in steps to upgrading
http://www.zen-cart.com/content.php?148-how-do-i-upgrade-my-zen-cart-site
If I did set up a test site and then let him work on it, that does seem more secure.
Mostly, does not affect your live site with possible errors
Once it is complete - test test test - before making changes to your live site

dustbowl:

I have hired a contractor to do some tweaks and adjustments to my site.
The contractor is asking for my ftp and admin info.
Says he needs access and also access to mysql.

I feel like I would be giving a stranger the keys to my house or bank account.

So how do you hire a contractor to work on your site, with out giving them access?

Thanks for any help.
You setup a TEST/DEV site and give them access to THAT.. You should not be doing this work on your live site anyway, and the contractor should know this too.. If I work on someone's site I set up a test/dev store for the work so their live store is left stable while I work on the test/dev site..

I always use a test/dev site that is a completely separate url to my live site.
So there is absolutely no possible way for anything to be connected to my live site.
I always change the admin directory name
Delete all the admin passwords from the database and setup new temporary passwords
make sure cpanel, ftp and other access passwords are unique to the dev site.

As well if you copied it from your live site
Delete all customer and sale info
Remove and delete critical info from payment modules.

Once they are finished I go thru the code to see whats altered (looking for backdoors etc)
When I am happy I copy the mods to my live site myself.
and delete and change all access passwords to the dev site.

gilby:

**Once they are finished I go thru the code to see whats altered (looking for backdoors etc)
When I am happy I copy the mods to my live site myself.
**and delete and change all access passwords to the dev site.

This part is important.. I do MY OWN installs on the live site..

I know everybody says not work on a live site, but I have been doing it on my own site for 2 years. I really did not have a choice until now.
I only crashed it once. But I have weekly back ups of it from day one, so I fixed it myself.
I've enjoyed working on my site and the info I have learned is invaluable.

Thanks SO MUCH for everybody's help.
There is no way of measuring what potential heart ache and money you all have just saved me from.
I will begin setting up a test site and following and doing what was mentioned.

dustbowl:

I know everybody says not work on a live site, but I have been doing it on my own site for 2 years. I really did not have a choice until now.
I only crashed it once. But I have weekly back ups of it from day one, so I fixed it myself.
and you have been lucky if this is the case.. You ALWAYS had a choice to setup a test site..:smile: You can use your site backups to make short order of the work.. I suggest that you setup a sub-domain and point your new sub-domain to the folder you will be putting your dev/test site in..

Also worth considering:
If the work you're asking them to do could actually be done on ANY installation of Zen Cart, then let them install their own site, do their development there on their own server, and then simply email you a zipped up copy of the files that they created or edited.

Then before you install them, inspect them for safety and security, and test them on a test copy of your site.
Also worth looking them over and seeing whether they should have put their changed files into an override folder, and if they didn't do that, you can do that part yourself by simply putting them in the correct override folder when you move the files to your test site and later to your live site.

That puts YOU always in control of what happens to YOUR site.

Another thing to (re)consider is the entire 'trust' issue itself.

I consider it it bit like this. If I don't trust a developer enough to provide them with sufficient access to the 'live store' (so they can complete the 'whatever'), I probably wouldn't trust them enough to perform the 'whatever' in the 1st place.

Conversely, as a developer, if the client doesn't have enough trust in me to provide the level of access I need to complete the task asked of me, I really don't want anything to do with the task in the 1st place. Its just trouble waiting to happen. This situation will never end well.

It is a two way street. The trust has to go both ways.

It is unrealistic to expect clients to have the knowledge and know how in regards to setting up special FTP accounts, etc for developers use, even if it is good and recommended practice. Likewise, it is also unrealistic to expect these clients to spot any nefarious code introduced during development, and although the idea of doing all development 'off site' and having the client upload the final product to their own site seems simple, even this is a bit much for many (for various different reasons).

I'm not in any way suggesting that merchants shouldn't takes steps to prevent their trust from being abused by an unscrupulous developer, but what I am trying to suggest is that not all developers are unscrupulous. They'll be in the minority, I'm sure (the main thing being is that we only ever hear the 'horror' stories, which gives a biased perception).

In my opinion, the biggest concern about hiring a developer isn't so much a trust issue, but more of a competency issue. Unless examples of previous work can be demonstrated, this is a hard call to make.

Just a little more food for thought.

Cheers
Rod

I enjoyed reading everyone's recommendation and that make sense. The part that is hard for me is the inspection part!

Since I am not as skilled developer as you guys, how can I inspect the code for security and back door?

What if they don't tell me about a specific file or directly that they have altered?

Take a full backup of your site from just before they started work, and compare it to the finished product using something like Winmerge. Any files altered or added will show up in the comparison, and you can inspect each of them for line-by-line differences with original code. As for recognizing nefarious code, that is a more complex matter... but only to worry about if there is something that doesn't make sense to you in the new code.

Perfect. I can take care of new code and hope for the best. Thanks for prompt reply gjh42 :smile: