How do I safeguard my website when working with a freelancer?

[3588a2af]

We are trying to figure out how to safeguard the integrity and security of our website when hiring a freelancer on Upwork. Are there ways to ensure that information isn't stolen, malware isn't installed, or damage isn't done to code? We don't have in-house expertise for spotting these things. We are using wordpress.

[prestonhunter]

Nate:
There are many ways to ensure the security of your website while working with freelancers. But keep in mind that this is your responsibility. Although Upwork has rules in place that state that freelancers must respect your intellectual property, Upwork does not guarantee the work done by freelancers.

One of the main ways that you will safeguard your website is to use a development server, and have the freelancers on your team do their work there. This is NOT the server that your customers use. That is the "production server" or the "live" server.

The various freelancers on your team have access to make their changes on the development server. Then the lead developer or project manager pushes those changes to the live server.

Also: You will establish an archvive of all source code and database data which is generated automatically. This archive is one that only you have access to. If anything goes wrong, you are able to restore the live site from the archive.

These and many other things that you can do are beyond the scope of this post to discuss in detail. Upwork doesn't provide these services automatically, of course. These things are your responsibility as a project owner. You may hire experts on Upwork - or elsewhere - to help you establish such safeguards.

[3588a2af]

Thank you, Preston. I really appreciate that advice. I'm wondering how I would post a job on Upwork for an expert to help with the safeguarding aspect. Would that need to be an ongoing project? 

Thanks again, 

Nate

[prestonhunter · Accepted solution]

re: "I'm wondering how I would post a job on Upwork for an expert to help with the safeguarding aspect. Would that need to be an ongoing project?"

This is probably NOT something you need on an ongoing basis.

I recommend that you post a job posting saying that you want to hire somebody to provide short-time consultation. State that you will only be TALKING with the freelancer you hire, to get ideas. You could hire three or four different consultants using hourly contracts and simply talk to them for about 30 minutes each.

After you do that, you will have ideas about what you want to do in order to safeguard your website. You may end up hiring one or more of these consultants to do hands-on work, or you may simply use their ideas and implement safeguards yourself, or you might hire somebody else to do so.

I think the MOST important things are to make sure YOU control your domain name and to make sure you have backups of your data and source code in a place that you control.

These principles are useful for many purposes: If there is a hardware failure, or if there are inadvertent mistakes, you will want these things in place. It's not just to guard against the (unlikely) scenario in which a hired freelancer intentionally causes mischief.

[3588a2af]

Again, this was very thorough and helpful, Preston. I do very much appreciate it.