# Temporary WordPress access for a developer, with an end date

Give a developer or support person a WordPress role for one hour to 30 days, see what they did, and let the access end on its own, without a shared login.

By M Asif Rahman, Nov 1, 2026.

To give a developer or support person temporary WordPress access, add one role to their own account for a fixed time and let it be taken back when the time is up. **Temporary access** in BetterShield Ultra, the separate paid add-on, does exactly that: it adds one role for 1 hour to 30 days, then removes only that role and signs the account out.

Our guide to [WordPress user roles and least privilege](/blog/wordpress-user-roles-security/) explains which role fits which job. This post is about the other half of the problem, which is how long the access lasts, and how to make sure it does not quietly outlive the work.

## Quick summary

- **Temporary access** adds one WordPress role to an account for 1 hour, 4 hours, 1 day, 3 days, 1 week, 30 days or until a date and time you choose.
- When the time ends, Ultra removes only the added role and signs the account out.
- **What they did** shows the account’s activity since the grant began, and **End now** stops the access early.
- The person receives an email with the role, the end time and the normal sign-in address. It has no password and no sign-in link.
- Without Ultra, the free way is a normal account that you remove by hand when the work is done.

## Why a shared login is the wrong tool

A developer needs to fix a plugin for a day. The quick answer is to send them an administrator password. The trouble starts afterwards: the password is in someone’s chat history, nobody remembers who has it, and the access has no end date unless a person remembers to set one.

An account of their own, with a role chosen for the job and a date it stops working, solves the three things that go wrong. You know who did what, because the [activity log](/docs/activity-log/) records actions against a named account. You choose how much power the account has, in the spirit of [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege). And the access ends without anyone having to remember.

## What Temporary access does

Temporary access adds one role to an account for a fixed period. A few details are worth knowing before you use it:

- **It only adds.** A grant adds access. It cannot remove an existing role on a timer.
- **The role must be new to the account.** You choose a **Role** the account does not already have.
- **You cannot grant more than you hold.** You cannot grant a role to yourself, or grant permissions you do not have.
- **The end removes only the added role.** The account itself, and any role it had before, stay as they were.

On multisite, each site has its own grants, and a super administrator or an account that is not a member of the site cannot receive one.

## Set it up

You need BetterShield and the [BetterShield Ultra](/docs/bettershield-ultra/) add-on active. The developer needs an account on the site first, since the grant adds a role to an existing account.

1. Open **BetterShield › Ultra › Temporary access**.
2. Under **Who**, search by name, username or email address and choose the account.
3. Choose a **Role** the account does not already have.
4. Under **For how long**, choose **1 hour**, **4 hours**, **1 day**, **3 days**, **1 week**, **30 days** or **Until a date and time**.
5. Read the summary, then press the button beginning with **Grant**.

A custom **Ends** time must be between one hour and 30 days from now, using the site’s time zone.

| You want to | Choose |
|---|---|
| A quick fix this afternoon | **4 hours** |
| A one-day job | **1 day** |
| A small project with a known deadline | **1 week** or **Until a date and time** |
| An ongoing contractor, reviewed each month | **30 days**, then grant again |

The account receives an email naming the role, the end time, the person who granted it and the normal sign-in address. The email includes no password and no sign-in link, so the person signs in the way they normally would.

## While the access is live

The **Temporary access** card lists current grants. Each active grant shows the account, the role, who granted it, its end time and a countdown.

Two buttons matter most:

- **What they did** opens the account’s activity since the grant began.
- **End now** removes the added role and ends every session on the account.

We recommend opening **What they did** before you end a grant early, or at the end of the work, so you see the changes while the context is fresh.

## What it can break, and how to undo

The added role grants all the permissions WordPress assigns to it. [WordPress’s own list of roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) shows what each role can do, so choose the narrowest one that covers the work. Use **End now** if the access should stop early.

One safeguard is worth knowing. Ultra does not remove the role at expiry if doing so would leave the site without an administrator. In that case the card explains that the grant remains active.

If the person still needs access after the grant ends, grant it again.

## Check it is working

- **The card.** The active grant shows the account, role, who granted it, its end time and a countdown.
- **The activity log.** It records **Role granted** when you press **Grant** and **Role removed** when the time ends or you press **End now**. See [the activity log](/docs/activity-log/) for filters and export.
- **The account.** After the end time, the account no longer has the added role and cannot use it.

## The free way, and when it is enough

You do not need Ultra to give someone access. The free way is to create an account for them with the role the job needs, then remove the role or the account yourself when the work is done. It is a perfectly good method for one person and one job.

What you lose is the part that is easy to forget. Nothing ends the access for you, and nothing counts down. If you take the free route, put the end date in your calendar the day you create the account. When it comes, remove the account or lower its role, then use **Sign out all their sessions** in the free [sessions](/docs/sessions/) tools so any browser that is still signed in is signed out too. Our guide to [forcing everyone to sign out](/blog/wordpress-force-logout-all-users/) covers that step.

## When the engagement ends

Temporary access suits a short job. When an agency or a long engagement finishes, there is usually more to close than one role: application passwords, assistant connections and the accounts themselves. That is the job of **Handover**, also part of Ultra, which gathers the access an agency’s accounts still hold and lets you review each item before anything changes. It is covered, step by step, in [managing security across many sites](/blog/manage-security-multiple-wordpress-sites/) and in the [Handover doc](/docs/handover/).

## Recommended settings

- Use the shortest period that covers the work. A task that takes an afternoon gets **4 hours** or **1 day**, not **30 days**.
- Choose a role with only the permissions the job needs.
- Open **What they did** before ending a grant early.
- Prefer a named account with a grant to a shared password, every time.
- Run the grant from your own account, since you cannot grant a role to yourself.

## Frequently asked questions

### Do I need BetterShield Ultra for temporary access?

Yes. **Temporary access** is part of the paid BetterShield Ultra add-on. The free plugin still lets you create an account with a role and remove it yourself, but nothing ends it automatically.

### What happens when the time runs out?

Ultra removes only the role it added and signs the account out. The account and any role it already had are not touched.

### Can I end the access before the time is up?

Yes. Press **End now** on the **Temporary access** card. It removes the added role and ends every session on the account.

### Does the person get a password?

No. The email names the role, the end time, who granted it and the normal sign-in address. It has no password and no sign-in link.

### Can I give someone more access than I have?

No. You cannot grant permissions you do not hold, and you cannot grant a role to yourself.

## Conclusion

Temporary access replaces a shared login with an account that has a chosen role and an end date. You can see what the person did, stop the access early, and rely on the role being taken back when the time is up. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/), and BetterShield Ultra adds this feature; the full details are in the [Temporary access doc](/docs/temporary-access/).