You hire a developer for a specific job, or bring someone onto the team who only needs to upload files to one particular folder. The quick fix (handing over the hosting account's main password) is also the riskiest, and almost always unnecessary: there is a way to give scoped access to exactly what that person needs, without exposing the rest of the account.
Why sharing the main account is a bad idea
The hosting account's main login reaches everything: every site if several domains share the account, every database, every mailbox, security settings, backups. Handing that full key to someone who only needs to upload files to one folder exposes far more than the task requires.
And it is not just a theoretical risk. If that person uses a weak password on their own computer, if their machine gets infected, or if the working relationship simply ends badly, the exposure is not "access to one folder": it is access to the whole account. The security principle behind this is simple and well known: everyone should have access only to what they need to do their job, not a bit more.
The alternative: a scoped FTP account
Most hosting panels let you create additional access accounts, independent of the main one, with their own username and password, and with access limited to a specific folder instead of the full account. Whoever connects with those credentials sees only that folder and what is inside it; they cannot navigate up or see the rest of the account's files.
It is the exact tool for this problem: it gives the other person everything they need to do their job, and nothing more.
How it is created, in general terms
From the panel's FTP access section, a new account is created by specifying a username, a password, and the folder it will have access to. Most panels let you choose any folder inside the account, not just the root, so access can be scoped to a very specific project folder that person will be working in.
Once created, those credentials (username, password and the server address) are shared with the person who will use them, instead of sharing the main account's credentials.
Good practices when creating these accounts
One account per person, never one shared among several. If more than one person needs access, give each their own account. That way, if something goes wrong, it can be traced back and that person's access revoked without affecting the rest of the team.
Generated passwords, not reused ones. Each account with its own strong password, not one recycled from another service.
Revoke access as soon as the need ends. If the work was a one-off, delete that access account once it is done, instead of leaving it active "just in case" indefinitely. A forgotten access account, sitting active for years with nobody remembering it, is exactly the kind of gap nobody can later explain.
Review which access accounts exist periodically. Over time, leftover access from old projects nobody uses piles up. A review every so often (what accounts exist, what they were created for, whether they are still needed) prevents open doors from accumulating unnoticed.
When broader access genuinely makes sense
There are situations where scoped access is not enough: someone administering the entire site on an ongoing basis, for instance, may need access to the control panel in general, not just one folder over FTP. In those cases, many panels let you create an administrator-level access with broad permissions that is still a separate account from the main one, which allows revoking it independently if needed, without having to change the password of the account that administers everything else.
The general rule stays the same regardless of the level of access needed: each person gets their own account, scoped to what they genuinely need, and easy to revoke without affecting the rest of the infrastructure.
A short checklist before sharing any access
Before sending credentials to anyone outside the project, three simple questions prevent most problems: does this person need to see more than one folder? If not, do not give it to them. Is this a one-off job or something ongoing? If it is one-off, note somewhere when to check whether it can be deleted. Does an old account already exist for someone no longer on the project? If the answer is yes, that is the moment to delete it, not whenever someone happens to remember.
Those three questions take less than a minute and prevent a good share of the forgotten access accounts nobody can later explain when they turn up in a security audit.
Write them down as an actual step in your project handoff process, not just something to keep in mind. A checklist that exists only in memory is the first thing skipped the day everyone is in a hurry to get a project out the door.
It costs nothing to build this into whatever process already marks a project as finished, and it turns a good intention into something that actually happens every single time, regardless of how busy that particular week is or who ends up handling that specific handoff.
Over a year of projects, that small habit adds up to a noticeably shorter list of stray accounts than the alternative of hoping someone remembers eventually.