WordPress plugin

FixGuru Access

How our team gets into your WordPress site for one job without you handing anyone a password, and how that access ends. The people who sign in are our own US-based team, bound by our confidentiality, never a contractor or a marketplace, and every sign-in is logged on your job page.

Why a plugin

Most website repairs start with the owner emailing an admin login to a stranger. That habit is how sites get hacked, and it leaves no record of what the fixer did. The plugin replaces it with one temporary account, a backup taken first, and a log of every change, all of which stay on your site under your control. It is the safest option, and it is optional: you can share a login instead, and the trade-offs are at the bottom of this page.

What happens when you connect

You install the plugin, open Tools, then FixGuru Access, and paste the connect code from your job page. The code ties the plugin to that one job and no other.
The plugin creates one administrator account with a random password that nobody is shown. It is set to expire in 72 hours.
Before anything else, it backs up your database (compressed) and your plugins, themes and mu-plugins (zipped). Uploads are left out to keep it small. The backup lives in a randomly named folder under wp-content/uploads/fixguru-access, protected from the web, and you can download or delete it from the same screen.
It tells fixguru.com it connected. We call your site back to confirm the address is real before the item on your job page turns green.
When one of our engineers needs to work, our system asks the plugin for a sign-in link. Each link works once and expires in ten minutes. The sign-in is written to your log and to your job page with the address it came from.
While we work, every plugin, theme, user, setting and file change is listed under Tools, FixGuru Access, so you can see exactly what was done.

What it does, and what it never does

What it does

Creates one temporary administrator with a random password nobody sees. It deletes itself after 72 hours, or the moment you click Remove access.
Backs up your database and your plugins, themes and mu-plugins before anything changes. The backup stays on your site, in a protected folder you can download or delete.
Logs every plugin, theme, user, setting and file change, and every sign-in with the address it came from, on your own Tools, FixGuru Access screen.
Lets our team in through single-use sign-in links that expire after ten minutes. Each one is written to the log and to your job page.
Talks to fixguru.com twice: once when you connect, once when access ends.

What it never does

Shows anyone your password, or stores one. The only secret it keeps is a hash.
Sends your database, files or backups to us. Backups never leave your site.
Keeps access after the job. The temporary administrator is gone before the job closes.
Collects anything about your visitors or customers.
Stays against your wishes. Deactivating or uninstalling it removes the temporary administrator on the spot.

What it sends to fixguru.com

Two calls, and nothing else leaves your site.

When you connect: your site address, your WordPress version, the plugin version, the temporary account's user name and expiry time, and a shared secret the plugin generates. Your site keeps only a hash of that secret, so a copy of your database cannot be used to call your site as us.
When access ends: a short notice saying why (removed by you, expired, deactivated or uninstalled), signed with that hash, so your job page shows the exact time.

Requests from us to your site (status, the change log, a sign-in link, remove access) carry the secret and are refused without it. Backups never leave your site.

How it ends

When your job closes we remove our own access first: the plugin deletes the temporary administrator and reports it. You can end it earlier at any moment by clicking Remove access now on the plugin screen, or by deactivating or uninstalling the plugin. The change log and the backups stay on your site for you; uninstalling deletes the backups, so download them first if you want to keep them. The 72-hour expiry is a backstop in case everything else fails.

Prefer not to install a plugin?

You can share a login in the encrypted vault on your job page instead. Three things change: there is no automatic backup, no change log on your site, and no account that deletes itself. We take a backup by hand before we change anything and list every change in your report. The login is encrypted the moment it arrives, every time our team opens it is shown on your job page with the time and address, and it is destroyed 72 hours after the job closes.

If you go this way, create a temporary administrator just for the job rather than sharing your own login. Your job page shows where to click, and when the job closes it shows you where to delete that user again.

Get the plugin

Download fixguru-access.zip (version 1.0.0, GPL). Every line of it is readable in the ZIP. The connect code appears on your job page once your card is held, and the plugin does nothing until you enter one.