My client keeps changing password and denying me access before the project is fully complete. How do I politely ask him not to do so?

Question

I have a nice but emotionally vulnerable client. I work towards developing his websites and his client's websites, and other kinds of project like graphic design, photo editing, etc.

When it comes to website development, I install the CMS and create a username and password for admin access, or back-end access. Then, the client requests the admin credentials, which I forward to him.

On several instances before, and now too, the client keeps changing his website back-end's password, denying me access to the back-end even before the project is completed and financially paid in full. This creates problem for me because I no longer have full admin access (for example, in WordPress CMS). Then what he does is, he takes over the whole CMS and sends me an invite to sign up for the website. This gets frustrating for me and creates more problem for me at work. I had told him before on several occasions that "please do not change password of back-end until the project is fully complete". But he tends to take everything personally and gets agitated when I tell him to do something he does not want to do. Over that, he takes over the whole back-end admin panel and starts playing with the website code and contents, sometimes complicating things further or messing up the website.

Now this is getting frustrating for me, and I am not so good at handling other people's emotional burden, especially my client (I don't think that is my job either - to deal with their emotions). I am also not getting paid for fixing problems that arise because he keeps playing with the code and contents of the website and messing them up. So, I just want to politely but firmly tell him not to change back-end user credentials and passwords until the project is fully completed and fully paid.

How do I deal with the client and tell him this? And how can I protect myself in the future if he damages the website before the project is complete (because he takes over the whole back-end admin panel and starts playing with the website code and contents)? That is also another concern that I have.

Please help.

Answer 1

a nice but emotionally vulnerable client

Although you say that, the rest of your question and comments make him sound like the customer from Hell. I suggest that you ask yourself whether you need him as a client, and whether he is worth the energy he is costing you. If not I'd cut him loose.

If you feel that you need to keep going with this guy, i.e. you really need to money, I suggest you follow your own advice for this project.

From now on, I will create a super user account for myself and give him limited access until the project is complete.

For future work, I suggest that your draft your contract very carefully, making it clear

1. What the deliverables are;
2. What constitutes the evidence that the deliverable is complete;
3. What payment is due (include margin for dealing with client);
4. What the handover procedure is (e.g client can put his grubby fingerprints on once payment is made).

And, for your own sake, try to find clients who aren't pathological.

@Siva I worked for a successful multi-disciplinary engineering practice, which had invested a lot of time in proposal templates to cover contingencies. Out agreement contained a clause that made it clear that all the IP that we developed remained ours until all invoices were paid in full. That came in handy on at least one occasion. (Of course we had an NDA for their IP).

We developed on our platform, and handed them snapshots at agreed times.

We also had standard payment terms: typically the client would pay an upfront invoice, and we would invoice for work in progress so we never lost money if the client failed to pay. Project Leaders were empowered to stop a project until work had been paid for (as a last resort).

Answer 2

I always create a Super User account only for me, then other accounts (SU or lower) for other people. So, if we are two SU, I have my access and the other users can do whatever they want with their account and password.

If necessary, I limit other user's permissions so they don't mess up my work and my code.

Also in this way you separate users interactions with the CMS, i.e. you can see in the logs who did what.

I don't think you should explain anything to him, just act this way and tell him that this is the best practice to work on a project.

Answer 3

This is a client who wants to take over. Knowing that anything you do will be changed means that you are not in charge of the project once you have handed over control. What that means is that the project has to be structured in small pieces AND that you get paid in full for any piece that is done before handing over any master passwords. You do not "own" the project, the client does.

A "nice" client is one that pays you to fix up the mess they have made.

Accepting that this is how the client operates means that you don't have to worry about how the project looks, behaves, or functions. Simply do the changes requested, get paid, then hand over control.

Answer 4

You won't like my answer.

The reality is that when politeness, logic and reason ends (and it seems that have already happened in your case), you're down to more decisive means of exerting pressure. And these, in your position, should be the points written down in the contract you signed with the customer.

I learned it the hard way; I wrote my first freelance project before I even hit 18. I was in the secondary school and wrote an application for a pizza restaurant owner. I had virtually no contract at the moment of writing; we agreed on the scope of the task and I assured him that I will fix any errors that will surface after finishing the implementation.

And when I finally did finish the implementation, suddenly I started getting reports that "there is an error: lack of a button which does this and that". Luckily, that project finally ended and I got paid.

Before you start cooperation with any customer, prepare a contract, which states:

• A very precise, easily verifiable definition of "done"
• Tools, which will be used (yours or customer's)
• Any additional obligations (such as purchase of additional libraries or tools)
• Any specific restrains placed on you and the customer (this is where you can state that customer is not allowed to do any modifications to unfinished product)
• The way you will get paid (for instance a part of payment for every finished part of the project - and don't move your finger until you get paid). This will at least allow you to minimize losses if customer quits in the middle
• Easily verifiable conditions for paying fines by both sides in case of breaching of contract (e.g. finishing project after the deadline or interfering with the development process)
• Any additional security measures against customer's possible wrongdoings.

If a customer refuses to sign a well written and honest (just to both sides) contract, it is a clear sign that you really don't want to do any work for such a person.

Having such contract in hand, you can exert pressure on the customer by warning that breach of contract has certain consequences. If customer decides to breach the contract, you can always open a case in the court. The latter is obviously an extremity you probably want to avoid, but is still an option. Civil contract has legal force and you can seek fulfilling points of the contract through a lawsuit. It depends though on the country you live in and its laws; for instance in Poland the losing party has to pay 100% of lawsuit costs (including even payment for the lawyer who was representing you), so if you have solid grounds for the lawsuit, the risk is minimal.

If you don't have such a contract right now, you can still exert pressure on the customer, but you need to weigh the risks. You risk that customer will cancel the contract and you won't get paid, but the customer risks that you won't do the job for them and that also might cause unpleasant consequences.

In your case I would probably create a separate super-user account, do not give the customer credentials to it and calmly explain that any changes made to the final website causes delays and unless you are paid for those delays, you can not allow for them to being made.

There's a technique for working with unreasonable people called "a broken record". Every time customer uses different arguments, you say calmly: "I understand that, but unless we renegotiate our contract to take into account all the changes being done by any 3rd parties, I can not agree to giving you credentials for superuser account until I finish my job". And then calmly repeat the same thing for every single argument that will be thrown at you.

Answer 5

It may be too late to help with this specific client, but in general my recommendation would be to do all of your design and development work on a development platform that you control and only you can access, and then push that work to the client's own environment according to a schedule which you arrange.

Your development environment could be hosted on a service of your choice or could be run locally via docker containers or even just a virtual machine on your own computer. Because it's your private environment which the client doesn't pay for, he cannot demand access to it.

In the case of Wordpress, copying a site can be a bit clunky, but there are plugins and services which can make the process easier. Include the cost of these in your project budget.

Explain to the client that while he can make changes to his copy of the site, those changes will be overwritten when you publish the next round of updates, so he should avoid making significant permanent changes until the project is finished.

Give the client advance notice of when you will be publishing the next round of changes, and warn him each time that this will overwrite any changes he has made. If the client refuses to let you overwrite his changes with your work, then you can ask him to provide confirmation in writing that he doesn't want you to complete the project.

If there are changes he wants you to incorporate, you can have him provide those changes to you, and you can incorporate them in your development environment. You can even arrange a meeting before each push where you review his changes and work with him to incorporate them into your copy. This is billable time, of course.

The client can be shown progress in your development environment either by giving him front-end only access or by screen sharing, but he cannot have back end access because it doesn't belong to him.

Answer 6

By copyright law, websites belong to the website developer, not the client, so I build them on my own hosted server (or I set up their own with their credit card but not tell them where it is or is hosted). I do not allow access to any client and set up the login urls with secret wording.

I take sites down, if they choose not to pay or stop paying a monthly maintenance fee or the initial build fee. I call that line item:

"Design Fee, the overall looks and layout of the website. This design is copyrighted by our company and is a recurring fee for as long as our designs are being utilized by _____. If payment is stopped, you will have to hire another developer to create a brand-new site, and the present site will be taken down within 90 days of non-payment. This is a commonsense reasoning that no person likes their own work that continues to have value to be taken over and paid to a competitor or not paid at all."

And my second line of contract/estimate is about the monthly maintenance fee and then a per page charge, etc. And I always charge sales tax, since I do not sell websites, so it really is more like renting them most likely if ever audited by the state. (which I actually was and do not have to charge sales tax but the state at that point doesn't realize that retain ownership myself even if files are sent out of state onto other servers I rent from - I take no chances since I owed them $10,000 in back taxes and won the case, but it was scary and clients don't mind paying the tax.)

So anyway, that has been my business model for the past 16 years and I've never not gotten the contracts. Also, if they question it, just explain that clients do not normally know what they are doing and can make unbelievable messes, and it is in their best interest at my low fees to take advantage of the maintenance fee which allows them to ask for changes here and there for up to one hour of work per month.

By the way, since you are building websites for his clients, the temporary server idea is best until you can turn it over to them. They'll come back to you for a fee to fix things, I'm sure.

Also, I never have to write a contract or hire a lawyer as suggested. It's all in the estimate and invoice. Paying anything on it, is the contract being accepted.

Answer 7

I feel like most of the rest of the answers are a little more surreptitious than what ever worked for me. Creating superuser accounts and forcefully changing passwords can be surprising for clients, and surprises often lead to getting fired.

In this case it may be due to incompetence, but I've worked with clients who have processes to automatically change passwords due to regulatory compliance or just plain good security practices.

Make this part of your change process.

I assume you already have a contract, so work to amend it if necessary. Also make sure that there's a good general disclaimer in your future contracts. You want something like, "usual access."

That could and should cover a whole array of other situations that you're not thinking about right now, like what if they don't pay their Internet bill or if they decide to firewall you.

Once this is done, the next time that the client changes the password, inform them that it causes additional work on your part and that it's covered in this usual access clause.

The next time it happens, manage it as a straight-up change request. It should be the same as if they asked you to change the website colors or use a new layout. You do already have a set process for managing changes, right?

The crux: they are causing you additional effort due to their actions. You are paid for your effort. Therefore, make it clear that this causes more effort and therefore more cost for them. It sounds like you're taking it personally, when really it's just a business matter.

Be prepared for them to continue to do this and pay your change cost. That's their choice to make.

Answer 8

My advise is to send him a letter by email (with email acknowledge receipt ) as below Subject: Important: Admin Access for Website Development Dear Valuable Client, I hope you’re doing well. I wanted to send you an important update regarding the website project and the admin access. Please read the message below and confirm receipt at your earliest convenience.

As we continue developing your website, I would like to kindly request that the admin credentials remain unchanged until the project is fully completed and payment has been processed. This will ensure that I have full access to finalize the website and address any necessary adjustments or issues.

Making changes to the back-end during development can result in delays and unexpected issues that might impact the website’s functionality. I’m dedicated to providing you with a high-quality final product, and keeping the access consistent will help us avoid any complications.

Once the project is fully completed and ready for launch, I will happily hand over full control of the admin panel. At that point, you’ll be able to manage the site as needed. In the meantime, I am happy to discuss any updates or changes you would like to make — I’m here to collaborate and ensure everything meets your expectations.

Please confirm receipt of this email and let me know if you have any questions or concerns. I appreciate your understanding and cooperation in this matter, and I look forward to bringing your vision to life.

Best regards,

Answer 9

Handling this situation requires a balance of professionalism and firmness, as well as some preventive measures to protect your work and avoid potential misunderstandings. Here are a few steps that could help:

1.  Set Clear Expectations in Writing: Draft a polite, straightforward email or message, perhaps saying something like:
“For the smooth completion of your project and to ensure everything is finalized as we discussed, it’s essential for me to retain back-end access until all development and design work is completed and fully paid. Changing the password before then can lead to issues that may delay the project or require extra work to fix. I would greatly appreciate your cooperation on this.”
2.  Include Terms in Contracts: If you don’t already have a contract, consider creating one for future projects, outlining a clause about administrative access and payment terms. You could add a clause stating that until the project is completed and payment is made, back-end access should remain unchanged, or an hourly rate will apply for fixing any issues caused by unauthorized changes.
3.  Use Temporary Accounts: When setting up CMS access, consider creating a temporary account with restricted permissions for the client’s review purposes, reserving full admin access for yourself. This way, they can see progress but can’t make changes that might disrupt your work.
4.  Implement Regular Check-Ins: For emotionally sensitive clients, having scheduled updates can reassure them about progress and possibly reduce their need to access the back-end preemptively.
5.  Document All Changes: If he does access the back-end and makes changes that cause issues, document these instances clearly. This provides a record in case there’s a need for clarification on what caused delays or additional work.
6.  Prepare a Polite Boundary Statement: In case he becomes emotional, you could respond with something neutral, like:
“I want this to be a positive experience for you and deliver a project you’re happy with. For that, keeping the back-end access unchanged is key. I’ll gladly provide full access upon completion and payment to ensure everything works smoothly.”

By addressing the issue directly but kindly and having safeguards in place, you can both protect your work and set a precedent for future projects.

Answer 10

Independent website designers and developers need to ensure they have a legally binding contract. Get yourself an attorney and an accountant. Make sure you write up unique contracts for every job. Do not accept the clients blanket contract. If you are on a call with the client and they have a lawyer on the call; you then reschedule the meeting so your attorney can be on the meeting to represent your interests.

One alternative is to setup a cloud instance during development. Do not give the client the backend admin passwords until you are done with the project. Specify this in the contract. Relinquish the passwords when the project is complete and the site has been moved to a production server.

A contract ensures you will be paid for the work performed even if the client cancels the project or eliminates the entire department using your software or if they go out of business suddenly. The contract can be used to enforce payment via legally binding agreements.

There is a video on YouTube which covers all this and the room was full of independent contract workers in your field. It's worth a listen as it's excellent advice.

Don't be afraid to fire problematic clients. It's not worth the headaches and frustration.