Privacy > sharing access > FCRM and Cart
Just curious to know how you guys deal with sharing accesses to your sites with FCRM and FluentCart when support requires access (ninjas or any other Wordpress team).
For privacy, compliance and so, it’s not possible to share admin accesses “freely” or without taking this into account.
I’ve always missed some kind of password access or a specific setting for this.
Teamviewer. It allows a remote desktop situation through a one time code.
J V I’ve used it before but I see no relation with this topic taking into account its features.
A remote access to a site with personal data is still non-compliant , even you give temporary access.
I’m talking about giving admin access to your site or store for debugging without exposing personal data.
Jorge de los Reyes I get that but I don't believe you can do that, which is why I would want to be there. Also that way I would benefit from seeing the process and thus learn something for a possible next time.
It wouldn't be non-compliant as there should be no need to access any personal data. The remote session would be supervised, which frankly is the only way I would give any access to my site.
J V Yeah. I get that if you're on a live session, you can some kind of control what you share (which many risks though. Just a quick mistake changing tabs, and you're done).
but, if you have FCRM, or Cart on your site, and any support team accesses, that would be non-compliant with many compliance regulations.
So, that's why I was asking.
Usually, support, is non-live. At least, WordPress plugins support. That's why I was asking how you guys manage this.
What I see is that 99% of users share full admin access with support. Here, and with many other plugins. That's why I raised this.
Jorge de los Reyes Yes well not me. I am not sure what you mean with the risk of changing tab. I would only open what they may need, and I would be there live. Period!
I have done support (different systems, but still) and we used this tool most. You can also set it up with view only which means they can view but you handle the mouse and keyboard. That however makes everything slow and more annoying for the one trying to support you.
J V that works only for live, supervised debugging. Agreed.
The point is simpler: that’s not how most WordPress support actually happens.
Tickets are async. Access is unsupervised. And with FCRM / carts, admin = data exposure by default.
So the real gap isn’t how to watch support.
It’s the lack of role-based, data-restricted admin access for debugging.
Until WP/plugins solve that, most sites are compliant on paper… and exposed in practice.
Hey Jorge de los Reyes , I don't know if this would be officially compliant for your situation, but for giving beta testers limited access to my staging site admin, Advanced Access Manager was a perfect solution for me! Now I have a way to give developers and ninjas limited access to my site, in a very fine grained way, so zero access to especially sensitive things like FCart or anything else beyond what they need, and the free version did everything I needed for my case, but perhaps the paid version would do even more for compliance needs.
Jeff wow! Seems like a perfect fit. I guess, this allows to grant access choosing the available plugins on the admin?
Maybe that’s the solution: grant some kind of admin access but on a new role, 100% admin but with no acccess to specific plugins.
Would love to see a walkthrough of that: I’ll check that out :)
Thank you Jeff!
Jorge de los Reyes yes, create a new role or use a current one, and micro manage access from a few different angles. took me about 15 minutes to figure it out and test access levels with my test beta user. You have this role on my staging site BTW 🤩 so you have already been using it 😁
Jeff awesome! I think I’ll be using user role manager then 😄. Thank you for the orientation Jeff!
It’s been there all the time 😂
Jorge de los Reyes everything is easy, when you know how, 🤣 and sometimes, even the professor can learn something from his students 🤓
This is a very valid concern and something many WordPress site owners struggle with. Granting full admin access for support can be risky from both a privacy and compliance standpoint, especially on sites handling customer or payment data.
In practice, temporary admin accounts with limited capabilities and clear expiration policies seem to be the safest workaround, but it would be great to see more built-in, role-based or time-limited access options directly within tools like FCRM and FluentCart. A native “support access” feature could really help balance security with effective troubleshooting.
I use Hide My WP Ghost and it has a similar feature, giving access I define and for time periods I set. I prefer to use that than to share unlimited admin access. (Yes, I have been removed from my admin role and locked out by someone I gave shared admin access to -- not a support agent, but someone supposed to be running the day-to-day who decided that meant I shouldn't have access anymore. That got fixed real hard and I became a lot less trusting.)
Laura Baugh thank you for sharing this !
we can learn a lot from this experiences!
After checking that, I’m seeing that maybe, some kind of “support access” could be a nice add on for Fluent Auth Shahjahan Jewel
Laura Baugh 🤯 real hard, lol
I should have mentioned that I am using this https://wordpress.org/plugins/wp-security-audit-log/
in conjunction with AAM, again just the free version, to keep my eye on the beta testers on my staging site, and am absolutely loving it too!
Thanks for the info in this thread. I'll look into AAM, but as far as I'm concerned I have a simple rule, which is to never give admin credentials to anyone. Even on a staging site created by WP-Staging, all the user data is exposed, and that's a no-no for privacy and GDPR reasons, as well as for contractual reasons (our clients do not agree to their data to be shared with any third party).
Whenever that is requested, I offer to do any additional debugging that the support agent or dev would request. I have been developing WP sites for more than 10 years, and I never had to provide admin credentials to anyone. I used to be a developer many years ago and I am very technical, so that helps, but there is no way I would give admin credentials to anyone. As soon as you've done it more than once, you have no way to know who caused a breach when/if it happens.
I might consider doing so with AAM on a staging site, but there is no way that I would give admin credentials to our production site.
As you noted, live sessions aren't an option, and most devs won't accept to do that due to timezone differences and the inability to commit to a specific time.
PSA about this topic posted a few minutes ago. This solved my issue, but Jorge de los Reyes issue is more complex.