Does Drupal have a mechanism which will allow me to keep control over a site after handing it over to a client?

If things go wrong with the client relationship, I need to be sure I still have control over the website.

  • 3
    IANAL, but you really need to talk a lawyer about what you plan on doing is legal in your jurisdiction and doesn't violate your contract (explicit or implicit). If this was a properly executed "work for hire" engagement, then there is a good chance that your client has the full rights over the website and you have none.
    – mpdonadio
    May 5, 2016 at 13:15

2 Answers 2


Yes, as the developer you can control this:

  1. Make sure only you know the (strong) password to the admin (user 1) account.
  2. Make sure Drupal core and modules are up-to-date to mitigate possibility of a security hole that may expose the user 1 login.
  3. Make sure only you have access to the files/database for the site; that way your client can't change data manually that might give them access, or run PHP scripts to do the same.
  4. If you have the PHP filter module enabled, disable it, or at the very least make sure your client can't use it.
  5. Install User One to stop users with the "Administer Users" permission from editing user 1's password.
  6. Make sure no other user has permission to "Administer Permissions" and "Administer Modules" so they can't grant permissions to them selves, disable User One or other critical modules.

There may be some more steps you can/should take, depending on the nature of your relationship/hosting/etc, but those should cover the basics from a Drupal perspective.

I'd strongly recommend being up-front with your client about this. Call it a 'policy' that you have, to ensure a smooth relationship, and position it that your having access to the site for maintenance/updates is actually the right move for them, not just you.

  • 3
    Make sure only you know the (strong) password to the admin (user 1) account this will not be foolproof if there is another admin or user role that has "Administer users" permissions. Which means they can change user's 1 name and password.
    – No Sssweat
    May 5, 2016 at 10:36
  • 1
    Really good point @NoSssweat, I've added another item for that
    – Clive
    May 5, 2016 at 10:40
  • and not have other admin or use role with "Administer modules" and "Administer permissions" permission, as they could disable User One.
    – No Sssweat
    May 5, 2016 at 10:47
  • 1
    @NoSssweat Another great point - I've made this post community wiki, please feel free to add new items like that to the list
    – Clive
    May 5, 2016 at 10:50
  • If the client has access to the server the site is running on, or has admin access to the database the site is using, then there are other ways (e.g. drush, mysql client) to reset the user 1 password. May 11, 2016 at 5:09

Apart from the Drupal specific actions (as described in the previous answer), you may also want to consider additional approaches that will give you another level of control over a Drupal website, as further detailed below.


Put an appropriate phrasing (clause) in your contract with your client about that website. Something like so "For as long as client 'uses' (which means 'so and so') this website, client agrees that 'I' keep control (which means 'so and so') over this website. Any time Client violates this obligation, a penalty of X $$$ is due (by the client), for each period of 24 hours that Client does not remedy such violation, notwithstanding any additional damages due to this violation to be compensated on top of that.".

Your client is not going to easily agree to such clause, but after you get it in your contract, you're in pretty good shape. If you can't reach an agreement on that, and you really need that control, then better run away from this client.

Payment terms

If the background of your question is that you want to be sure that you get payed for the work you did to build the site (as in version 1 of your question ...), then that is something to think about upfront and get it included in your contract. Something that IMO could be a good compromise is like so:

  • Split the payment of the total invoice amount in 3 slices (instalments). Receiving the very first payment (slice) is considered as the final approve of the customer to accept your offer to build the site (and only then you start working on it).

  • The 2nd payment is due when you first show/demonstrate the newly developed site to the customer (which may include giving the customer limited access to the site also).

  • The 3rd (final) payment is considered as the final approve of the customer of the delivered site, in the state the site is in at that very moment. And after that payment is received, you ensure that within a reasonable amount of time (eg 7 days) you "turn over the keys to the kingdom" (aka give all access of the site to the customer).

Trusted 3rd party

Get a trusted 3rd party involved, such as a "Software Escrow Agency". You turn over whatever is needed (eg: passwords, etc) to have full control over the site. The 3rd party only forwards that to your client after all conditions are satisfied (eg after you confirmed you received the payments, if that's what the background of your question is.

And for this to work smoothly, you create a 3 party agreement that all parties agree to upfront, and which includes appropriate details about what exactly the "deposit" is about (password(s), keys, software, etc.), and what the conditions are for the intermediate party to give the client access to what you deposited with that 3rd party.

This approach (which is not cheap, so you may want to include the cost of it in what you charge the client ...) often helps it you're a small company, and your client is a huge organization (that really needs "something" from a tiny niche company, which may even be located in another country).

Hosted solution

Your question doesn't specify what type of control you want to have/keep, but "a" possible reason might be because you've created a Drupal based website which is using GPL software.

So "if" you want to prevent your client to provide a copy of the typical Drupal components (modules, etc that you are handling over to your client) to some other 3rd party, without your prior approval (whatever that would take, eg some fee?), "then" you might want to try to convince your client to accept a hosted solution (by you, or some 3rd party you have an agreement with). Whereas you ensure that the client receives all the benefits (functions, etc) of the website, possibly exclusively also, but without giving them access to those typical Drupal components.

With this approach, you also have the right (unless your contract with your client stops you from doing so) to reuse these Drupal components for other clients.


If "you" have control over the DNS settings used to access the Drupal site (eg because you are the owner of the domain name), then that gives "you" another level of control of the site that the domain name refers to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.