How to be sure that the website's security isn't under any risk after he has done his job? (I'm a beginner, I use Ubuntu-16.04-PHP). Thank you!
tl;dr: It's really, REALLY difficult to be sure. About the website itself, static analysis and installing a known, (code)reviewed version of the website could help. About the server itself, nuking it and installing from know sources is the only way to be 100% sure.
Next time, please don't grant to anyone, more privileges than the bare minimum. You probably saved time back then but it came back to bite you so you'll end up spending a lot more.