It's simple. Use version control (I use git) and a VPN, where your friend can connect to your local webserver running your working copy to see your current state, but the live server stays clean and can be updated from git later.