Plenty of companies have a single password for the hosting panel, known to the manager, the accountant, the former designer and whoever set up the website five years ago. Mailbox passwords look alike, or the employee wrote theirs on a piece of paper. Nothing happens for years. Then someone's mailbox is stolen and sends thousands of spam messages from the company server, or a stranger gets into the panel and deletes the website.
Which accounts need protecting?
Every account that lets the person who logs in change the website, the email or the domain. These matter more than the website's own login, because they control everything underneath.
- The registrar account where the domain is managed.
- The hosting provider account that pays the invoices.
- cPanel or the server control panel.
- The website's admin panel, such as WordPress.
- Your Cloudflare account if you have one, and Microsoft 365 or Google Workspace accounts.
- Staff mailboxes.
The registrar account in particular often gets forgotten. Anyone who gets in can change the nameservers and point your website and email anywhere they like. We explain why it should be in the company's name in choosing a domain name for your company.
How do you choose strong passwords and manage them?
Use a long, different password for each account, kept in a password manager. Length matters more than odd symbols, and a phrase of several random words is stronger and easier to remember than a short complicated one.
The bigger problem is reuse. When an employee uses their work email password on another site that later leaks its data, attackers try that password on their mailbox straight away. A password manager solves this, and it lets you share a login with a specific person without pasting it into a chat. Many of these tools have business plans with shared vaults and permissions.
Also avoid saving panel passwords in the browser on a computer that several people use. Now and then, look at the last login details that cPanel and many provider panels show. An IP address from a country where nobody on your team works is a reason to stop and change the password.
Why turn on two-step verification, and which kind should you use?
A stolen password is all an attacker needs. With two-step verification they also need your device. Turn it on for every account in the list above, starting with the registrar, hosting and email.
An authenticator app on your phone, or a security key, is better than text messages, because a phone number can be moved to another SIM card through fraud. Keep the recovery codes somewhere safe, and on an account the whole company depends on, don't tie verification to one person's phone alone.
- List the accountsWho owns what, and who knows the password
- New passwordsLong and unique, kept in a password manager
- Two-step verificationWith an authenticator app and saved recovery codes
- One account per personWith permissions matched to their work
- Regular reviewAnd whenever someone leaves
How should you split access across the team?
Give each person an account in their own name, with only the permissions their work needs. A designer who uploads site files needs an FTP account limited to the site folder. They have no use for the main cPanel password.
A shared account stops you from knowing who did what, and it forces a password change for everyone when one person leaves. In WordPress, give writers the Editor or Author role and keep Administrator to one or two people. In cPanel, create separate FTP and database accounts instead of sharing the main login.
What should you do if an email account is hacked?
Change the password immediately from a clean device, then check the account's forwarding rules and filters. Attackers often add a rule that forwards a copy of every message to an outside address, or hides customer replies, and that rule keeps running after the password changes.
- Ask your provider whether the server landed on blacklists because of the messages sent.
- Warn customers who may have received scam emails in your name, especially any asking for money transfers.
- Check the employee's device, since the password may have been stolen from it.
- Make sure your SPF, DKIM and DMARC records are set up, as explained in why your company's emails go to spam, so your domain is harder to spoof.
What should you do when an employee leaves or you change IT providers?
Cut off access on the day they leave. Change their email password or redirect the mailbox to a colleague, delete their panel accounts, and change every shared password they knew. Do the same when you stop working with a developer or IT company: make sure every account is in the company's name and that they can no longer log in.
We secure hosting, domain and email accounts for our clients and review access with them as part of our hosting, server and email service. If you aren't sure who can get into your accounts today, get in touch and we will start with a simple inventory.
Questions our partners ask
Does cPanel support two-step verification?
Yes. cPanel offers two-step verification through an authenticator app on your phone, as long as the provider has enabled the feature on the server. Turn it on for every panel account, and for your registrar and hosting provider accounts too.
How do I know my email account has been hacked?
Common signs: bounce messages for emails you never sent, customers complaining about strange messages from you, forwarding rules you didn't create, or a warning from your provider that the account is sending spam. Change the password right away and check the forwarding rules.
What should I do when an employee leaves?
Cut off their access the same day. Change their email password or redirect the mailbox to a colleague, delete their panel accounts, and change any shared password they knew.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
