Protecting Your Hosting Account: Passwords, 2FA and Access

A hacked website rarely starts with a sophisticated attack. More often it starts with a guessed password or one leaked from another site. On the hosting side there are several separate doors to protect, and each needs its own key.

The accounts to protect

1. Client area: invoices, services and support tickets live here. Someone with access can cancel your service or reach your domain management.
2. cPanel: gives access to all your files, databases and email accounts.
3. Email accounts: password reset links arrive here, so losing one can mean losing other accounts too.
4. Site admin: the WordPress or application administrator account. See securing WordPress admin.

What makes a good password

• Unique: never used on any other site. Passwords leaked from one site are tried automatically on others.
• Long: a long password made of several random words is both safer and easier to remember than a short, complex one.
• Stored in a password manager: the only practical way to keep a separate password for every account.

Two-factor authentication (2FA)

2FA means someone who steals your password still can't log in, because they also need the one-time code from the authenticator app on your phone.

Turning on 2FA in cPanel

Under Security › Two-Factor Authentication, click Set Up Two-Factor Authentication, scan the QR code with an authenticator app and enter the code it shows. In case you lose your phone, use your app's backup or device transfer feature.

Passkeys

Some services offer passkeys instead of passwords, using the fingerprint or face recognition on your device. Passkeys resist fake sites better, because they only work on the real site's address. Turn them on wherever your registrar, email provider or cloud services support them.

Giving team members access

Rather than handing a designer or developer your own cPanel password, give them only the access they need. For example, create an FTP account limited to one folder, or a separate WordPress user. Close these accounts when the job is done.

If something looks wrong

If you see a login notice you don't recognise, changed files or emails you didn't send, change your passwords first, then follow the steps in our guide to suspicious changes and open a support ticket. Don't log in through links in emails that look like security notices; always type the panel address yourself.