Account Security: Passwords, 2FA and Team Access
The accounts that matter most
Your registrar account outranks everything: whoever controls the domain controls the website and the email, regardless of where they are hosted. Protect it as your most critical asset, followed by the hosting client area, the CMS administrator accounts and the payment gateway.
Baseline practices
- A password manager for the whole team, with no credentials in spreadsheets or chat messages.
- Unique passphrases of 16 characters or more for every service.
- Two-factor authentication everywhere it is offered, using an authenticator app rather than SMS.
- Individual accounts per person, never a shared login, so access can be revoked cleanly.
- Least privilege: editors get editor roles, contractors get time-limited access.
- A documented offboarding routine that revokes access the day someone leaves.
Recovery planning
- 1 Store 2FA recovery codes somewhere physically separate from the password manager.
- 2 Use a company mailbox not hosted on the same domain as the recovery address for registrar and hosting accounts.
- 3 Keep a written list of critical services, who owns them and how to recover them.
- 4 Nominate a second administrator so a single person's unavailability is not an outage.
Frequently asked questions
How often should passwords be rotated?
Rotate on events — a staff change, a suspected breach, a device loss — rather than on an arbitrary schedule. Length and uniqueness matter far more than frequency.
Is SMS 2FA acceptable?
It is better than nothing, but SIM-swap attacks are real. Prefer an authenticator app or hardware key for anything financial or domain related.
Need a hand applying this?
Our engineers can do it for you. Open a ticket and we will help.