How to secure your hosting account

Why this matters

Most hosting break ins do not involve clever hacking. They start with a reused password, a phishing email, or an old FTP account nobody remembered. One stolen login can expose your website, your customers' data and your business email. This article covers the accounts around your hosting; for hardening the website itself, see how to secure a website.

List the logins you have before you begin:

Login	What it controls
ODHOST client area	Billing, services, tickets
cPanel or Plesk	Files, databases, email, DNS
Email accounts	Mail, and password resets for other services
FTP accounts	Website files
Website admin (WordPress or other)	Content, plugins, users
Domain registrar	Nameservers and ownership of the domain
VPS SSH or RDP	The whole server

Steps to secure your accounts

1. Use a different strong password for every login in the table. A long passphrase of several random words is both strong and easy to type. Never reuse your email password anywhere else.

2. Store passwords in a reputable password manager rather than in a notebook, spreadsheet or WhatsApp chat. Share access with staff through the manager's sharing feature, not by message.

3. Turn on two factor authentication (2FA) wherever it is available:

   • cPanel: Security > Two-Factor Authentication, if your host has enabled it. Scan the QR code with an authenticator app.
   • Client area: look for a security or two factor option in your account settings; WHMCS supports this when the host enables it.
   • WordPress: use a well maintained 2FA plugin for admin accounts.
   • Email and registrar: enable 2FA on the mailbox that receives billing emails and on your domain registrar account.

   Save the backup codes in your password manager.

4. Protect your billing email. Whoever controls it can reset your client area password. Use an address on a provider with 2FA, keep its recovery phone number current, and make sure it is not a mailbox an ex employee still knows.

5. Review who has access, every few months and whenever staff or agencies change:

   • cPanel Files > FTP Accounts: delete accounts you do not use. See uploading files with FTP.
   • cPanel Email > Email Accounts: remove old mailboxes or change their passwords.
   • cPanel Security > Manage API Tokens and SSH Access keys, if present: revoke anything you do not recognise.
   • WordPress Users: remove old administrators and downgrade users who only need to write posts.
   • Client area contacts or users: remove people who no longer need access.
   • On a VPS: check ~/.ssh/authorized_keys and the list of user accounts.

6. Give helpers their own access instead of your main password: a separate FTP account limited to one folder, their own WordPress user, or a client area contact with only the permissions they need.

7. Watch for phishing. Be wary of anyone asking for your password, by phone, email or chat, even if they claim to be from your host, bank or a government office. Look closely at sender addresses and links, and log in by typing the address yourself.

8. Keep software updated and backups current, so a break in can be undone. ODHOST shared plans include weekly backups; also keep your own copies, as explained on website backups.

How to confirm it worked

• Logging in to cPanel, the client area and your email now asks for a 2FA code.
• Your password manager holds a unique entry for every login in the table.
• Lists of FTP accounts, email accounts and admin users contain only people who need them today.

If something looks wrong

If you see logins you do not recognise, changed files, unexpected emails sent from your domain, or a password that no longer works:

1. Change the affected passwords from a device you trust.
2. Turn on 2FA if it was not on.
3. Open a support ticket with the domain, what you noticed and when (IST), any suspicious IP addresses or file names, and the changes you have already made. Never include passwords in the ticket.