Skip to main content

Protect your hosting account

Your hosting and domain accounts control your website, your email and your domain name. If someone else gets in, they can take the site down, read your email or move the domain away. These habits make that much harder.

Secure the way you sign in​

  • Use a unique, long password for every account, ideally created and stored by a password manager. A reused password is only as safe as the weakest site you used it on.
  • Turn on two-step sign-in wherever it is offered. Even if your password leaks, a code from an authenticator app on your phone is still needed to get in.
  • Keep recovery details current. Make sure the email address on your accounts is one you still use and protect, because password resets are sent there.
  • Save your backup codes somewhere safe, such as your password manager, so a lost phone does not lock you out.

Keep the email address behind your domain safe​

The contact email on your domain registration receives renewal notices, transfer confirmations and password resets. Do not use an address at the same domain as the only contact: if the domain stops working, so does the email you need to fix it.

Recognize phishing​

Attackers often pretend to be a hosting company or registrar. Be suspicious of any message that:

  • Says your domain or account will be suspended unless you act immediately.
  • Asks you to sign in through a link, or to reply with a password or a code.
  • Comes from an address or a link that does not match the company's real domain.

Instead of clicking, open the provider's website by typing its address yourself, sign in there and look for the same notice. Genuine support teams do not need your password or your two-step codes.

Look after your website​

  • Update everything: the CMS, such as WordPress, and every plugin and theme. Most website break-ins use known flaws that an update would have fixed.
  • Remove what you don't use: old plugins, themes, test copies of the site and accounts for people who no longer need access.
  • Give each person their own login, with only the permissions they need, rather than sharing one administrator account.
  • Use secure connections: SFTP rather than plain FTP, and HTTPS for the site and its admin area.

Keep backups you can restore​

A backup is only useful if you can restore it. Make sure that:

  • Backups run automatically and include both files and databases.
  • At least one copy is kept somewhere other than the hosting account itself.
  • You know how to restore a backup, and have tried it at least once.

Keep your domain locked​

A domain lock (transfer lock) blocks transfers to another registrar until you remove it. Leave it on unless you are moving the domain, and keep the authorization code private: together with access to your account, it is what allows a transfer.

At DomainPilot

Every domain registered with DomainPilot includes a domain lock against unauthorized transfers. To protect your DomainPilot account with an authenticator app, follow Turn on two-step sign-in for your account on the DomainPilot website.

Did this article help you?