Your website may look perfectly normal while the accounts controlling it are poorly protected. A stolen login to your hosting provider, domain registrar, business email, or website dashboard can create problems that a routine website update will not fix.

For a small service business, protecting these accounts does not require memorizing dozens of complicated passwords. It starts with knowing which accounts matter, giving each one a unique password, and enabling stronger sign-in protection wherever possible.

Identify the Accounts That Control Your Website

Start by listing the services someone would need to access to change, disable, or take over your website:

  • Domain registrar: Controls registration details and, often, domain-related settings.
  • Hosting or website platform: Controls the service running your site and may provide access to its files or settings.
  • Website administration: Allows people to edit pages, install features, or change site configuration, depending on their permissions.
  • Business email: May receive password-reset links and security notifications for the other accounts.
  • DNS and other connected services: May control how visitors and email reach your business.

The goal is not to share one master login with everyone who works on the site. Record who owns each account, who has access, and how the business can recover access if its usual administrator is unavailable. Use a secure recordkeeping method rather than putting passwords into an ordinary shared spreadsheet.

Use Unique Passwords and Add a Second Sign-In Check

A strong password helps protect an account, but reusing that password across services creates an unnecessary connection between them. If one service is compromised, the same password may be tried elsewhere.

Use a reputable password manager to generate and store distinct passwords. Protect the password manager itself with a strong master password and the strongest available multifactor authentication (MFA). The National Institute of Standards and Technology (NIST) recommends strong passwords, password managers, and MFA for small businesses.

Two-factor authentication (2FA) adds another verification step beyond a password. Some services support security keys or passkeys; others offer authenticator apps or one-time codes. These methods are not equally resistant to phishing. Where available, choose a phishing-resistant option, such as a properly configured security key or passkey, especially for your most sensitive accounts. A code sent by text is generally less protective against certain attacks, but it is still preferable to relying on a password alone when stronger methods are unavailable. NIST's small-business MFA guidance recommends prioritizing sensitive systems and phishing-resistant options.

Do not assume that turning on 2FA for your hosting account also protects your website dashboard or email. Review each service separately.

Make Sure Extra Security Does Not Lock Out the Business

Before enabling a new sign-in method, check the provider's account-recovery instructions. Store recovery codes securely, separately from the device you normally use to sign in. Make sure the business has an authorized way to recover critical accounts if a phone is lost or a staff member leaves.

For WordPress sites, 2FA options depend on the site's configuration and installed tools. WordPress.org's Two-Factor plugin is one available approach, not a built-in guarantee that every WordPress website already requires 2FA. Its documentation explains that each user must configure their own authentication options. Any plugin should be checked for compatibility and maintained like other website software.

If a contractor manages your website, ask for individual access wherever the platform supports it instead of handing over your primary credentials. Give people only the permissions their tasks require. When the working relationship ends, review access to the website, hosting, domain, email, and related services—not just the public site's administrator list.

A Short Access Check Worth Repeating

Set aside time to answer four questions:

  1. Can the business identify and access the accounts controlling its domain, website, and email?
  2. Does each important account have a unique password and the strongest practical MFA option enabled?
  3. Are recovery methods current and securely available to an authorized person?
  4. Do former employees, vendors, or unused accounts still have access they no longer need?

Repeat the review when you change providers, hire or release a contractor, or receive an account-security alert. If you suspect an account has been compromised, follow the affected provider's recovery process promptly rather than treating the situation as ordinary maintenance.

Website security is not a one-time password change. The useful habit is keeping control of the accounts—and the people permitted to use them—clear as the business changes.

Sources and Further Reading