Walkthrough · Beginner · 30 minutes
How to Secure Your Hosting Account
Harden the single account that carries every site you operate — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
One line covers it: harden the single account that carries every site you operate — a beginner-level job of roughly 30 minutes.
Below is the full run of steps, the error most people trip over, and the short cut worth remembering. On Hosting & Domains plans several steps are already automated away — the guide marks each one.
By the Hosting & Domains team · Reviewed 18 August 2026
Beginner
Skill rating
30 minutes
Time budget
5
Steps in total
24/7
Support on call
No technical background needed. This walkthrough was written for first-timers, proven on our own hardware, and honest about which parts are genuinely tricky rather than merely unfamiliar.
First rule: read the snag section before you start, not afterwards. It was distilled from the tickets of everyone who tried the other order.
How the work divides up
The work falls into a few clean stages: retire the weak passwords, turn two-factor on wherever it exists, list every live credential, defend the recovery mailbox and glance at the login history now and then.
No part of this needs code or a terminal unless the guide says so plainly — and where it does, the exact commands are printed. The step-by-step is below, with the surrounding sections supplying the context that makes it hold.
The error nearly everyone hits
The contractor credential that outlives the contract. FTP or panel access issued for a fortnight of work and still working two years later is the commonest silent exposure in small-business hosting, and nobody notices it.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
A habit worth borrowing
The email address on your client account is the real root of trust, because it can reset everything below it. Give that mailbox your strongest password, switch two-factor on, and never let it point at an inbox you have stopped reading.
A minute spent now repays itself every time this job comes round again — and like almost every hosting job, come round it will.
What a Hosting & Domains plan spares you
Some steps in this guide exist only because hosting traditionally forced them on you. Here the SSL issues itself, the copy is taken daily without being asked, and one-click installers remove the manual setup. What is left is the part that was always genuinely yours.
Stopped mid-guide at an awkward hour? That is exactly what round-the-clock support is for — say which step you are on and we take it from there.
Why this job is shorter on our plans
Every walkthrough in this library is run on the platform we actually operate — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen rather than gesturing at it from a distance.
NVMe storage and LiteSpeed caching sit under every tier, the smallest plan included — that is the floor here, not an upgrade.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 30 minutes stays 30 minutes.
5 steps, nothing padded
Each stage is a few minutes of steady clicking, and the fiddly moments are labelled fiddly.
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
Taken from real tickets
These guides came out of the support queue, so every snag flagged is one people genuinely hit.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Quick Start
Order placed to site online
- 1
Retire the weak passwords
The client area and cPanel each want their own generator-made password. This account is the master key to everything beneath it, and a recycled favourite is not good enough.
- 2
Turn two-factor on wherever it exists
It is available in the client area and in the panel alike. When a password leaks from an unrelated breach, this is the defence left standing.
- 3
List every live credential
FTP logins, API keys, extra panel users. Each account created for a departed contractor or a dead experiment is an entrance nobody watches. Remove the stale ones today.
- 4
Defend the recovery mailbox
Account recovery runs through your contact address, so that mailbox quietly caps the security of everything else. Keep it current and keep it seriously protected.
- 5
Glance at the login history now and then
Wherever login history is available, look at it occasionally. Oddities are cheapest to catch early, and the habit takes about a minute a month.
Built In
Fitted to every plan
- cPanel, which is what most of the industry already runs
- Spam and virus screening on every mailbox by default
- Mailboxes that answer at the name you hold
- People on the support desk every hour of every day
- Free SSL on every plan, reissued before the old one lapses
- Webmail in the browser plus IMAP, POP and SMTP for any client
- Your existing site brought across by our engineers, at no charge
- Staging copies for trying a change before it goes live
- PHP versions set per site from the control panel
- NVMe SSD storage on every tier, not only the dear ones
Frequently Asked
The questions that come up most
Does securing WordPress secure the hosting account?
It does not, because they are separate layers. Logins and attack surface belong to the site in their own right. The hosting account sits above it and can read, change or delete everything. Site security without account security is a bolted door in an unlocked building.
How do I safely give a developer access?
Scope the credentials to the task: an FTP account confined to the project directory, or a separate panel user where that is supported. Never the master password. Grant the least you can, record what was granted, and revoke it when the work ends.
If I cancel, what becomes of my site and files?
They remain yours. Download a full copy from the panel whenever you like, before or during cancellation. Names stay registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Do plans include copies I can restore myself?
Yes — every plan gets a daily copy, and the restore runs from your panel in minutes: files, databases or both, at three in the morning with no ticket queue in the way. Keeping a further copy offsite is still a sound habit, and nothing here stops you.
Keep reading
How to Test Your Website Speed
Measure honestly, so whatever work follows aims at evidence rather than guesswork — beginner level, about 20 minutes.
How to Install WooCommerce
Get a working shop onto WordPress and push a test order all the way through — beginner level, about 45 minutes.
SSH (Secure Shell) (Glossary)
A single term without the jargon: what it means, why it counts, and where it catches people out.
PHP Hosting
Set the PHP version per site, on quick NVMe hardware.
CMS Hosting
Quick, hardened hosting for WordPress, Joomla, Drupal and every major CMS.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Your site has earned better hosting.
Every plan carries the essentials other hosts bill as extras — and support that answers.
View PHP Hosting plans