How-to · Beginner · 30 minutes

How to Secure Your Email Account

Everything you need to protect the one account that can reset every other account you own — the steps in order, the snag to watch, and the tip our support desk gives everybody.

See the plans Ask us a question

Straight answer first

In a line: protect the one account that can reset every other account you own — a beginner-level task that takes 30 minutes.

The walkthrough below covers every step, the mistake most people make, and the shortcut worth keeping. On Hosting Seller plans several of these steps are already done for you, and we say where.

Written by the Hosting Seller staff · Checked 1 August 2026

Beginner

Skill needed

Stages to finish

Free

Help included

Tested

On our own kit

You do not need to be technical for this. The walkthrough is written for first-timers, tested on our own platform, and honest about which parts are genuinely fiddly and which are merely unfamiliar.

One promise before you start: nothing in this guide is irreversible. Where a step could bite, we say so and give you the undo.

The overview before the detail

Here is the route in full: treat it as the master key it is, give it a unique generated password, switch two-factor on at both the doors, audit the forwarders and filters and look at how the account is accessed.

Each stage is a few minutes of steady clicking — the time it takes depends mostly on how familiar the control panel already feels. The detailed steps sit further down this page; skim the whole route once before you begin.

Read this before the first click

The forwarder left behind. A compromised mailbox 'recovered' by changing the password carries on leaking through the forward rule planted during the break-in, and the audit step is what actually ends the incident.

Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.

The trick worth borrowing

Give the mailbox a different password from the hosting panel, both generated and both stored in your manager. The two doors open onto different rooms, and one key fitting both halves the work for anybody trying them.

It costs a minute now and pays that back every time the job comes round again — which, like most hosting jobs, it certainly will.

The parts we have already done for you

We have automated the steps that do not deserve your time: certificates issue and reissue themselves, the installer handles application setup, the daily backup covers the what-if, and per-site settings live in a panel instead of a config file. The guide above covers what remains — the part that is actually about your site.

And when a step misbehaves anyway, support answers at any hour with the actual fix, not a knowledge-base link and a shrug. Half our best guides began life as a pattern in the ticket queue.

A shield icon standing in for site security and DDoS filtering

A good platform makes every guide shorter

Every walkthrough on our how-to shelf is tested on the platform we actually run — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen instead of gesturing vaguely at it.

What you pay on day one is what you pay at renewal, so the year-two invoice holds no surprises worth opening early.

Step by step, tested exactly as printed
The snag flagged before you reach it
The dull steps are already automated
People on hand at any hour if you stall

Why Hosting Seller

On every plan, as standard

Help on the counter

Stuck on step three at midnight? Support answers at any hour, mid-guide included.

Works exactly as written

Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.

The snag, named early

The classic mistake for this exact job is flagged before step one, so 30 minutes stays 30 minutes.

Scoped honestly

Protect the one account that can reset every other account you own is a beginner-level task — this guide budgets 30 minutes and says which steps the platform absorbs.

No jargon toll

Terms are explained where they appear or linked to the glossary — nothing assumes you already know.

Written from real tickets

Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.

First Steps

From choosing to live

1
Treat it as the master key it is
Password resets for your bank, your hosting and everything else arrive by email. Whatever security your mailbox has is effectively the ceiling on the security of every other account you hold.
2
Give it a unique generated password
Generated by a password manager and used nowhere else. Email passwords that appear in a breach dump get tried against mailboxes within hours, and reuse is what makes that attack work.
3
Switch two-factor on at both the doors
Both webmail and the hosting control panel support it. The panel matters twice over, because anyone inside it can read and reset every mailbox on the account without needing your password at all.
4
Audit the forwarders and filters
An attacker who gets in briefly plants a silent forward and a rule that deletes the evidence. Read both lists carefully and remove anything you did not put there yourself.
5
Look at how the account is accessed
Check last-login details where they are available, switch off protocols you never use, and revoke app passwords that no longer match a device you still own.

In the Box

Packed with every plan

One-click installs for WordPress and 400+ other applications
NVMe SSD storage on every shelf, not just the top one
The renewal price printed on the tag matches the order price
A 99.9% uptime commitment, watched by monitoring day and night
The Softaculous installer for one-click application setup
Webmail in the browser plus IMAP, POP and SMTP for your own client
DDoS filtering handled out at the network edge
Spam and virus filtering fitted to every mailbox
Upgrades apply to the account in place, with no move between plans
SSH, Git and Composer on the plans built for developers

Across the Counter

The questions we get asked most

How would I spot that the mailbox had been broken into?

The signs: your password suddenly stops working, there are messages in Sent you never wrote, contacts report spam from you, unfamiliar forwarders or filters appear, or login alerts arrive from places you have never been. Any one of those means reset and audit immediately.

Does leaving IMAP switched on create a risk?

IMAP over SSL with a strong unique password is perfectly safe. The risk sits in reused passwords and in app credentials nobody monitors. Switch off protocols you genuinely never use and keep proper credentials on the ones you do.

What if the site outgrows the plan I bought?

You move up in place. Plan changes are made from the client area with no migration and no downtime, and the range runs from small shared accounts through VPS to whole dedicated servers. Growing becomes a line change on your account rather than a hunt for a new host.

Do you shift an existing site across at no charge?

We do. Open a ticket with the login details for your current host and the whole lot comes over: files, databases, mailboxes and configuration. You check the copy before DNS changes hands, and the old site keeps serving customers until the new one takes the traffic, so nobody ever sees a gap.

What uptime do you commit to, and who is watching?

We commit to 99.9% uptime and watch it continuously. That figure is an operational target rather than a poster line, and the alerting behind it usually has an engineer on a problem before the first customer notices anything is wrong.

What does round-the-clock support actually stretch to?

People at the counter at every hour, and a scope that takes in the practical work: mailbox setup, DNS records, WordPress trouble, restores. Not 'the server responds, ticket closed'. Ask us something hard before you order — the reply is a fair sample of what you would get afterwards.

Can I set the PHP version myself?

Yes — PHP versions are chosen per site from the control panel, so an old application and a current one can sit side by side on the same account. Extensions and per-site settings live in the same screen, and none of it needs a support ticket.

Packing up and moving host? Take our checklist.

A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.

Do the launch properly this time.

From a first website to a rack of servers, moving up is a change to your account rather than a migration.

See the plans