How-to · Beginner · 30 minutes
How to Secure Your Hosting Account
Lock down the one account that holds every site you run — a practical, jargon-free walkthrough with the classic mistake flagged before you make it.
Straight answer first
In a line: lock down the one account that holds every site you run — a beginner-level task that takes 30 minutes.
The walkthrough below covers every step, the mistake most people make, and the shortcut worth keeping. On Hosting Seller plans several of these steps are already done for you, and we say where.
Written by the Hosting Seller staff · Checked 1 August 2026
Beginner
Difficulty level
30 minutes
Time to allow
5
Stages
24/7
Help at any hour
You do not need to be technical for this. The walkthrough is written for first-timers, tested on our own platform, and honest about which parts are genuinely fiddly and which are merely unfamiliar.
Rule of the road: read the snag section before you begin rather than after. It is harvested from the tickets of people who did it the other way round.
The shape of the work
The job breaks into a few clear stages: replace the weak passwords, switch on two-factor wherever it is offered, list every credential that exists, secure the recovery mailbox and glance at the login history.
No stage needs code or a terminal unless the guide says so outright, and where it does, the exact commands are printed. The full step-by-step sits below; the sections around it give the context that makes it stick.
The mistake nearly everyone makes
The contractor login that outlives the contract. FTP or panel access created for a fortnight's work and still valid two years later is the most common quiet exposure in small-business hosting, and nobody ever notices it.
Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.
The trick worth borrowing
Your client-area email address is the real root of trust, because it can reset everything else. Give it the strongest password you own, turn on two-factor, and never leave it pointing at a mailbox you stopped reading.
It costs a minute now and pays that back every time the job comes round again — which, like most hosting jobs, it certainly will.
What you can skip on a Hosting Seller plan
Several steps in this guide exist only because hosting historically made you do them. On our plans SSL issues itself, backups run daily without being asked, and one-click installers replace the manual setup entirely. What is left is the part that is genuinely yours.
Stuck halfway through at an odd hour? That is exactly what round-the-clock human support is for — tell us where you are in this guide and we will pick it up from there.
The hosting this guide is written against
Tutorials age badly when they are written against imaginary hosting. These are written against ours: the same panel, the same installer and the same defaults you will meet.
NVMe disks and LiteSpeed caching sit on the shelf at every price point, not behind a premium tier.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
The snag, named early
The classic mistake for this exact job is flagged before step one, so 30 minutes stays 30 minutes.
5 steps, no filler
Each stage is a few minutes of steady clicking, with the fiddly parts marked as fiddly.
No jargon toll
Terms are explained where they appear or linked to the glossary — nothing assumes you already know.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
Written from real tickets
Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
First Steps
From choosing to live
- 1
Replace the weak passwords
Separate, manager-generated passwords for the client area and for cPanel. This account is the master key to everything sitting inside it, so it deserves better than a reused favourite.
- 2
Switch on two-factor wherever it is offered
Both the client area and the panel support it. It is the one control that still holds the line after a password has leaked somewhere else entirely.
- 3
List every credential that exists
FTP accounts, API keys, extra panel users. Every login made for a past contractor or a long-finished experiment is a door still standing open. Delete the stale ones today.
- 4
Secure the recovery mailbox
Account recovery runs through your contact address, so that mailbox quietly sets the ceiling on everything else. Make sure it is current, and make sure it is well defended.
- 5
Glance at the login history
Where login history is available, skim it now and then. Anything odd is cheapest to catch early, and the habit costs roughly a minute of your month.
In the Box
Packed with every plan
- Mailboxes that carry your own domain name
- A free SSL certificate on every plan, reissued before it lapses
- Spam and virus filtering fitted to every mailbox
- Site migration done for you by our staff, at no charge
- Staging copies so changes get tested before they go live
- cPanel, the panel the rest of the trade already knows
- NVMe SSD storage on every shelf, not just the top one
- A domain free for year one when you order annually
- A 30-day money-back guarantee on every hosting plan
- WebP image optimisation built in and costing nothing
Across the Counter
The questions we get asked most
Is securing WordPress the same as securing the account?
No — they are different layers. The site has its own logins and its own attack surface. The hosting account sits above it and can read, change or wipe the lot. Site security without account security is a locked room in an open house.
What is the safe way to give a developer access?
Credentials scoped to the job: an FTP account limited to the project folder, or a separate panel user where that is supported. Never your master password. Grant the minimum, write down what you granted, and revoke it when the work ends.
What happens to my files if I leave?
The site and the files stay yours. Pull a full backup from the panel whenever you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Are backups included, and can I put one back myself?
A backup is taken daily on every plan, and the restore is yours to run from the panel in minutes — files, databases or both, at three in the morning without waiting on a ticket. Keeping your own copy offsite as well is never a bad habit, and nothing here stops you.
Which control panel comes with the account?
cPanel, which the whole trade already knows. That means every tutorial online matches what you see, your backups restore onto any cPanel host anywhere, and what you learn here stays useful for life. Plesk and DirectAdmin are stocked on specific plans for anyone who prefers them.
Do you shift an existing site across at no charge?
We do. Open a ticket with the login details for your current host and the whole lot comes over: files, databases, mailboxes and configuration. You check the copy before DNS changes hands, and the old site keeps serving customers until the new one takes the traffic, so nobody ever sees a gap.
How do I read the mail when I am away from the desk?
Webmail opens in any browser, and every mailbox also speaks IMAP, POP and SMTP — so the mail app on your phone, the client on your desktop and webmail all show the same messages in the same order.
Read next
How to Install WooCommerce
Turn a WordPress site into a working shop, configured properly the first time — beginner level, about an hour.
How to Use phpMyAdmin
Read, back up and carefully edit your database through the panel's standard window — intermediate level, about 20 minutes to learn.
AI Website Builder
Describe the site and the AI builder drafts it on real hosting.
Charity Hosting
Reduced prices for charities and nonprofits, essentials still included.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Your site is worth better hosting.
From a first website to a rack of servers, moving up is a change to your account rather than a migration.
See the plans