Most compromises we see come down to a password that was weak, reused, or stolen from somewhere else entirely.
What actually makes a password strong
Length, far more than complexity. A long passphrase of several unrelated words beats a short string of symbols, and you can remember it. Substituting 3 for e and adding an exclamation mark fools nobody – cracking tools have tried that since the 1990s.
The rule that matters most
Never reuse a password. Breaches happen constantly at sites you have no control over. When one leaks, attackers try the same address and password everywhere else. A unique password per site means one breach affects one account.
Use a password manager
You cannot remember dozens of unique passwords, and you should not try. A password manager generates and stores them, and you remember one strong passphrase for it. This single change fixes reuse, weakness and writing them down at once.
The accounts that matter most here
- Your client area login – access to billing and domains
- cPanel – access to everything hosted
- Your website's own administrator account
- The email address those accounts recover to, which is the master key to all of them
Also
- Turn on two-factor where offered – see Turning on two-factor authentication
- Never send a password by email. If you must share one, change it afterwards.
- Change any password that has been on a computer you suspect was infected
