Most account takeovers don't involve genius hackers — they involve a reused password leaked from some other website, tried automatically on yours. This checklist closes that door for your ZedgeHost, cPanel, WordPress and email accounts.
The checklist
- A different password for every account. Client area, cPanel, WordPress admin, and each important mailbox — all different. One leak must never unlock everything.
- Long beats clever: 14+ characters. A phrase of random words with numbers is both strong and memorable — or let a password generator do it.
- Use a password manager — your browser's built-in one at minimum. Humans can't remember 30 strong passwords; managers can, and they also refuse to type your password into look-alike fake sites.
- Turn ON two-factor authentication (2FA) wherever it is offered. If your client-area account shows a Two-Factor Authentication option in its security settings, enable it — a code from your phone then becomes the second key, and a stolen password alone is useless. Do the same inside WordPress with a security plugin.
- Guard the master email: the email address on your accounts receives every password reset. It deserves your strongest password and 2FA at its own provider — it is the keys to all the other keys.
- Never share your main logins. A developer needs their own FTP account or WordPress user — created for them, deleted after (see the FTP article). Sharing the master password means never being able to take access back cleanly.
- Change passwords when: a staff member leaves, a device is lost, or you ever typed a password into a page you reached from a strange email link.
✅ Result: Your accounts now resist the attacks that actually happen: mass password-reuse attempts, phishing pages and casual credential sharing. Ten minutes of setup, years of protection.
⚠ Common mistakes & fixes
- "Strong" password used everywhere: strength doesn't matter once it's leaked from another service. Unique is the rule that saves you.
- Passwords in a phone note or a chat: chats get forwarded and phones get lost. A password manager is the only notebook designed for this job.
- Ignoring login-notification emails: if a service says "new sign-in" and it wasn't you, change that password immediately and check the account's other sessions.
Related articles
- How to Reset Your Client Area and cPanel Passwords
- How to Secure Your WordPress Website
- What to Do If Your Website Gets Hacked