Most hacked websites do not fall into the hands of attackers through a sophisticated attack, but because of a weak or reused password. One cracked password then opens the admin panel, FTP and emails.
What makes a password strong
- Long. Length is what matters, ideally at least 14 characters. A long sentence of several words is better than a short password with an exclamation mark.
- Unique. Every service should have a different password. If one leaks, the others stay safe.
- Unrelated to you. No names, birth dates, company names or dictionary words.
Where you have passwords
| Hosting admin panel | access to everything, the most important password |
| Mailboxes | allow password recovery for other services |
| FTP accounts | access to website files |
| Databases | access to application data |
| Website admin (WordPress, etc.) | the most common target of attacks |
How to remember them
Use a password manager. You remember one strong master password and the program generates and stores the rest. It is both more secure and more convenient than writing passwords on a piece of paper or always using the same one.
Basic rules
- Do not send passwords by email or write them in a chat. If it is unavoidable, share them through a different channel than the username.
- If a password has probably leaked (suspicious activity, a user leaving the company), change it immediately.
- Where possible, turn on two-factor authentication, see the glossary.
- You can find out whether your address was part of a data breach at haveibeenpwned.com.
- Do not use default usernames such as admin.
If your website has already been hacked, read My website was hacked: what to do.