Quick answer: Every account that can change your website, including the CMS, hosting, domain registrar, DNS, email and analytics, should have a long, unique password generated by a password manager, plus two-factor authentication where offered. Use a team password manager to share access instead of email or spreadsheets, give each person their own login where the service allows it, and have a clear routine for adding and removing people. Reused and shared passwords cause more website break-ins than clever attacks do.
Which accounts count as “website admin”
When people think about website passwords they think about the WordPress or CMS login. That is only one of them. A typical small business site depends on:
- The CMS admin (WordPress, Shopify, Squarespace or others)
- Hosting control panel (cPanel, Plesk or the host’s own dashboard)
- SFTP or SSH access to the server
- Database access
- Domain registrar
- DNS provider, if different from the registrar
- Email accounts, especially the one used for password resets
- CDN or firewall service, such as Cloudflare
- Google Analytics, Search Console, Tag Manager and Google My Business
- Payment gateway and ecommerce plugins
- Backup service
Anyone with the registrar login can point your domain elsewhere. Anyone with the reset email can take over most of the others. Treat them all as admin accounts. Our guides on domain security and website ownership explain why the registrar and ownership records matter so much.
What makes a password strong
Current guidance from security bodies such as NIST has moved away from rules like “one capital, one number, one symbol, change every 90 days”. Those rules led people to predictable patterns. What matters most:
- Length. Longer passwords are much harder to crack. A random string of 16 or more characters, or a passphrase of several random words, is a good baseline.
- Uniqueness. Every account gets its own password. If one service leaks, the others stay safe.
- Randomness. Generated by software, not invented by a person. People are bad at randomness.
- Not known to be breached. Passwords that appear in public breach lists are tried first by attackers.
Change a password when there is a reason: a suspected breach, a staff member leaving, or a service reporting a leak. Forced changes on a timer with no reason tend to make passwords weaker.
Why reuse is the real danger
Large data breaches happen regularly. When they do, email and password lists are shared and sold. Attackers then try those combinations on other services, a technique called credential stuffing. It is automated and cheap.
If a team member uses the same password for a forum and for your WordPress admin, the forum’s breach becomes your breach. You can check whether an email address has appeared in known breaches using Have I Been Pwned.
Use a password manager
Nobody can remember dozens of long, random, unique passwords. A password manager remembers them for you. It:
- Generates strong passwords
- Stores them encrypted
- Fills them into login forms
- Syncs them across devices
- Warns about reused or weak passwords
Well-known options include 1Password, LastPass, Bitwarden, Dashlane and KeePass. They differ in price, team features, where data is stored and how sharing works.
What to look for in a team password manager
- Shared vaults or folders so you can share access by role, not by individual password
- Per-user accounts with the ability to remove someone instantly
- Two-factor authentication for the password manager itself
- Audit logs that show who accessed what
- Browser extensions and mobile apps that people will actually use
- Emergency access or recovery so the business is not locked out if one person is unavailable
Set a long, unique master password for the manager itself and protect it with two-factor. It is the key to everything else.
Share access safely
Prefer individual logins
Where a service supports multiple users, give each person their own login with the right role. Shared logins make it impossible to know who did what and hard to remove one person without disrupting everyone. In WordPress, use roles to limit what each person can do; see WordPress user roles.
Google Analytics, Search Console, Tag Manager and most hosting panels support multiple users. Use that instead of passing around one Google account.
When you must share a login
Some services only allow one login, such as some domain registrars or older systems. In that case:
- Store the credentials in a shared vault in the password manager
- Limit the vault to the people who really need it
- Turn on two-factor and decide who holds the second factor
- Change the password when anyone with access leaves
Never share passwords by email, chat or spreadsheet
Emails and chat messages sit in inboxes and backups for years. Spreadsheets get copied and forwarded. If you must send a credential outside the password manager, use a one-time secret link that expires after viewing, and change the password once the task is done.
Add two-factor authentication
Two-factor authentication means a password alone is not enough to log in. Turn it on wherever it is offered, starting with:
- Email accounts used for password resets
- Domain registrar and DNS
- Hosting
- CMS administrators
- Google accounts
- Payment services
Authenticator apps are generally safer than SMS codes, which can be intercepted through SIM swap fraud. Hardware security keys offer even stronger protection for the most sensitive accounts. Our post on WordPress two-factor authentication covers the setup inside WordPress.
Record backup codes in the password manager so a lost phone does not lock the business out.
Adding and removing people
Most access problems come from staff and agency changes. Write a short routine.
When someone joins:
- Create their own accounts with the minimum role they need
- Add them to the relevant password manager vaults
- Make sure two-factor is set up on day one
When someone leaves or an agency contract ends:
- Remove their user accounts from every service
- Remove them from password manager vaults
- Change any shared passwords they had access to
- Check for API keys or SSH keys they created and revoke them
- Confirm the business, not the individual, owns key accounts such as the domain and analytics
Keep a simple access register listing each service, who has access and who owns it. Review it every quarter.
What to do after a suspected breach
- Change the password for the affected account and any account that shared it
- Log out all active sessions where the service allows it
- Check for new users, changed email addresses or changed recovery details
- Review recent activity logs
- Turn on two-factor if it was not already on
If the website itself shows signs of compromise, follow a full clean-up. Our guide to a hacked WordPress site covers the steps.
FAQ
Is it safe to store passwords in my browser?
Browser password storage is better than reuse, but dedicated password managers offer stronger sharing, auditing and cross-browser support for teams.
How long should a website admin password be?
Sixteen characters or more from a generator is a sensible minimum for admin accounts. Longer is better when the service allows it.
What if the password manager itself is hacked?
Reputable managers encrypt vaults so the provider cannot read them. A long master password and two-factor make your vault very hard to open even if encrypted data were stolen.
Make good habits the easy option
Strong, unique passwords, a shared password manager, two-factor and a clear joiners and leavers routine protect every part of your website. If you want help auditing access and securing your site, see our Turn visitors into customers service.
