Most account compromises begin with a guessed, reused or stolen password rather than a clever technical attack.
WHAT MAKES A STRONG PASSWORD
Length matters more than complexity. Sixteen characters or more is a sensible minimum for hosting accounts. Unique to each account. A password reused on a forum that later gets breached becomes a password an attacker will try on your cPanel. Not based on your business name, domain, phone number or year of founding. These are the first guesses. Generated randomly where possible. Use the password generator built into cPanel or your password manager.
STORING THEM
Use a password manager: Bitwarden, 1Password or KeePass. It removes the temptation to reuse, and lets you share credentials with a developer without emailing them.
Never store passwords in a plain text file on the server, in a WhatsApp message, or in an email you keep for reference.
CHANGING THEM
Change immediately if a password was ever emailed in plain text, shared with someone who no longer works with you, typed on a public computer, or appears in a breach notification.
Changing your cPanel password does not change your email account passwords or your WordPress login. Those are separate and must be changed individually.
