You sit between us and your clients, and you carry obligations in both directions.
PROTECTING YOUR OWN ACCESS
Strong unique password on WHM and on your Client Area Two-factor authentication on both API tokens rather than passwords for billing system integration, scoped narrowly Your own computer kept clean and patched, since it holds access to every client you host
PROTECTING YOUR CLIENTS
Set Max Email per Hour on every package, limiting the damage one compromised mailbox can do Set quotas rather than unlimited Never share one login across multiple clients Remove access for staff and contractors when they leave
RESPONDING TO PROBLEMS
Act on abuse reports promptly. A phishing page on one client account threatens every account on the server. Watch for accounts sending unusual volumes of mail. Check periodically for accounts running long-abandoned software.
WHAT TO TELL CLIENTS
That they are responsible for keeping their own site software updated, unless you sell them a maintenance arrangement. Say it in writing at the start, because after a compromise it reads as an excuse rather than a term.
