This account controls your services, your domains and your billing. Secure it accordingly.
THE ESSENTIALS
A long, unique password, not reused anywhere else and different from your cPanel password Two-factor authentication, enabled under Account > Security Settings The backup code stored somewhere safe An email address you actually monitor, on a domain we do not host
TWO-FACTOR AUTHENTICATION
Enable it. Someone with your billing login can request changes, view your services and reach cPanel. Protecting cPanel while leaving billing open defeats the purpose.
PHISHING
We will never ask for your password by email. Messages threatening imminent suspension, or claiming a domain is about to expire, are a standard attack. Log in by typing the address yourself and check for the notice inside your account.
SUB-ACCOUNTS
Give colleagues their own contact with appropriate permissions rather than sharing your login. Remove them when they leave.
REVIEW
Once a year, check your contact details, your saved payment methods, your additional contacts, and that two-factor authentication is still enabled. Ten minutes, and it prevents most of what goes wrong.
