Password hygiene and 2FA

Password hygiene means a unique secret for every account, stored in a password manager so you never reuse the same string. Two-factor authentication (2FA) adds a second check, usually a time-based code from an app, so a stolen password alone cannot open cPanel, WordPress, your registrar, or mail.

Use a password manager for unique logins

People reuse passwords because they are hard to remember. A password manager remembers for you and can generate long random strings for each site. The brand matters less than the habit: one unique secret per login, ideally twenty characters or more. If the same password sits on cPanel, wp-admin, and the domain registrar, one third-party leak can open all three. Assume any reused password is already burned, and change every place you used it—not only the account you noticed first.

Turn on TOTP where it counts

Enable app-based TOTP on cPanel under Security, on WordPress admin accounts, at your domain registrar, and on mailboxes that receive reset links. SMS is better than nothing, but an authenticator app or hardware key is stronger because SIM-swap attacks exist. After you enable TOTP, store recovery codes in the password manager vault, not as a screenshot on the desktop. Shared team mailboxes need a vault entry more than one person can open, or a single phone in a drawer will lock everyone out on a weekend.

Separate people from automation

Humans should use 2FA. Deploy scripts, WP-CLI, and CI jobs should use revocable tokens or WordPress application passwords instead of the owner password in a config file. When someone leaves the team, revoke vault access, TOTP devices, panel logins, and registrar access the same day. Shared passwords have no clean offboarding path, so avoid them.

If you suspect a compromise

Set unique passwords everywhere you reused the old one, turn TOTP on if it was off, end active WordPress sessions, rotate application passwords, and confirm a registrar lock if your registrar offers one. SSH keys help for shell access on a VPS, but they do not replace 2FA on the control panel. The password manager is the daily habit; TOTP is the second door; reuse is the hole that lets a forum leak become a stolen shop.