Your client account can control billing, services and support requests, while hosting panels and mailboxes may have separate credentials. Protect each access point independently. Reusing one password across these systems makes a single compromised login more damaging and can make it harder to identify which account needs attention.
Recommended workflow
- Check the official website address before entering credentials, especially when following links from unexpected email.
- Review authorized users and recovery methods and remove access that is no longer required.
- Use a secure transfer method agreed with support if temporary access is necessary, then revoke that access after the task is complete.
Use unique passwords stored in a trusted password manager and enable additional authentication where the relevant service supports it. Keep recovery details current, protect the email address used for account recovery and review access granted to former colleagues or contractors. Shared company access should use individual user accounts with suitable permissions whenever available.
A useful support request explains the problem without exposing secrets. Include service references, error messages and timestamps, but remove passwords, private keys, session cookies and API tokens from screenshots or logs. If a secret has already been exposed, rotate it through the appropriate control panel and tell support what happened. Changing a client-area password does not automatically rotate every hosting, database or mailbox credential.
