Website admin passwords, accounts and who has access

An admin login page is tried by automated software thousands of times a day, on every reasonably visible site, regardless of how obscure the business behind it is. This is not personal and it is not a targeted attack — it is the same scanning behaviour covered in why small-business websites get compromised, applied specifically to login credentials rather than to unpatched software.

Why weak passwords are found, not guessed cleverly

Automated tools do not need to guess a password creatively. They try enormous lists of common passwords systematically. Separately, they try credentials leaked from entirely unrelated services elsewhere on the internet. The assumption is a reasonable one: some fraction of people reuse the same password across multiple accounts. A password that is short, common, or reused from another account is functionally an unlocked door. It takes no skill at all on an attacker’s part to find it.

What an actually strong password looks like — and why secure passwords matter

A strong password is long, unique to this one account, and not built from information about the business that is publicly guessable — a business or owner’s name, an address, a memorable date. Length matters more than complexity rules imposed by a form. A long, random passphrase is both stronger and easier for a human to actually remember than a short password forced to include a symbol and a number. A password manager generates and stores a genuinely unique password per account, so nobody has to remember any of them at all. That is worth adopting for exactly this reason.

Why reuse is the single most damaging habit

A password reused across a business’s website, its email, and unrelated personal accounts means a breach at any one of those unrelated services can hand an attacker working credentials for the website. No exploit against the website itself is required at all. This is the single most common way a password compromise happens. It is entirely preventable without any technical skill — simply never reusing a password anywhere.

Every account is a door, not just the main one

An administrator account is the highest-value target. But every account with any level of access is a potential entry point. A compromised low-privilege account can sometimes still be used to escalate further, or to damage the site directly, depending on what that role permits. User roles and permissions covers assigning the narrowest role each person actually needs. This page is about making sure whichever accounts exist are individually well secured.

Reviewing who actually still has access

Accounts accumulate over time. A former employee, a contractor whose project finished months ago, an agency no longer engaged — each one left active is a door nobody is watching. A periodic review of every account with any access to the site, removing anything no longer genuinely needed, is a basic and frequently skipped hygiene step, and it costs nothing beyond the time to actually look.

Where two-factor authentication (and, for some sites, a VPN) fits

A strong, unique password closes the most common route in. Two-factor authentication closes the route that remains even when a password is somehow still compromised — a genuinely different and complementary layer, covered fully in two-factor authentication on the accounts that matter.

Password managers, briefly: how they keep passwords encrypted in a secure vault (not just Windows’ built-in storage)

A password manager generates a long, random, genuinely unique password for every account, and stores it encrypted, so nobody has to remember or reuse anything. It is the single most effective, lowest-effort tool available against the reuse problem described above. Dedicated tools such as NordPass, RoboForm, 1Password or Bitwarden protect that vault with strong encryption, and sync it across every device and browser. That is more thorough than relying only on a browser’s own built-in password storage, or on Windows. The specific product matters less than actually using one consistently. Adopting one across a small team costs little. It removes almost entirely the temptation to reuse a memorable password across multiple logins, which is the single habit responsible for the largest share of credential-based compromises.

Why “security questions” are often weaker than the password itself

Account recovery questions — a mother’s maiden name, a first pet — are frequently answerable from public information or social media. That makes them a weaker link than the password they are meant to back up. Where a platform allows it, disabling easily guessable recovery questions in favour of a password manager’s own recovery process, or two-factor authentication’s backup codes, closes this quieter gap.

What a genuinely suspicious login attempt looks like

Most platforms log recent login activity somewhere in account settings. An unfamiliar location, an unfamiliar device, or a login at an implausible hour are all worth investigating immediately, rather than dismissed. This log is one of the few places an attempted or successful unauthorised access actually leaves a visible trace, before any other symptom appears.

Why staff training matters as much as the technical controls

A strong password policy achieves little if staff are not shown why it matters, and how to actually use a password manager day to day. A short, practical explanation, rather than a policy document nobody reads, is what actually changes behaviour on a small team.

A final, practical starting point

Rolling out a password manager for the handful of accounts covered above this week, rather than waiting for a broader security review to schedule it, closes a meaningful share of the risk immediately.

Where to go from here once an account is compromised

What actually happens once an account is compromised, and the order of operations that limits the damage, is a question for whoever is managing the site’s ongoing security. They need a plan for it before it is needed. Confirming this is being actively managed is exactly what a considered engagement should include — see website design services.