Old password rules, at least one capital, one number, one symbol, changed every 30 days, produced passwords like "Summer2025!" on sticky notes. Current guidance from security bodies is different, and easier on everyone.
What to require
- Length over complexity. A passphrase of three or four random words is both stronger and easier to remember than a short complicated password.
- Unique passwords for every service. Reuse is the real danger: one breached website exposes every account that shares the password.
- Two-factor authentication on email, hosting, domain, banking and admin accounts, at minimum.
- Block known-breached and common passwords where the system allows it.
What to stop doing
- Routine forced changes with no reason. Change a password when there is a sign it was exposed, or when someone leaves.
- Hints and security questions that anyone can research.
- Sharing passwords by email or chat.
Make it practical: a password manager
A company password manager generates long unique passwords, fills them in automatically and lets you share access to shared accounts without revealing the password itself. It also makes offboarding straightforward.
Shared and service accounts
List every shared account (social media, suppliers, hosting, domain registrar), store them in the password manager, and decide who owns each one. Change them when anyone with access leaves.
For servers
Use SSH keys instead of passwords for server logins; see SSH keys explained. Store database and API credentials in configuration that is not in your code repository.
At IDX
The IDX client area supports two-factor authentication. Turn it on for every person with access to your account, because whoever controls the account controls your domains, hosting and email.
IDX on digital infrastructure
Back to blog →