Locking down logins

A stolen or guessed password is the easiest way in. Make logins hard to abuse.

Passwords

• Use a password manager and a unique password for every account.
• Length beats complexity: a 16-character passphrase is far stronger than P@ssw0rd!.
• Never reuse the password from your email anywhere else. Your email is the key to resetting everything.

Multi-factor authentication (MFA)

MFA asks for a second proof, usually a 6-digit code from an authenticator app. Even with your password, an attacker can't sign in. Turn it on for your registrar, hosting panel, email and CMS first.

SSH keys instead of passwords

For servers, use key-based login and turn passwords off entirely:

ssh-keygen -t ed25519
ssh-copy-id user@your-server

Then set PasswordAuthentication no in /etc/ssh/sshd_config and restart SSH. Keep a second session open while you test, so you don't lock yourself out.

Limit attempts

Rate limiting and temporary lockouts stop automated guessing. Tools like fail2ban block IPs after repeated failures.

Remove what you don't use

Delete old accounts the day someone leaves, and review admin users every few months.