MFA and Passwords for Website Owners: The Practical Setup Guide

Most website incidents do not begin with a dramatic technical attack. They begin with a reused password, an old administrator account or a login that should have required multi-factor authentication. For a business website, the accounts around the site matter as much as the code itself.

This guide covers practical account protection for website owners. It is written for teams that manage domains, hosting, WordPress, email, analytics, quote forms and support tools without a full security department.

Start with the accounts that can change the business

Not every login carries the same risk. Prioritize accounts that can redirect visitors, change DNS records, edit website files, read customer enquiries, send email as the company or delete backups. Those accounts deserve the strongest controls first.

• Domain registrar: controls ownership, nameservers and transfer settings.
• DNS provider: controls where website, email and verification records point.
• Hosting or server panel: controls files, databases, mail and backups.
• CMS admin: controls pages, users, plugins, themes and sometimes code.
• Business email: receives password resets, quotes and customer messages.

CISA's small business MFA guidance puts it plainly: strong passwords help, but on their own they are no longer enough to keep accounts safe. Apply that advice first where a single login could disrupt sales, search visibility or customer trust.

Use MFA where account takeover would hurt most

Multi-factor authentication adds a second proof beyond a password. CISA's More than a Password page calls it the extra step that stops a stolen password from opening the door on its own. For business websites, enable MFA on the registrar, hosting, email, CMS administrator, cloud and payment accounts wherever it is offered.

Authenticator apps and hardware security keys beat codes sent by text message. The NCSC's 2-step verification guidance rates text messages as the least secure option, though still far better than no second step at all. Keep backup codes in a controlled location, not in a shared chat or email thread.

WordPress has no second factor built in, so it comes from a plugin. MaxMindSecurity Pro, for example, adds two-factor authentication with an authenticator app or emailed codes, backup codes and a choice of which roles must use it.

After enabling MFA, test recovery. Make sure the business can still reach the account if a phone is lost, an employee leaves or a contractor relationship ends.

Replace shared admin logins with named users

A shared account is convenient until something breaks. If five people use one admin login, you cannot easily tell who installed a plugin, changed DNS, deleted a user or downloaded data. Named accounts make review and removal simpler.

Use role-based access where the platform supports it. WordPress, for instance, has editor, author and contributor roles that cannot install plugins. A content editor rarely needs plugin access. A support person may not need DNS. A developer may need temporary deployment access but not permanent billing access.

When someone leaves, remove the named account instead of changing one shared password and hoping every connected session closes. The same rule applies to agencies and freelancers; see our vendor access checklist.

Make passwords long and unique

CISA's strong password guidance recommends long, random, unique passwords stored in a password manager, with phishing-resistant MFA alongside them. NIST's SP 800-63B sets a minimum of 15 characters for a password used on its own. In practice, the safest workflow for most teams is a password manager that creates one unique password per service.

Do not reuse the same password across hosting, WordPress, email and analytics. If one service is compromised, reuse can turn one exposure into several account takeovers.

Review saved passwords quarterly. Remove logins for old test sites, retired plugins, former agencies and services the business no longer uses.

A simple account review checklist

• List every account that can change the website, DNS, email, code, data or backups.
• Enable MFA on high-risk accounts first.
• Move from shared admin accounts to named users.
• Use unique passwords stored in a password manager.
• Save recovery codes where the business can retrieve them safely.
• Remove accounts for people and vendors who no longer need access.

Start with the registrar, business email and hosting logins, because those three can undo everything else. If you want a second set of eyes on administrator access and account ownership, that review can be scoped within a website security engagement.

Editorial note: this article was prepared with AI assistance and checked against CISA, NIST and NCSC guidance. It is general educational guidance; MFA and strong passwords reduce risk but cannot guarantee that every compromise is prevented.