MFA, Strong Passwords and Account Recovery: A Hosting Security Checklist

Your domain registrar account is the single most valuable target an attacker can hit. With access to it, someone can transfer your domain away, point your DNS at their own servers, intercept your email, and lock you out — all before you've finished your morning coffee. Your hosting control panel is a close second: it holds your website files, databases, and email.

The good news: securing both accounts is a one-afternoon job, and most of it is free. This checklist walks you through it in four steps — passwords, multi-factor authentication, recovery options, and a final lockdown — based on current guidance from NIST (the US National Institute of Standards and Technology) and CISA (the Cybersecurity and Infrastructure Security Agency). No security degree required.

Why Your Registrar Account Is the Keys to the Kingdom

Think about what lives inside your registrar account. It's not just a billing profile — it's the control room for your entire online presence.

What an attacker can do with registrar access

With your registrar login, an attacker can:

• Transfer your domain to another registrar — once it's gone, getting it back is a slow, painful dispute process.
• Change your nameservers or DNS records — redirecting your website visitors to a fake site, or your email to their inbox.
• Disable privacy protection — exposing your personal contact details.
• Turn off auto-renew — letting your domain expire so they can grab it.

Domain hijacking is rare for small sites, but when it happens the damage is total: your website, your email, and your brand, all gone in one move. ICANN's own security guidance treats registrar-account compromise as one of the highest-impact risks a domain owner faces.

Why hosting panels are targeted too

Your hosting account holds the website itself — files, databases, email accounts, backups. Attackers who get in typically install malware, send spam from your domain (which gets you blocklisted), or use your server as a launchpad for attacks on others. A compromised hosting account can also be the route to your registrar account, if you reuse passwords between the two — which brings us to step one.

Step 1 — Fix Your Passwords First

Everything below rests on this step. MFA helps enormously, but a strong, unique password is still the foundation.

What NIST actually recommends in 2025

NIST published Revision 4 of its Digital Identity Guidelines (SP 800-63B) in July 2025, and it overturns most of what people were taught about passwords:

• Length beats complexity. Minimum 8 characters, but 15+ is recommended when a password is your only factor. A long passphrase like correct-horse-battery-staple is far harder to crack than P@ssw0rd! — and easier to remember.
• No forced complexity rules. Requiring uppercase + numbers + symbols doesn't help; it just makes people write passwords down or reuse predictable patterns. NIST says verifiers shall not impose composition rules.
• No periodic rotation. Forcing a password change every 90 days is officially dead — NIST says don't do it. Change passwords only when there's evidence of compromise.
• No security questions. "What was your first pet's name?" is guessable and researchable. NIST bans knowledge-based authentication for password setup.
• Screen against breached lists. Services should check new passwords against known-compromised lists — and you should do the same for your existing ones (more below).

The practical takeaway: stop trying to memorize Tr0ub4dor&3-style passwords. Use long, unique passphrases — and let a password manager handle the remembering.

Use a password manager — the only realistic way to have unique passwords everywhere

Here's the uncomfortable math: the average person has over 100 online accounts. Nobody memorizes 100 unique 15-character passwords. The only people who actually achieve "unique password per site" use a password manager.

A password manager generates long random passwords, stores them encrypted, and fills them in for you. NIST's 2025 guidelines effectively assume you're using one — they require services to support passwords up to 64 characters and to allow pasting into password fields, specifically to accommodate manager-generated passwords.

Pick any reputable manager (Bitwarden, 1Password, Apple's or Google's built-in managers all work), and start with your two most important accounts: your email and your registrar/hosting logins. Migrate the rest over time.

Check whether your passwords are already breached

Before you set new passwords, check whether your current ones are already in criminals' hands. Have I Been Pwned lets you enter your email address and see every known data breach it's appeared in. If your registrar email shows up, assume the password you used there is compromised too — change it immediately, and anywhere else you reused it.

NIST requires services to screen new passwords against breached lists (the HIBP database holds over 900 million compromised passwords). You doing the same check manually is the user-side equivalent.

Step 2 — Turn On Multi-Factor Authentication (MFA)

A password alone is one factor — something you know. MFA adds a second factor — something you have (your phone, a security key) or something you are (fingerprint, face). Even if an attacker steals your password, they can't get in without that second factor.

If your registrar or host offers MFA, turn it on today. It's the single highest-impact step on this checklist.

MFA methods ranked: SMS vs authenticator app vs passkeys

Not all MFA is equal. Here's how the common methods stack up, from weakest to strongest:

CISA calls FIDO/WebAuthn-based authentication (passkeys and hardware keys) the gold standard for MFA, and NIST requires phishing-resistant authentication at its highest assurance level. But any MFA beats no MFA — don't let the perfect be the enemy of the good.

Why SMS codes are the weakest option

SMS-based codes have a specific, well-documented weakness: SIM swapping. An attacker calls your mobile carrier, impersonates you, and gets your number transferred to their SIM card. From that moment, your SMS codes go to them. NIST marks SMS as "restricted" — permitted, but not recommended — and CISA explicitly excludes it from phishing-resistant MFA.

If SMS is the only MFA your registrar offers, still enable it (it stops basic password-guessing attacks). But if an authenticator app or security key option exists, use that instead.

Setting up an authenticator app (TOTP) — the practical sweet spot

For most people, an authenticator app is the right balance of security and convenience:

1. Install an app — Google Authenticator, Microsoft Authenticator, Authy, or your password manager's built-in TOTP feature.
2. In your registrar/hosting account, go to security settings and choose to enable two-factor or authenticator-app authentication.
3. Scan the QR code shown on screen with the app. A 6-digit code appears, refreshing every 30 seconds.
4. Enter the current code to confirm setup.
5. Save the backup codes the service shows you (see Step 3 — this is critical).

From now on, logging in needs your password plus the current code from the app. An attacker with only your password gets nowhere.

Passkeys and hardware keys — the phishing-proof upgrade

Passkeys (and hardware security keys like YubiKeys) are the strongest option because they're phishing-resistant by design. The private key never leaves your device, and it's cryptographically bound to the legitimate website's domain — your device simply will not authenticate on a fake lookalike site, no matter how convincing it looks. Real-time phishing toolkits that can relay SMS and TOTP codes in under a second are useless against them.

If your registrar or host supports passkeys or FIDO2 security keys, consider enrolling at least two devices (e.g., your phone and a hardware key kept somewhere safe), so losing one doesn't lock you out.

Step 3 — Secure Your Recovery Options

MFA is powerful, but it creates a new risk: locking yourself out. Recovery options are your safety net — but they're also an attacker's back door. Treat them with the same care as the password itself.

Save backup/recovery codes somewhere safe

When you enable MFA, the service gives you a set of one-time backup codes (usually 8–10). These let you log in if you lose your phone or authenticator app.

• Do save them somewhere secure and offline — printed on paper in a safe place, or in your password manager's secure notes.
• Don't store them in your email inbox, a plain text file on your desktop, or a screenshot in your photo gallery. If an attacker gets your email, they get your recovery codes too.

Test one code after setup (most services let you verify without consuming it, or consume just one) so you know the process works before you need it in a panic.

Keep your account email secure — it's the master key

Almost every "forgot password" flow ends at your email inbox. That makes your email account the master key to everything else — registrar, hosting, bank, all of it.

• Your email account needs its own strong unique password and MFA, before anything else.
• If you use one email for everything, consider a dedicated address for registrar/hosting accounts, so a breach elsewhere doesn't cascade.
• Never use an email address tied to a domain you might lose (like an old work address) as the recovery email for your registrar account. If you lose the domain, you lose the recovery path — a classic catch-22.

Remove old phone numbers and stale recovery methods

Go through your account's recovery settings and remove anything outdated: old phone numbers you no longer control, backup email addresses you don't check, authenticator apps on phones you sold. Every stale recovery method is a potential way in for someone else — a recycled phone number is a particularly common attack vector.

Step 4 — Lock Down the Rest

With the big three done, finish with these quick wins:

Review active sessions and authorized devices

Most account dashboards show where you're currently logged in. Look for sessions you don't recognize — an unfamiliar location or device is a red flag. Log out everything you don't need; you can always log back in.

Turn on login alerts if available

Many registrars and hosts can email or message you when someone logs in from a new device or location. Enable these notifications. They're noisy for about a week, then they become a quiet early-warning system.

Don't reuse the registrar password anywhere else

This deserves its own line because it's the most common failure. Your registrar and hosting passwords must be unique — used nowhere else, ever. Credential-stuffing attacks (trying leaked passwords from one breach on other sites) are automated and constant; the Verizon Data Breach Investigations Report consistently finds stolen credentials behind the large majority of web-application attacks. A password manager makes uniqueness effortless.

The 2-Minute Emergency Plan (If You Suspect a Breach)

If something feels wrong — an unexpected login alert, DNS changes you didn't make, a transfer you didn't authorize — act fast, in this order:

1. Change your password immediately, from a device you trust.
2. Revoke all active sessions in the account dashboard.
3. Check your DNS records and nameservers — revert anything you didn't change.
4. Check whether a transfer was initiated — most registrars show pending transfers; cancel any you didn't start.
5. Contact support right away and tell them you suspect unauthorized access. Ask them to place a temporary lock on transfers.
6. Check your email account too — if the attacker got in via email compromise, the registrar is just the start.

Speed matters more than perfection here. Lock the account first, investigate second.

The Complete Checklist

Print this, or copy it into your notes app, and work through it top to bottom:

Twelve boxes. Most people finish in under an hour — and the peace of mind lasts as long as you own the domain.

Frequently Asked Questions

Is SMS two-factor authentication better than nothing?

Yes — but only just. SMS codes stop automated password-guessing and credential-stuffing attacks, which are the most common threats. But SMS is vulnerable to SIM swapping, where an attacker transfers your number to their own SIM. NIST classifies SMS as "restricted" and CISA excludes it from phishing-resistant MFA. If your registrar offers an authenticator app or security-key option, choose that instead. If SMS is the only option, enable it anyway — then push for better.

What's the difference between MFA and 2FA?

Two-factor authentication (2FA) is a subset of multi-factor authentication (MFA): 2FA means exactly two factors (usually password + code), while MFA means two or more. In practice the terms are used interchangeably, and enabling "2FA" on your registrar account is exactly what this checklist recommends.

I lost my phone with my authenticator app. Am I locked out forever?

Not if you prepared. This is what the backup/recovery codes from Step 3 are for — enter one at login instead of the app code, then set up the authenticator on your new phone. If you didn't save backup codes, you'll need to go through the provider's manual identity-verification process, which is slow by design. Save the codes before you need them.

Are passkeys really safer than an authenticator app?

Yes, meaningfully so. Authenticator-app codes can be phished in real time — an attacker relays the code you type on a fake site to the real one within seconds. Passkeys can't be relayed: the private key never leaves your device and is cryptographically bound to the legitimate domain, so authentication on a lookalike site simply fails. CISA designates passkeys (FIDO2/WebAuthn) as phishing-resistant; TOTP codes are not.

Should I use the same MFA method for every account?

Use the strongest method each service supports. For your registrar, hosting, and email — the three accounts that control everything else — prefer an authenticator app at minimum, and passkeys or a hardware key if available. For low-risk accounts, SMS or email codes are acceptable. Match the protection to the value of what's behind the login.

How often should I change my passwords now?

Only when there's a reason: a known breach involving that service, a Have I Been Pwned alert on your email, a lost device, or suspicious account activity. NIST's 2025 guidelines explicitly say not to rotate passwords on a schedule — forced rotation pushes people toward weaker, predictable passwords. A strong unique password plus MFA doesn't expire.

Your domains are only as safe as the account that controls them. Work through the checklist above today — start with a password manager and MFA on your email and registrar accounts, and your most valuable digital assets go from the weakest link to the strongest one. New to domains entirely? Our domain registration guide covers the basics of getting started securely.