Chapter 3 · 3.7
Secure passwords and what to do if a password is leaked
A good password is the most important protection for your website and email. This article explains which passwords belong to your package, how to make them secure, and what to do if one is leaked.
Which passwords do you have?
| Password | What for? | Changing it |
|---|---|---|
| My WebOké | Your customer area, and therefore also the button to DirectAdmin. | My WebOké, Mijn Administratie, Inloggegevens |
| DA password | Logging in directly to DirectAdmin and the default FTP account. | Setting or changing your DA password |
| Mailbox | Each email address has its own password. | Changing the password of an email address |
| FTP account | Each additional FTP account has its own password. | Creating and managing FTP accounts |
| Database | The database user for your website. Also found in your website's settings, such as wp-config.php. | Database users, privileges and passwords |
| Your website | For example, the WordPress administrator. You manage this within your website itself. | In your website |
These passwords are separate from each other. If you change your DA password, your mailbox, database and website passwords don't change.
A secure password
- Long: at least 12 characters, preferably more. A sentence made up of four or five separate words is strong yet easy to remember.
- Unique: use each password in only one place. If it's leaked via another website, your package stays secure.
- Not guessable: no name, date of birth, company name or domain name.
- Stored in a password manager, such as Bitwarden, 1Password or your browser's password manager. These can also generate strong passwords for you. In My WebOké, you can do this with Generate next to the DA password.
- Not shared via email, WhatsApp or a note on your screen.
Extra security
- Turn on Two-Step Authentication in DirectAdmin (see Setting up Two-Step Authentication) and use an authenticator app for My WebOké.
- Don't give others access using your own password. Create a separate FTP account for a web developer (see Creating and managing FTP accounts) or a login key with an expiry date (see Login Keys: logging in for scripts and programs).
- Log out on a computer you share with others (see Logging out and closing safely).
Do you think a password has been leaked?
For example, because you received a data breach notification, you see an unfamiliar IP address in the Login History, or email is suddenly being sent in your name. In that case, do the following:
- Change the password immediately. If it concerns DirectAdmin, set a new DA password in My WebOké (see Setting or changing your DA password). This also works if someone else has already changed the old password.
- End all other sessions in DirectAdmin: Profile, Sessions tab, END ALL OTHERS (see Logging out and closing safely).
- Check the Login History for unfamiliar IP addresses (see Login History: who logged in and when?).
- Check the Login Keys and remove any keys you don't recognise (see Login Keys: logging in for scripts and programs).
- Check your FTP accounts and remove any accounts you don't recognise (see Creating and managing FTP accounts).
- Check your email: check Forwarders for any forwarding to an unfamiliar address, and change the passwords of your mailboxes (see Forwarders: forwarding mail to another address and Changing the password of an email address). If spam is being sent from your address, read What to do if your e-mail address has been misused.
- Have your website scanned for malware with Imunify360 (see Imunify360: scanning your website for malware). If your website has been hacked, follow My website has been hacked: step-by-step plan.
- Turn on Two-Step Authentication (see Setting up Two-Step Authentication).
- Also change the password anywhere else where you used the same password.
Please note: After changing a mailbox password, also update the password in your email program on your computer and phone. If a device keeps trying with the old password, the server will block your IP address after a while (see Solving login problems).
Can I also do this in My WebOké?
Yes. You can set your DA password in My WebOké without knowing the old one: My Products, Admin, Change DA password block. The new password applies immediately, including for the default FTP account.
Tip: Not sure whether something's wrong? Create a ticket via the Support centre. We can check the server logs with you.