Team access and two-factor authentication: Secure shared workflows
· PoolByte Technology
Most of the time, a website's security is compromised not by a vulnerability in the server, but by a compromised account. Someone with access to the domain panel can change the DNS records and redirect your site and emails elsewhere. Someone entering the hosting panel can delete files, and someone entering the management panel can change the content. These accounts are all digital keys to your business. Personal accounts and two-step verification are the most effective ways to protect these keys.
Agencies, freelance developers and new teammates working on projects need these keys. The problem is how access is granted: a single admin password sent from WhatsApp becomes an unknown risk that is still in their possession years later.
Map your accounts
The first step is to collect all accounts related to your site in one list:
- Customer panel and DNS management where the domain name is registered
- Hosting and cPanel account
- Website administration panel
- Corporate email accounts
- CDN, payment provider and email delivery service
- Search Console, Analytics and tag manager
- Social media and business profiles
For each account, write down the owner, recovery email, and who has access. Critical accounts must be opened with a business-controlled address, not an employee or agency's personal email. We have also discussed the risks on the domain side in our domain security guide.
Give individual access instead of a single password
Wherever possible, create a personalized account rather than a common administrator password. Website administration panels have roles such as editor, writer, or administrator; It is not necessary to grant full administrative privileges to a person who will enter content. Tools like Search Console and Analytics also allow you to add the user with their own account and limited authority.
On the hosting side, you can create separate FTP or SFTP accounts for file access and limit them to a specific folder. Using a key-based connection completely eliminates password sharing; Details are in our SFTP guide.
The biggest benefit of a personalized account is that you can turn off access for only that person when the job is done. In the case of a shared password, closing access means disrupting the work of everyone who knows the password at the same time.
Turn on two-step verification
Two-step verification (2FA) requires a second piece of proof in addition to the password during login. Even if the password is somehow obtained, the account cannot be entered without the second step. Methods vary depending on security level:
- The code sent via SMS is better than nothing; however, it is weaker against attacks such as SIM card cloning.
- Timed codes generated by authentication applications are a good balance for most uses.
- Hardware security keys and passkeys provide the strongest protection against fake login pages.
Prioritize according to the criticality of the account: domain panel, email and hosting account should be at the top of the list. Keep the backup codes provided during installation in a safe place; These are the ways to return to the account when the phone is lost.
Keep recovery information up to date
The weakest point of an account is often the way to reset the password. The recovery email may be from someone who has left work, and the recovery phone may be a line that is no longer in use. In this case, the account remains open to hijacking and the real owner cannot get it back when he loses access.
For critical accounts, change the recovery address to a common and monitored address of the business. Also check that the domain contact email is working and incoming notifications are being read.
Share passwords in a safe place
If there is access that must be shared, do it through a team-enabled password manager rather than a messaging app or email. The password manager lets you see who has access to which record and revoke access with one click. It also makes it easy to use long, random and different passwords for each account.
When a project is completed or work with a partner ends, remove any access you gave them and change any shared passwords.
Review access regularly
A few times a year, open your account list and check users one by one. If it's a user you don't recognize, an administrator account that hasn't been used for a long time, or a forgotten API key, remove it. Also verify in this check that two-step verification is turned on for all critical accounts. Include security notifications, new device login alerts, and administration panel registrations as part of this control.
Frequently asked questions
If my phone is lost, can't I log into my account due to two-step verification?
If you kept the backup codes provided during installation, you can log in with them. That's why it's important to keep backup codes separate from passwords and in a safe place. If possible, also define a second verification method.
Should I give my agency full admin rights?
Start with the lowest authority required for the job. If extended authorization is required temporarily, reduce the authorization or close the account at the end of the job. Ownership of the domain name and email account must remain with the business in all cases.