A small website has more passwords than it seems: the Enhance panel, WordPress, each email address, FTP, the database, your registrar account. Attackers don't guess them one by one: they try passwords leaked from other hacked websites. If you use the same password everywhere, it only has to be stolen once.
What you'll achieve
- know which passwords you have and where to change each one;
- have a long, unique password for each, kept in a password manager;
- turn on two-factor authentication where it matters most.
The passwords of a website hosted at NBT Host
| What | Where to change it | Guide |
|---|---|---|
| Enhance, the hosting panel | in Enhance, from the account menu, top right | Your Enhance password and two-factor authentication |
| NBT Account (services, invoices, card) | no password: you sign in with a link sent by email | NBT Account: how to log in and what you'll find |
| WordPress, each user | in WordPress, under your profile, or from Enhance, under “WordPress users” | WordPress users: roles, access and cleanup |
| Each email address | in Enhance, under “Emails” | How to create an email account in Enhance |
| FTP accounts | in Enhance, on the website's page | Encrypted FTP (FTPS) with FileZilla: account and connection details |
| The database user | in Enhance, the “Databases” tab, then also in wp-config.php | Creating a MySQL database and user |
| Your registrar account, if your domain isn't with us | at the company you got your domain from | — |
For your NBT Account, what matters is the password of the email you sign in with: anyone who can read your email can request the link.
What a good password looks like
- Long: at least 14–16 characters. Length matters more than odd symbols.
- Unique: one for each account. No website password is ever reused for your personal email or your bank.
- Generated, not invented:
Firma2026!or your child's name with their birth year are among the first ones tried. A password manager generates random passwords and remembers them for you.
An easy-to-remember alternative, for passwords you type often: four or five unrelated words, for example lampa-zebra-cartof-nisip-vioara.
The steps
A. Use a password manager
- Choose a password manager. Modern browsers (Chrome, Safari, Firefox, Edge) have one built in, synced between your computer and phone; there are also standalone apps, free or paid.
- Protect the manager with a long master password that you don't use anywhere else, and with two-factor authentication.
- Add all the passwords from the table above to it, one by one.
B. Change old or reused passwords
- Start with the most important ones: the email you use to sign in to your NBT Account and Enhance, then Enhance, then the WordPress administrators.
- For each one, generate a new password in the manager, set it in place of the old one and save it.
- For the database user, also put the same new password in
wp-config.php(for WordPress), otherwise the website stops with “Error establishing a database connection”. - For email addresses, update the password on your phone and in your email app too, otherwise the server rejects the login, and after several failed attempts your IP address may be blocked temporarily.
C. Check whether one of your addresses appeared in a data breach
- Open https://haveibeenpwned.com and enter your email address. The site tells you whether the address appeared in databases stolen from other services.
- If it did, change the password everywhere you used the old one.
D. Turn on two-factor authentication
Two-factor authentication (2FA) asks for a code from your phone in addition to your password. A stolen password is no longer enough.
- Enhance: from the account menu, with “Enable two-factor authentication” (the steps are in Enhance password and two-factor authentication).
- WordPress: with a two-factor authentication plugin, at least for administrators (see WordPress users: roles, access and cleanup).
- The personal email you use to sign in to your accounts (Gmail, Outlook, Yahoo): from the account's security settings.
- Your domain registrar, if your domain isn't with us: anyone who gets in there can transfer your domain.
Use an authenticator app instead of SMS codes, wherever you can. Where a service gives you backup codes, save them in your password manager. Enhance doesn't provide backup codes: turn on account backup in your authenticator app, so you don't lose your codes along with your phone.
What you never do
- Never send passwords over WhatsApp or email, not even to us. We never ask for your password: for access, we use a temporary user or delegated access (see Enhance access for other people).
- Never enter your password from a link received by email without checking the page address (see Fake emails about your hosting or domain).
- Never keep passwords in a
parole.txtfile or in a photo on your phone.
If something doesn't work
- You lost the phone with your authenticator app. Use a backup code, where you have one. For Enhance, email or call us from the phone number or email address used for your order: once we've confirmed it's you, we turn off 2FA and you turn it back on.
- After you change your email password, your phone keeps asking for it. Update it in the email account settings on your phone. If you can't sign in to any of our services anymore, your IP address may be blocked after too many failed attempts: send us your IP.
- You suspect someone used your password. Change it right away, then follow How to tell if your website has malware to see whether anything changed on your website.