Field note
Access hygiene on shared hosting panels
Who should hold cPanel logins, how to retire staff access, and why email-forwarded passwords still cause breaches.
Shared hosting remains common for South African small-business sites. The panel login often doubles as the master key to files, databases, email, and DNS. When that password lives in a WhatsApp chat or a shared spreadsheet, every former freelancer still effectively has the keys.
Create a short access register: person, role, panel username, date granted, date revoked. Prefer separate FTP or SFTP accounts with directory jail for designers who only need the theme folder. Avoid handing out the primary cPanel user for routine content edits when a CMS role will do.
Enable two-factor authentication on the panel and on the CMS whenever the host supports it. Prefer authenticator apps over SMS where both are offered. After any staff or agency change, rotate the primary password and revoke API tokens for deployment scripts.
Email accounts on the same hosting package deserve equal attention. Compromised webmail is a frequent path to password-reset abuse on the CMS. Disable unused mailboxes, and do not forward panel password resets to a distribution list.
During hosting security reviews we walk the access register with the owner, remove stale users, and set a calendar reminder to re-check after each contractor engagement. The habit matters more than any single tool.