Start with the accounts that keep the site online
A small website rarely has just one login. You may have separate accounts for the domain registrar, hosting provider, content management system, email service, backups and analytics. Losing access to any of them can interrupt routine work; losing access to a domain or hosting account can make recovery especially difficult. A password manager gives you one place to store those credentials and generate a different password for each account.
Begin by listing the services your site relies on, including accounts you use only occasionally. For each one, note its purpose, the email address used to sign in and who should have access. This simple inventory helps you find forgotten accounts before there is a problem. Keep it in a secure location, not in a public website document.
Set up the manager before changing passwords
Choose a password manager that works on the devices you use and makes it practical to export your data if you need to move later. Look for clear account recovery options and, if others help maintain the site, features for sharing access without sending passwords in messages. Install the manager through its official website or your device’s app store, then learn how it saves, fills and generates passwords.
Protect the manager with a long, unique main password that you do not use anywhere else. If it supports multi-factor authentication, enable it. Store any recovery codes according to the provider’s instructions in a secure place you can reach if your usual device is lost. Before putting every account into the manager, confirm that you can sign in on another device and understand the recovery process. A manager reduces password reuse, but it also makes access to its vault especially important.
Replace reused passwords in a sensible order
Work through your account inventory one service at a time. Start with the email account that receives password resets, followed by your domain registrar, hosting account and site administrator login. Then update backup services, plugins or extensions with separate accounts, and other tools. Use the manager to generate a distinct password for each login. Save the new credential as you change it, and test that it works before signing out of the service.
Do not assume a password change ends every existing session. When an account offers a way to review signed-in devices or active sessions, check for ones you do not recognize and sign out sessions that are no longer needed. Remove accounts for former collaborators where you have permission to do so. These checks are useful even when you have no reason to suspect a breach.
Keep multi-factor authentication and sharing manageable
Turn on multi-factor authentication for important services that offer it, especially email, the registrar, hosting and the password manager itself. Follow each service’s setup and recovery guidance. If possible, avoid relying on a single phone or person for every authentication method: a lost device should not make routine site maintenance impossible. Store backup codes securely and make sure the appropriate site owner knows how to find them.
When more than one person maintains a site, give each person their own account wherever the service supports it. Assign only the access needed for their work. If a shared login is unavoidable, use the manager’s sharing features rather than copying a password into email or chat, and review who can see it when roles change. Document who controls the domain and hosting accounts so a contractor’s departure does not leave the organization locked out.
Make access review part of regular maintenance
A password manager is most useful when its contents stay accurate. During a regular site maintenance check, remove obsolete entries, confirm that saved sign-in pages still match the services you use, and review access for people who have changed roles. Be cautious when autofill does not recognize a page you expected it to recognize: navigate to the service through your usual bookmark or saved address rather than entering credentials into an unfamiliar page.
Finally, practice a small recovery check. Confirm that you can locate the manager’s recovery instructions, the domain and hosting account details, and any backup codes without exposing them to visitors or unnecessary collaborators. The goal is not a complicated security system. It is a dependable way to keep important website accounts distinct, accessible to the right people and recoverable when something goes wrong.
