Your hosting client area controls services, invoices, support tickets, domains, and sometimes login links to other panels. Treat it as a sensitive account.
Use a Strong Password
Use a unique password stored in a password manager. Do not reuse a CMS or email password.
Your email account is part of the same security boundary because password resets and invoices arrive there. Protect it with a different password and two-factor authentication. Never send a client-area password in a support ticket or give it to a contractor; create a separate authorised user when delegation is available.
Enable Two-Factor Authentication
If available, enable two-factor authentication. Save recovery codes somewhere secure.
Store recovery codes outside the device that generates your codes. Before replacing a phone, transfer the authenticator or add the replacement method and test it. If several people need access, each person should use their own account and second factor rather than sharing one code generator.
Review Contacts and Managers
Remove people who no longer need access. Give extra users only the permissions they need.
Check names, email addresses and notification recipients at least quarterly and whenever a colleague or supplier leaves. Removing a client-area user may not revoke separate WordPress, SFTP, SSH, mailbox or control-panel credentials, so review those systems as well.
Keep Billing Details Current
Expired payment methods can lead to missed renewals or interrupted services.
Confirm that renewal notices reach a monitored mailbox and that more than one responsible person knows when important domains and services renew. Treat an unexpected invoice, password-reset message or new-service notice as a security signal rather than simply deleting it.
Check Sessions and Support Requests
Sign out on shared devices and avoid accessing billing controls over untrusted public Wi-Fi. Read recent tickets and service changes for activity you do not recognise. TekLan support will not need your password to inspect your account.
If You Suspect Access
Change the client-area and email passwords from a trusted device, enable or reset two-factor authentication, remove unknown users and contact support. Include approximate times and the changes you observed, but do not send passwords or recovery codes. Then review affected domains, DNS, websites and payment details rather than assuming the account page was the only target.
Protecting the client area protects the services attached to it.
