How to Secure Your Computer: A Practical Security Guide for Website Developers and Hosting Users

If you manage websites, hosting accounts, domains, email accounts, databases, or servers, your computer is more than just a personal device.

It is a key to your digital infrastructure.

If your computer becomes compromised, an attacker may not need to “hack” your hosting server directly. They may simply steal the credentials, cookies, SSH keys, API tokens, FTP passwords, cPanel credentials, or session information already available on your computer.

This is why securing your own computer is just as important as securing the server you manage.

Modern attacks increasingly focus on stealing identities rather than breaking into systems. Infostealer malware, phishing, malicious browser extensions, fake software installers, stolen session cookies, and credential leaks can give attackers everything they need to log in as you.

For website developers and hosting users, one compromised workstation can potentially lead to multiple compromised websites or hosting accounts.

Here is a practical security checklist for keeping your everyday computer safer.

1. Understand the Most Important Rule: Your Computer Is Part of Your Security Infrastructure

Many people think:

“My server is secure, so my websites are secure.”

That isn’t necessarily true.

Consider this situation:

You have access to:

WHM
cPanel
SSH
FTP/SFTP
Git repositories
Cloudflare
Domain registrars
DNS management
Email
Database servers
Hosting billing systems
Backup systems

Now imagine that malware running on your computer steals your browser cookies, saved credentials, or SSH keys.

The attacker may not need to exploit your server at all.

They can simply use the credentials you already have.

For administrators and developers, endpoint security is therefore part of server security.

2. Keep Your Operating System Updated

Operating system updates are one of the simplest and most effective security measures.

Enable automatic security updates whenever possible.

Keep updated:

Windows
macOS
Linux desktop distributions
Device drivers
System components
Security software

Do not continuously postpone security updates because they are inconvenient.

Security vulnerabilities are regularly discovered in operating systems and applications. Attackers actively look for machines that have not received available security fixes.

CISA recommends keeping software and operating systems up to date and enabling automatic updates where possible.

For Windows users

Make sure:

Windows Update ? Automatic Updates

is enabled.

Also make sure Microsoft Defender and its security intelligence updates are current.

3. Keep Your Browser Updated

Your browser is one of the most frequently used applications on your computer—and one of the most important security boundaries.

Keep Chrome, Edge, Firefox, Safari, or whichever browser you use updated.

Do not ignore:

“Restart to update”

for weeks.

Modern browsers contain security protections against malicious websites, phishing, dangerous downloads, exploit attempts, and other attacks.

A browser that is several versions behind can expose you to vulnerabilities that have already been fixed.

4. Be Careful About Browser Extensions

Browser extensions can have enormous access to your browsing environment.

A malicious or compromised extension may potentially access sensitive information depending on the permissions it receives.

For a developer or hosting administrator, this can be particularly dangerous.

You may be logged into:

WHM
cPanel
Cloudflare
GitHub
Google Workspace
Email
Domain registrar
Payment systems

Ask yourself:

Does this extension really need access to my websites and browsing data?

Remove extensions that you:

Don’t use
Don’t remember installing
No longer trust
Don’t recognize
Installed only temporarily

Install extensions only from reputable sources and periodically review your installed extensions.

5. Password Managers Are Not the Enemy

There is a common belief that:

“Never save passwords in your browser.”

That advice is understandable, but it is too simplistic for modern security.

A reputable password manager can be significantly safer than using the same password—or variations of the same password—across dozens of websites.

CISA recommends using long, random, unique passwords and a password manager to generate and store them.

The important question is not:

“Are my passwords stored?”

The more important question is:

“How are they protected?”

A good password manager should allow you to use:

Unique passwords for every service
Long randomly generated passwords
Strong encryption
MFA
Biometric or device authentication
Password breach detection
Secure synchronization

Modern browsers also protect stored credentials using operating-system security mechanisms. For example, Microsoft documents encryption protections for passwords stored in Edge.

But there is an important warning

A password manager does not protect you from an infected computer.

Infostealer malware can target browser credentials, cookies, session information and other sensitive data. Microsoft has documented malware campaigns specifically designed to steal browser credentials and session cookies.

Therefore:

Password manager + secure computer + MFA

is much stronger than simply refusing to save passwords.

6. Use Passkeys Whenever They Are Available

Passkeys are becoming an important replacement for traditional passwords.

Instead of typing a password, you authenticate using your device’s security mechanism, such as:

Fingerprint
Face recognition
Device PIN
Hardware security key

Passkeys are designed to resist many forms of phishing because the authentication credential is cryptographically tied to the legitimate website.

Google supports passkeys through Google Password Manager across major desktop and mobile platforms.

For important accounts, prefer:

Passkey > phishing-resistant MFA > traditional password alone

where supported.

7. Enable Multi-Factor Authentication Everywhere Possible

If an account supports MFA, enable it.

This is particularly important for:

Email
WHM
cPanel
Cloudflare
Domain registrar
GitHub/GitLab
Google Workspace
Microsoft accounts
Hosting billing systems
Server management systems
Banking and payment accounts

But not all MFA methods provide the same level of protection.

Where available, prefer:

Passkeys
Hardware security keys
Authenticator applications
SMS-based authentication

SMS is better than having no second factor, but it is generally not the strongest option.

Microsoft has reported that phishing-resistant MFA can prevent the overwhelming majority of password-based identity attacks, even when an attacker knows the username and password.

8. Never Reuse Your Hosting Password

This deserves its own section.

Your hosting password should not be the same password you use for:

Gmail
Facebook
WordPress
Your domain registrar
Another hosting company
Your personal email
Your computer

If another website suffers a data breach and your password is reused there, attackers may try the same credentials against your hosting account.

This is called credential stuffing.

Your WHM/cPanel/hosting password should be:

Unique and used nowhere else.

The same principle applies to your email and domain registrar accounts.

9. Protect Your Email Account Like a Master Key

Your primary email account is often more important than your hosting account.

Why?

Because an attacker who gains access to your email may be able to reset passwords for:

Hosting
Domain registrar
Cloudflare
GitHub
Social media
Payment services
Other email accounts

Your primary email should therefore have:

A unique password
MFA or a passkey
Recovery information
Security alerts enabled
Regular login/activity monitoring

Think of your email account as the master key to your digital life.

10. Do Not Trust Emails Just Because They Look Professional

Modern phishing emails can look extremely convincing.

An email can contain:

Company logos
Correct branding
Professional formatting
Realistic signatures
Fake support tickets
Fake invoices
Security warnings
Password expiration notices
Domain renewal notices
“Your account has been suspended” messages

Never assume:

“It has a company logo, therefore it is legitimate.”

Instead, verify the request independently.

For example, if you receive:

“Your Cloudflare account has been suspended. Click here to restore access.”

Do not immediately click the link.

Open your browser and manually visit the official website.

The same applies to:

Hosting companies
Domain registrars
Banks
Google
Microsoft
GitHub
Payment providers

11. Check the Website Address Before Logging In

Phishing websites can look almost identical to legitimate websites.

Before entering credentials, check the domain carefully.

For example:

example.com

is completely different from:

example-login.com

or:

example.com.some-random-domain.com

or:

examp1e.com

Attackers frequently use domains that visually resemble legitimate websites.

For highly sensitive services, consider using bookmarks or manually entering the known official address rather than following login links from emails.

12. Do Not Install Random “Tools” From the Internet

This is one of the biggest risks for developers.

You may search for:

PDF converters
Video converters
Cracked software
Windows activators
Drivers
WordPress tools
SEO software
FTP clients
SSH utilities
“Free” premium plugins
Theme generators
AI tools
Browser utilities

and download software from an unknown website.

This is dangerous.

A program can appear to work normally while silently installing an infostealer or remote-access malware.

Download software from:

The vendor’s official website
Microsoft Store
Apple App Store
Trusted package repositories
Official GitHub/GitLab repositories when appropriate

Be particularly suspicious of:

“Disable antivirus before installing.”

That is an enormous red flag.

13. Avoid Pirated and Cracked Software

Cracked software is one of the easiest ways for attackers to distribute malware.

A “free” application may contain:

Password stealers
Remote access trojans
Cryptominers
Ransomware
Browser stealers
Keyloggers

For someone who manages hosting accounts, the risk is much greater because the computer may contain highly valuable credentials.

Saving money on a software license is not worth losing control of your hosting infrastructure.

14. Treat Unexpected Browser Pop-ups as Suspicious

If a website suddenly displays:

“Your computer is infected!”

or:

“Your Windows license has expired!”

or:

“Your browser is outdated!”

or:

“Click Allow to verify you are human.”

Stop.

Do not panic.

Do not install anything.

Do not call a phone number displayed by the website.

Do not grant remote access.

Close the tab/window and investigate using a trusted source.

Websites cannot normally determine that your computer has a virus simply because a pop-up says so.

15. Be Careful With “Allow Notifications”

Many websites ask:

“Allow notifications?”

Users often click Allow without thinking.

A malicious website can abuse browser notifications to display fake:

Antivirus warnings
Security alerts
Cryptocurrency scams
Fake Microsoft warnings
Fake Google warnings
Fake update notifications

Only allow notifications for websites that genuinely need them.

Periodically review browser notification permissions and remove suspicious sites.

16. Do Not Install Unknown Remote-Access Software

Applications such as remote-support tools can be legitimate and useful.

But if someone contacts you unexpectedly and says:

“Please install this software so I can fix your computer.”

be extremely careful.

Never provide remote access to an unknown person simply because they claim to be:

Microsoft support
Google support
Your hosting provider
Your bank
Your ISP
Your antivirus company

If remote access is genuinely required, initiate the support request yourself and verify the support provider independently.

17. Use Antivirus and Endpoint Protection

Modern operating systems already include security protection.

For Windows users, Microsoft Defender provides built-in protection against many common threats.

Keep it enabled and updated.

Do not install multiple antivirus products simply because you think:

“More antivirus = more security.”

Multiple security products can conflict with each other and do not necessarily provide better protection.

More importantly, antivirus is only one layer.

You still need:

Updated software
MFA
Safe browsing
Secure passwords
Good download habits
Regular monitoring

18. Use a Separate Computer for High-Value Administration

If you manage significant hosting infrastructure, consider separating everyday activities from administrative activities.

For example:

Everyday computer

Used for:

Social media
YouTube
General browsing
Downloads
Personal email
Entertainment

Administrative computer

Used primarily for:

WHM
SSH
Server administration
Domain management
Cloudflare
Git repositories
Production systems

The idea is simple:

The fewer risky activities performed on your administrative computer, the smaller the attack surface.

Microsoft also recommends dedicated PCs for users with access to high-value assets as part of its credential-protection guidance.

For larger organizations, dedicated privileged-access workstations can be an extremely effective security measure.

19. Do Not Use an Administrator Account for Everything

On your everyday computer, avoid running everything with administrator privileges.

Use a standard user account for normal activities where practical.

When administrator privileges are genuinely required, elevate the operation.

This makes it harder for certain types of malware to immediately obtain system-level privileges.

20. Secure Your Computer’s Login

Your Windows/macOS login itself should be protected.

Use:

Strong device password/PIN
Fingerprint
Face authentication
Automatic screen locking

Never leave your workstation unlocked when you walk away.

This is especially important in offices.

Someone does not need sophisticated malware if they can simply sit at your unlocked computer and access your browser, email, hosting panel, or password manager.

21. Secure Your SSH Keys

Developers and server administrators frequently use SSH keys.

Treat SSH private keys like passwords—but potentially even more carefully.

Never:

Send private keys through chat
Upload them to public repositories
Put them inside website files
Store them in publicly accessible directories
Commit them to Git
Share them with customers

Use encrypted key storage and strong passphrases.

Remember:

Private key = authentication credential.

If someone steals it, they may be able to authenticate without knowing your traditional password.

22. Never Put Production Credentials in Source Code

This is extremely important for developers.

Do not put credentials directly inside:

config.php
.env
database.php
settings.php
Git repositories
JavaScript files
public HTML

depending on the application and deployment architecture.

Never commit:

Database passwords
API keys
SMTP passwords
Cloud credentials
SSH private keys
Hosting passwords

to a public Git repository.

Microsoft specifically warns developers not to hardcode passwords, API keys, connection strings, or other secrets in source code.

Use appropriate secret-management and environment/configuration mechanisms instead.

23. Be Careful With Git Repositories

Before pushing a project to GitHub or another Git server, check what you are committing.

A common mistake is accidentally committing:

.env
config.php
backup.sql
database credentials
SSH keys
API keys

Once a secret has been pushed to a repository, simply deleting the file may not be enough because the secret may remain in Git history.

If a secret is exposed:

Treat it as compromised and rotate it immediately.

Do not merely delete the file.

24. Be Careful With FTP

If you manage websites, avoid plain FTP whenever possible.

Prefer:

SFTP
SSH
FTPS where appropriate

Plain FTP transmits credentials without the protection provided by encrypted transport.

Also avoid storing FTP passwords unnecessarily in multiple applications.

25. Be Careful With cPanel and WHM Sessions

For hosting administrators and resellers, browser sessions themselves can be valuable to attackers.

Do not assume:

“I have MFA, therefore I’m completely protected.”

If malware steals an active session cookie, the attacker may potentially use the existing authenticated session without needing the password.

This is one reason endpoint security is so important.

Log out of sensitive systems when they are no longer needed, particularly on shared or untrusted computers.

26. Monitor Your Important Accounts

Security isn’t only about prevention.

Monitor for unusual activity.

Look for:

Unknown login locations
Unknown devices
Password reset emails you did not request
New MFA devices
New SSH keys
New API tokens
Unexpected forwarding rules
New email filters
Unknown administrators
Unexpected hosting account changes
New FTP accounts
New cPanel users
Unexpected DNS changes

If something looks suspicious, investigate immediately.

27. Never Ignore Security Notifications

If Google, Microsoft, Cloudflare, GitHub, your hosting provider, or another service tells you:

“A new login was detected.”

Do not simply dismiss it.

Ask:

Was this me?

If the answer is no:

Change the password.
Revoke active sessions.
Remove unknown devices.
Review MFA settings.
Review recovery information.
Check API keys/tokens.
Investigate the computer from which you normally log in.

28. If You Suspect Your Computer Is Infected, Stop Using It for Administration

This is especially important for hosting users.

Suppose several websites suddenly become compromised and you suspect your hosting credentials were stolen.

Do not immediately log into WHM from the same computer and start changing every password.

If the computer is infected, the attacker may simply capture the new passwords as you type them.

Instead:

Use a known-clean device to change critical credentials.

Then:

Change the hosting/reseller password.
Revoke active sessions where possible.
Enable MFA.
Rotate SSH keys if necessary.
Rotate API tokens.
Change email credentials.
Review account activity.
Scan and investigate the original computer.
Check all websites for backdoors and unauthorized accounts.
Re-secure the workstation before using it for administration again.

29. Remember: Malware Can Steal More Than Passwords

This is one of the most important security lessons today.

People often think:

“I don’t save my passwords, so malware can’t steal them.”

Unfortunately, that’s not necessarily true.

Modern infostealers may target:

Browser passwords
Cookies
Session tokens
Autofill information
Cryptocurrency wallets
Browser profiles
Email credentials
Authentication data
Files
Application data

Microsoft has documented attacks where malware specifically targeted browser profile data and session cookies, allowing attackers to impersonate users without necessarily needing their password.

Therefore:

Typing your password manually is not a substitute for having a clean computer.

30. Keep Your Browser Profile Clean

Periodically review:

Saved passwords
Saved payment methods
Extensions
Notification permissions
Download history
Unknown browser profiles
Signed-in devices
Synced data

Remove anything you don’t recognize.

If you suddenly discover an extension you don’t remember installing, don’t simply ignore it.

Investigate how it got there.

31. Be Suspicious of Urgency

Attackers love urgency.

Messages such as:

“Your account will be deleted in 30 minutes.”

“Your domain expires today.”

“Your server has been suspended.”

“Payment failed—click immediately.”

“Your mailbox is full.”

“Your SSL certificate has expired.”

are designed to make you act before thinking.

Slow down.

Verify independently.

A few extra seconds can prevent a major security incident.

32. Back Up Your Important Data

Security is not only about preventing unauthorized access.

You also need to be able to recover from:

Ransomware
Hardware failure
Accidental deletion
Malware
Lost devices

Keep important files backed up.

For critical business data, maintain backups that cannot simply be deleted by the same account that is compromised.

And periodically test whether your backups can actually be restored.

A backup that has never been tested is only a backup in theory.

33. Secure Your Wi-Fi and Home/Office Network

Your computer is not the only thing that needs protection.

Secure your router:

Change the default administrator password.
Keep router firmware updated.
Use WPA2/WPA3.
Disable unnecessary remote administration.
Use a strong Wi-Fi password.
Review connected devices.
Replace old routers that no longer receive security updates.

If you work from public Wi-Fi, be particularly careful with administrative activities.

34. Don’t Trust USB Devices

Avoid connecting unknown USB drives to your computer.

A USB device can contain malicious files or exploit vulnerabilities.

If someone gives you a USB drive containing:

“Important website backup”

don’t automatically plug it into the computer you use to administer your servers.

Use appropriate security controls and scan files before opening them.

35. Security Is About Layers

There is no single magic security setting.

Good security looks more like this:

Secure device

Updated OS

Updated browser

Endpoint protection

Strong unique credentials

Password manager/passkeys

MFA

Safe browsing habits

Limited privileges

Secure server access

Monitoring

Backups

Each layer reduces the chance that one mistake becomes a disaster.

A Practical Security Checklist for Website Developers

If you develop websites or manage hosting accounts, your minimum checklist should look something like this:

Computer

Operating system automatically updated
Browser automatically updated
Antivirus/endpoint protection enabled
Firewall enabled
Screen automatically locks
Strong device authentication
Unnecessary applications removed
Unknown browser extensions removed
No pirated/cracked software

Accounts

Unique password for every important account
Password manager or secure credential management
Passkeys enabled where available
MFA enabled
Primary email strongly protected
Recovery options secured
Old sessions reviewed
Unknown devices removed

Hosting

WHM/cPanel MFA enabled
Unique reseller/hosting password
SSH keys protected
SFTP/SSH preferred over FTP
API keys protected
Hosting login activity monitored
Unused accounts removed
Unused FTP accounts removed
Backups available and tested

Development

No passwords inside source code
No API keys in Git repositories
.env and secret files excluded where appropriate
Production credentials separated from development credentials
Dependencies kept updated
Unused plugins/themes/scripts removed
Git repositories reviewed before publishing

Email

MFA/passkey enabled
Suspicious emails independently verified
Unexpected attachments avoided
Links checked before logging in
Security alerts monitored
Unknown forwarding rules investigated

The Most Important Lesson

You don’t need to become paranoid about every click on the internet.

But you should become deliberate about what you trust.

The modern attack isn’t always:

“A hacker broke through my server.”

Very often it is:

“Someone stole the administrator’s identity.”

The attacker may obtain that identity through phishing, credential reuse, malware, browser data theft, malicious software, leaked credentials, stolen session cookies, or compromised devices.

For website developers, hosting customers, system administrators, and resellers, the computer sitting on your desk can therefore be one of the most important security boundaries in your entire infrastructure.

Protect the computer. Protect the identity. Protect the accounts. Then protect the server.

Security is not a single product, browser setting, or antivirus application.

It is a habit.

And the best security habit is simple:

TetraHost Bangladesh

The Official Company Blog