When choosing a password, you should avoid using passwords that:

• are very common (e.g. dictionary words, the word “password” in any language, “abc123”, “letmein”, and “newpass”);
• are a simple word or phrase, combined with the current, or a recent year (e.g. “2014pass” and “new2015”)
• contain sequential numbers or keyboard patterns (e.g. “123456”, “qwerty”, “ytrewq”, “aassdd”, and “qweasd”);
• are based on a word with some letters replaced by similar-looking symbols (e.g. “p@ssw0rd” and “1l0v3y0u”);
• contain or are similar to your username, email address, or domain;
• are based on personal information which can be obtained via social engineering tactics;
• are used elsewhere (e.g. for other email services, forum registrations, online banking);

The guidelines listed below will help you choose a strong (good) password:

• use a trusted password generator tool (e.g. the Random password generator available in the hosting Control Panel);
• choose a password that is at least 8 characters long;
• include a passphrase (a string that consists of multiple words), punctuation marks, numbers, and a mix of capital and lowercase letters;
• include phonetic replacements (e.g. ‘2b’ for ‘to be’).

After you choose a strong (good) password, it is important to keep that password secure. Here are some tips on how to achieve this:

• use password manager software;
• never tell anyone your password, especially via email or instant messengers;
• do not write it down;
• change it periodically;
• do not use the same password for different websites/services;
• enter your passwords only on verified or trusted websites and services;
• use up-to-date anti-virus/malware software.

Everyone should pay attention to the security of their account, because anyone can be a target of hackers.

Accounts are almost always hacked automatically by bots. Particular users or sites are rarely a specific aim of an attack. In most cases, the hackers just need your system resources. If they gain access, the mailboxes are used for spamming; the hacked web sites are used for spamming, launching hacking or DDoS attacks against other sites or services, distributing questionable content, and hosting advertizing or fraudulent pages and malware.

This is why everyone should take proper measures to keep their services secure. No site is too small or an e-mail account too unimportant, as the service is almost always hacked just for its resources.

Of course, your business or you personally may be a specific target for attackers. This may be due to personal reasons, it may be initiated by competitors, or the hackers may be planning to demand a ransom from you to stop attacking your service. This is one more reason why you should pay attention to the security of your accounts. If you receive threats that your service will be attacked, you should notify us on this matter.

There are a few things you need to do in order to keep your e-mail account safe:

• Taking proper care of the security of your own devices. Passwords are often stolen via malware. If a device of yours is compromised, and you check your mailbox through it, the hackers may obtain your login credentials.

• Using only trusted devices to check your e-mail. Logging via a shared computer at a hotel or an Internet cafe should be avoided. Such an insecure device could be infected with malware, or it may have a key logger installed on it intentionally.

• Choosing strong passwords, and changing them regularly. You can find general information on how to choose a strong password and secure it in our Password tips article.

• Connecting over an encrypted connection. Our Webmail interfaces use encryption by default. If you use a stand-alone e-mail program, you can find detailed instructions for the most popular e-mail programs in the Configuring an e-mail program section from our online documentation.

If your mailbox gets compromised, the attackers may use it to relay spam, or they may manually look through your stored messages for data that may be valuable for them. It is also possible that your login credentials will be sold in bulk along with more compromised accounts to other malicious entities who will utilize them as they decide.

You should be sure that any third-party software packages that you install into your account are kept up-to-date. All plugins and themes you add to such an application also need to be updated regularly. Otherwise, your software may get hacked through a known security vulnerability that has already been fixed in the current version.

The administrative interfaces of your applications must be protected with strong passwords. You can find tips on choosing a strong password here: Password tips. You can also add an additional layer of security by password-protecting the administrative directory of your software (if there is such, and if this will still allow it to function properly for your web visitors) with an extra username/password pair. You can do this via the Protection section of your online Control Panel: Password protection. This method is very effective against brute-force password attacks, and may also prevent certain vulnerabilities in the scripts stored in the administrative directory.

It is a good idea to look for security tips specific to the software that you are using. You should be careful with the information sources though. For example, a badly written security plugin may actually make your application vulnerable.

Be sure that you have no leftover test or obsolete software installations still available over the web. Such an outdated package can easily let hackers into your account. Any software that you do not need should be removed or should have its access limited. You can use the Protection section of your Control Panel to prevent public access to such applications.

There are many reasons why you should pay attention to the security of your local devices. As far as our hosting service is concerned, you should know that the hackers are after your login credentials for your e-mail accounts, your FTP accounts, and any web-based interfaces you may be using with your hosting service. Below you can find some general tips on how to keep your devices secure. If you feel that you need to know more on security, you should do your own search for information that matches the level of your computer knowledge, and the devices and operating systems that you are using.

• Always keep updated both your OS and the software that you run on your computer.

• You need to always run an antivirus application with updated virus definitions, and your devices should be behind a firewall.

• It is a good idea to disable any running services you do not need. In general, any software and service that you run is a potential security risk, so it is a good practice not to run services you do not actually need. Also, some operating systems come with particular services enabled by default that are considered insecure by design or require special measures to have them secured.

• You should avoid installing pirated software. Such applications may come infected with malware; serial key generators and similar tools may actually be trojans.

• Malware is often distributed either as a file attachment or as a link that is being sent over the e-mail or some messenger service. Such messages may appear to be coming from people you know. This may be due to the fact that their own computers are already infected, and the malware is utilizing their system to distribute the messages to their contacts. If such a message appears suspicious to you, you should not open the attachment or click the link; you should rather check with the senders if they indeed sent the message to you intentionally.

• When following links, you should pay attention to the URL in the address bar of your web browser. Fraudsters often upload fake login or product pages at URLs that are misspelled/altered variations of the real address you expected to visit, or at hacked sites whose domains have nothing to do with the service you actually expect to use.

• It is important to be careful on the sources of both information and software you install. For example, it is usually a bad idea to install anti-malware software that was offered to you in a pop-up window while you browsed the Internet. Such a software may be of bad quality, or it may even be a trojan. You should do your own search on the software you are about to install and the reputation of its vendors.

• If your computer triggers pop-ups with unexpected requests while you browse the web, for example asking you to give administrative permissions to a program that does not appear to be related with what you are doing at the moment, to install an additional application on your device, or to do something else that does not appear to be right at this time or is otherwise suspicious, you should always proceed with care. This may be a result of you visiting a malicious site or a legitimate site that has been hacked.

• There are particular things related to your OS that may make it more secure, so you need to look up information on it.

Spammers use different methods to obtain e-mail addresses to send unsolicited messages to. Bots crawl the web to collect e-mail addresses listed on web sites. These bots are called harvesters. Hackers also obtain the addresses of the correspondents of their victims. They collect them from hacked mailboxes or infected machines. Some companies also sell people’s personal data to spammers.

There are some things you can do to reduce the chance of your e-mail address ending up in the hands of spammers.

* Avoid listing e-mail addresses directly on your website. If you need to provide means of contact, it is recommended that you have a contact form instead. Having a contact form will prevent spammers from obtaining your e-mail address. If you get too much spam that is being posted directly through the contact form, you may consider adding a CAPTCHA protection to it against bots.

If you must list contact e-mail addresses on your website, you should not list them in plain text. There are techniques you can use to make it harder for spammers to collect the addresses from the website automatically. All of these methods have downsides, so you need to decide which one suits your needs best.

– You can replace the @ symbol in the email address with the word “at”, and the dot(s) with the word “dot”, eventually surrounded by some characters, such as square brackets, for example, if your e-mail address is contact@example.com, you can write it this way:

contact [at] example [dot] com

– Another similar method is to display the e-mail address as an image such as:

– You may also utilize a script that will scramble or encode the e-mail address. You can look for such a script online, or a professional can implement such a solution for your website.

Harvesters will need more resources to interpret an address displayed using the above methods, while the majority of your web visitors will easily understand the actual address. They may only experience the minor inconvenience that they will not be able to simply copy-paste your e-mail address directly, and there is a possibility of mistakes while entering it. You should note that no solution is perfect. If an e-mail address is visible to a human, it may be interpreted by a bot.

* With our service, there is no limit on the amount of e-mail addresses you can create, and you can set up e-mail forwarding. This gives you the opportunity to use different e-mail addresses for different purposes: registrations, online forums, contact forms on your website, etc. If a forwarding e-mail address starts receiving too much spam, you can simply delete it.

* You must keep your devices free of malware, as hackers may steal your own e-mail address and the e-mail addresses of your contacts. You can read relevant tips on securing your devices at Importance of the security of your local devices.

* You should never follow unsubscribe links in apparent spam messages or in messages sent from services you have not subscribed for. In almost all cases, these links are either invalid, or, even worse, they prove to the spammers that their message reached a real person who monitors the mailbox. This raises the value of your e-mail address on the illegal market where it will be again sold in bulk with others.

For the same reason, you should not respond to suspicious or spam mails, and you must not click any other links in them.

* Do not list your main contact e-mail address in the WHOIS details of your domain name. Spammers target the listed contacts of domain names. You can list a forwarding e-mail address as contact. Over the time, it will be getting more and more spam. You should replace this address periodically.

Although there is much you can do to limit the exposure of your e-mail addresses to spammers, there are some things that you can hardly control.

Common addresses such as webmaster@example.com, info@example.com, contact@example.com, ceo@example.com, etc, are a default target of spammers. Such mailboxes exist at many domains, so spammers send messages to them blindly, presuming their possible existence. You should avoid having such mailboxes, unless it is necessary for your business.

Another way your address may end up with spammers is if a correspondent of yours gets infected with malware and their contacts are stolen. The same may happen with a company that has your e-mail address — they may get hacked, and their user database may be obtained by spammers.