This post shouldn’t really need to happen, but since I do support and see dozens of requests come in for help and the amount of sites that use simple passwords is amazing.
Let me give you an example of a few, without actually using their passwords. Yes some of these may be valid passwords for someone’s site but not to current knowledge any site that I have ever worked on.
First the username. By default the IndexU username is “admin” without the quotes. But this can be changed easily. How many sites have I worked on for customers that did NOT use admin as the username? One.
Seriously, just one.
Passwords are a different story. I have no idea how many times I’ve seen passwords set to simple words that are in pretty much every brute force directory that exists. Passwords like
-
Passw0rd
-
the site owners city name
-
the site owners first name
-
the site owners last name
-
paperclip (I guess there were some nearby and it was something to type in)
-
1111111111 (not kidding on that one, 8-10 characters, all the same)
-
the sites domain name (seriously!)
Of course you do realize, that if you use your name or city or address as your password, that information is usually public in your Whois record.
If you really want to keep your information and site secure then please use a strong password of at least 8 characters that uses a mixture of uppercase and lowercase letters, numbers and special characters (like $, %, ^, &, # etc). It’s combinations like those that make it MUCH harder to crack a sites password.
Remember that once a user has figured out your password and is in your admin panel the possibility that they now know your cpanel (or worse, WHM) password is greatly increased because most users use the same password for everything.
Now all they need to do is check your whois, see what your email address is, and try to log into your webmail account. Once there they can try to transfer your domains.
It’s not worth it to be lazy. If you really need to, write that password down on a piece of paper or a business card and place it in your wallet or in a CD case next to your computer. Heck you could write it on a cd and people might think it’s a CD Key for some program and not your password for your email or website.
My customers get assigned passwords, and most of them like it. The ones that don’t like it ask to have it changed and I flat out say no. It’s for my security as well. If someone is hosted on my server and gets hacked and their domain is suddenly trying to send out 50,000 emails per hour (wouldn’t happen due to limits, but it’s possible on some machines) then it would make me look bad, and could get my whole server blacklisted which would suck big time.
Take your time, and learn about what you’re doing. And if you need it, ask for help.