Last time we met the robots. Today we look at the first thing they try: your front door, the login.
Most people picture a hacker guessing a password. That does happen, but it's the least of the three ways passwords are taken:
- Guessing. Robots try common passwords on your login page, millions of times a day. "Summer2026!" doesn't last long.
- Re-using. Billions of email and password pairs have leaked from other websites over the years. Robots try your old leaked password on your website, email and hosting. If you've used it twice, one leak opens two doors.
- Stealing. Malware on a computer copies saved passwords straight out of the browser. We'll cover that in lesson 5.
A strong password helps with the first one. It does nothing for the other two.
The pattern to spot
Watch for emails you didn't expect: "new sign-in from Windows in Romania", "your password was changed", "here's your reset code". Each one means someone else is trying your door. Never ignore them, and never click the link in them. Go to the account yourself and check.
The fix is free
Two-step login (also called two-factor or 2FA) means a password alone isn't enough. You also approve the login on your phone. Microsoft found it cuts the risk of an account being taken over by more than 99%. Yet only 43% of UK micro businesses insist on it.
Today's easy wins
- Turn on two-step login for your email first. Your email can reset every other password you own.
- Then do the same for your domain, hosting and website.
- Start using a password manager, so no password is ever used twice. Your phone or browser already has a decent one built in.