Password security for members and administrators

Most people reuse passwords. When a shopping site or a game they signed up for years ago leaks its customer list, criminals feed those email and password pairs into login pages everywhere else, including yours. This is called credential stuffing, and it is the most common way a membership account gets taken over. The member did nothing wrong on your site; they simply used the same password somewhere that was careless.

For a member, a stolen login means someone else reading their messages or changing their details. For an administrator, it means someone else holding the keys to your content, your member list and your payment settings. The good news is that sensible password practice is not complicated. It just needs to be different for the two groups.

Length beats cleverness

For years people were told to build passwords from a mix of capitals, numbers and symbols and to change them every few months. The result was predictable passwords like Summer1! becoming Autumn2!. Current guidance from security standards bodies has moved on, and the core idea is simple: a long password is harder to guess than a short, complicated one.

A passphrase is several unrelated words strung together, such as “copper kettle orbit fiddle.” It is long, easy to type and easy to remember, and it is far stronger than a scrambled eight-character string. The weak points are reuse and common choices, not the absence of a symbol.

A sensible password policy for members

Your members are not security professionals, and a policy that frustrates them leads to locked accounts, support emails and people who give up logging in. Aim for rules that protect them without getting in the way. Check what your membership platform lets you configure, and where you have a choice, lean toward these:

• Require a reasonable minimum length. Twelve characters or more is a comfortable floor for members, and passphrases make it easy to reach.
• Do not set a low maximum. A cap of sixteen characters punishes the people doing the right thing.
• Block the obvious. If your software can reject very common passwords, or your site name followed by a number, switch that on.
• Allow pasting and offer a show-password option. Blocking paste breaks password managers, and a show button reduces typos on phones.
• Skip forced expiry. Ask members to change a password when there is a reason to, such as a suspected leak, not on a timer.

Getting this right matters most at the start. A new member who is locked out in their first week is far more likely to drift away, which is one reason the first thirty days decide whether a member stays.

Administrators need a higher standard

An administrator account can export every member’s details, issue refunds, change what people are charged and delete a year of work in a few clicks. Treat it accordingly.

1. Every person gets their own login. No shared “admin” account passed between you, your assistant and your web developer. Separate logins mean you can remove one person without disrupting anyone else, and you can see who did what.
2. Use a long, unique, generated password. Twenty or more random characters from a password manager, used nowhere else.
3. Turn on a second login step. Two-factor authentication, where a code from your phone is needed as well as the password, is the single biggest upgrade you can make to an admin account.
4. Keep a separate member account for testing. Browse your site as a regular member with a regular account, so your admin session is not left open on every device you use.
5. Change shared credentials when people leave. If a departing contractor knew the password for your hosting, domain or email tool, change it the same day.

Password managers: the habit worth recommending

A password manager is an app that creates, stores and fills in passwords for you, protected by one strong master password. It removes the temptation to reuse, because you never need to remember individual passwords. It also offers a quiet protection against fake login pages: a good manager will not fill in your details on a lookalike address.

For your team, make one mandatory. For members, recommend one gently in your help pages and your welcome material. Many will already have one built into their browser or phone without realizing it.

Password resets that are safe and painless

The reset process is where a lot of account takeovers actually happen, because it is designed to let someone in without the password. A safe reset process has a few features worth checking on your own site:

• Reset links are single-use and expire after a short period, such as an hour.
• Passwords are never sent by email. If you ever receive your own password in an email from any service, it is storing passwords badly.
• The member gets a notification whenever their password or email address changes, so they can react if it was not them.
• Your support team never asks for a password, and never changes the email address on an account just because someone asks by phone or email. Verify first, for example by replying to the address already on file.

Here is a notification you could adapt for password changes:

Subject: Your password was changed

Hi Margaret, the password for your Riverside Quilters account was changed just now. If this was you, there is nothing more to do. If it was not you, reset your password straight away using the Forgot password link on the login page, then reply to this email and we will help you check your account. We will never ask you for your password.

Your password security checklist

You can work through most of this in an afternoon:

1. Review your member password rules against the list above and adjust what your platform allows.
2. Make sure every administrator has a personal login, and remove any shared or unused admin accounts.
3. Move your own admin passwords into a password manager and replace any that are reused.
4. Switch on two-factor authentication for every admin account that supports it.
5. Request a password reset on your own site and check that the link expires and the change notification arrives.
6. Add a short, friendly paragraph about passphrases and password managers to your help page.

None of these steps is dramatic, but together they close off the most common ways accounts are lost.