Strong Password for Email, cPanel and WordPress, How to Create One

A strong password is one that is long, unique to each account and not found on any list of passwords that have already leaked. Almost every internet user now has at least one email account. Usually, of course, they have many more accounts in many different places. For their own security, legal and personal data protection, they need to protect their accounts in the best possible way.

On our servers we see automated login attempts on email, cPanel and WordPress accounts every day, looking for exactly the weak and reused passwords. That is why we updated this guide, which we first wrote in 2018, based on today's guidance from NIST and the NCSC.

What makes a password strong today

What makes a password strong today is first of all its length, because length makes it far harder for computers to guess than symbols do. Every password must qualify as "strong" to be considered secure, but the definition has changed. Until a few years ago, a strong password was one that included capital and lowercase letters, numbers, special symbols and had at least 8 characters.

NIST, the US standards body, in its SP 800-63B-4 guidelines from July 2025 now sets at least 15 characters when the password is the only protection on the account, and at least 8 when it is combined with two-step verification. It also says services should not force combinations of capitals, numbers and symbols, nor password changes every few months. The reason is simple. When we are forced, we create passwords like "Password1!" or just change the last number, and hackers know those patterns first. A password is changed immediately only when there is evidence it has leaked.

Secure password and why simple passwords get cracked

A secure password is not one that we simply think is "very clever". The most common mistake internet users make is using simple, weak passwords. If you look at the lists of the most used passwords worldwide, you will see "qwerty", "123456", "password" and so on at the top. The NCSC, the UK's cyber security agency, found "123456" in 23.2 million breached accounts.

Two conclusions follow from these results. The general public:

• does not know what a "strong password" is,
• believes the password they chose is "too clever" for anyone to discover.

These are also the reasons why every day a great many internet users realise their accounts have become a target for hackers. Hackers use a very simple tactic. They build applications with long lists of likely passwords and then set little robots to make continuous attempts on the account, trying those passwords one by one. The simpler a password is, the greater the chance they find it and get into the account.

The same robots also try on other websites the passwords leaked from one website. So even a good password, if you use it on many websites, is only as safe as the weakest of those websites.

How to create a strong password you can remember

To create a strong password you can remember, the simplest way is to join three or more random words that have nothing to do with each other. This is the method the NCSC recommends under the name three random words, for example something like "coffee-train-fish-2026". It gives you a long password that you remember, while a computer finds it very hard to guess.

Change all your simple passwords to strong ones as soon as you can, and for cPanel and your email accounts you do this from cPanel Password & Security. Every important account needs its own password, and above all your email, because that is where every other account is reset from. In the past we suggested building passwords around a "theme" you like, such as your favourite car and the year it came out. Today, though, details like that are easy to find on social media, so the words must be truly random and not personal.

If you want to check whether one of your passwords has leaked, Have I Been Pwned shows whether your email appears in known breaches. If it does, change the password on that service and on any other service where you used it.

What is a password manager and how it helps

A password manager is an app that creates and stores all your passwords encrypted, so that you only need to remember one, its master password. A password like "UbeKLw2531%@$!" is strong because it is completely random, but it is hard to remember. The password manager creates and keeps passwords like that, so you can have a different password on every website without remembering them.

The master password of the password manager must be the strongest one you have, built from random words and protected with two-step verification. The password manager built into your browser or phone is also an option, as long as the device locks with a code or biometrics. If you prefer paper, keep it somewhere safe and not stuck to your screen.

Do not type in and do not save your passwords on computers that do not belong to you! It is very easy for a malicious person to install software on that computer that captures every password you enter, so they can use it later to get into your account.

What is 2FA, two-step verification

2FA is two-step verification, meaning that after your password you also need a second code that only you have. Although guidance on creating proper passwords has existed for decades, the general public still ignores it and keeps using extremely simple passwords, and that is why two-step verification was created.

As the name says, it uses an extra "step" that usually comes from an app on your smartphone, such as Google Authenticator or Microsoft Authenticator. The second step is a series of numbers that is valid for a limited time, usually 30 seconds, and is shown only to the account owner. So even if a hacker finds your password, they will not be able to get into your account, because they will not know the extra code.

The difference is measurable. In a 2023 Microsoft study of its own accounts, multi-factor authentication reduced the risk of compromise by 99.22%, and by 98.56% for accounts whose password had already leaked. It is not absolute protection though. A well-built phishing site can ask you for the second code too, which is why you never enter it on a page you reached through a link in an email.

At Konet, two-step verification has been available since September 2023 in cPanel, in webmail for each email account separately and in the Client Area. See how to enable 2FA in cPanel and two-factor authentication in the Client Area.

What is a passkey and why it is the next step

A passkey is a way to sign in without a password, where you identify yourself with your device's fingerprint, face or PIN. Passkeys are based on the FIDO2 standard and are stored on your device, so there is no password to leak, to reuse or to give away by mistake on a phishing site.

When we first wrote this article in 2018, we noted that in 10 years things would certainly be very different. Passkeys are exactly that change. The NCSC recommends passkeys over passwords wherever they are available, and notes that they are at least as secure as the strongest password combined with two-step verification. Google, Apple and Microsoft already support them, so if a service offers you a passkey, say yes.

Email, cPanel and WordPress passwords

Your email password is the most important password you have, because anyone who gets into your email can reset the password of every other account you own. The same goes for cPanel, from where someone can change your website's files, read your email and set up new accounts for spam.

On our servers, every login to cPanel, email and FTP goes through a system that detects repeated failed attempts and automatically blocks the IP, and Imunify360 filters attacks before they reach the website. In the Client Area you also get an email when someone signs in from an unusual location, as we describe in the new security systems in the Client Area. But no system protects an account whose password is "123456", because it is found within just a few attempts.

That is why three things are worth doing today. Change your cPanel and email passwords to long, unique ones, enable 2FA, and in WordPress do not use the "admin" username and add two-step verification with a reputable plugin.

Email hacked, what to do

When your email is hacked, you often find out from a friend or customer who tells you they received a strange message from you. If it happens, do the following in order:

1. Change the password from a computer or phone you know is clean.
2. Enable two-step verification.
3. Check the email forwarders and filters, because attackers often add forwarding of your messages to an address of their own.
4. Change the same password on every other website where you used it.
5. Tell your contacts not to open links or attachments from your recent messages.

If messages are missing after the hack, read why with IMAP "my emails disappeared" affects all your devices at once, and how POP3 protects you.

Check your computer too. If it gets infected with a virus or other malicious program, the computer effectively stops being under your control. The creator of that virus can access your computer whenever they want and use it for their own benefit, which includes access to your accounts.

For "free" security programs that appear in ads, ask yourself the very simple question: "Why would a company offer me its service for free? And if it offers it for free, how does it survive?". Some of them are malicious themselves. The built-in Microsoft Defender in Windows is not in that category though, because you already pay for it with your Windows licence, and it scored 18 out of 18 in the AV-TEST test of October 2025. You will find more in our smart malware protection guide.

If your email or website is hosted at Konet, let us know so we can check the account. For a WordPress website that has been hacked, follow the WordPress recovery guide after a hack.

What happens when a hacker gets into your account? The least that can happen is that they read your emails and send them wherever they want. The worst case includes losing money from your bank account, and even criminal prosecution against you for threats or damage caused to others through your account. So learn about the risks and protect what belongs to you!