Recommended Security Practices

1. Use Strong Passwords

• Create unique, complex passwords using a mix of letters, numbers, and symbols.
• Avoid reusing the same password across multiple services or accounts.
• Consider using a password manager to generate and store strong passwords securely.
• Change passwords regularly, especially if you suspect a compromise.

2. Enable Two-Factor Authentication (2FA)

• Add an extra layer of security by enabling 2FA on your DirectAdmin and email accounts.
• Use an authenticator app such as Google Authenticator or Authy rather than SMS where possible.

3. Keep Software Updated

• Regularly update your email clients, web browsers, and any related software.
• Install security patches promptly — many attacks exploit known vulnerabilities in outdated software.

4. Monitor Your Account Activity

• Check periodically for unusual login attempts or unexpected changes to your account settings.
• Review your sent messages folder for any activity you don't recognise.
• If you notice anything suspicious, change your password immediately and contact support.

5. Maintain Clean Email Lists

• Only send emails to recipients who have explicitly opted in to hear from you.
• Regularly remove bounced or inactive addresses to keep complaints low and deliverability high.

6. Use Proper Email Authentication

• Configure SPF, DKIM, and DMARC records correctly for your domain.
• These records help prevent spoofing and significantly improve your email deliverability.

7. Beware of Phishing Attempts

• Do not click suspicious links or download attachments from unknown senders.
• Always verify the sender's identity before responding to requests involving sensitive information.
• Legitimate services will never ask for your password via email.

8. Back Up Important Emails and Data

• Regularly back up your email data to protect against accidental loss.
• Use DirectAdmin's built-in backup features or a third-party tool to automate this.

9. Limit Access and Permissions

• Only grant account access to users you trust.
• Apply the principle of least privilege — give accounts only the permissions they actually need.
• Remove access promptly when it is no longer required.