The password security checklist for web agencies
Twelve practical checks to protect your clients' hosting, domain, WordPress and email logins, from two-factor sign-in to offboarding.
ClientKeeps team · · 2 min read
Use this checklist once a quarter. Most agencies can tick off the first half in an afternoon.
Storing passwords
1. One place for every client login. Not a spreadsheet, not chat, not email. A shared vault with end-to-end encryption.
2. Unique passwords everywhere. One reused password turns one leak into ten. A good vault spots reuse for you; ClientKeeps flags it on the dashboard.
3. Long, random passwords. Let the generator make them. Nobody needs to remember a hosting password.
4. No breached passwords. Check passwords against known breaches. ClientKeeps does this in your browser, with a privacy-preserving lookup, so the password itself is never sent anywhere.
Signing in
5. Two-factor sign-in on your vault, for everyone. No exceptions for the boss.
6. Two-factor on the client accounts that matter most: domain registrar, DNS, hosting, email. Keep the codes in the vault so they belong to the agency, not to one person's phone.
7. Passkeys where you can. They can't be phished, and they make signing in faster too.
Access
8. Only the clients each person works on. A designer doesn't need the DNS login for every client.
9. Time-limited access for freelancers. It ends by itself, so you don't have to remember.
10. A record of who opened what. When a client asks "who has seen our hosting password?", you should be able to answer in a minute. ClientKeeps keeps a tamper-evident audit log.
When things change
11. Offboard on the last day. Remove access, check what the person could open, and change the important passwords first: domain, DNS and hosting.
12. Change passwords on a schedule. Not every password needs it, but the ones that unlock everything do. ClientKeeps shows which logins are due on the dashboard.
Bonus: ask clients the safe way
Never ask a client to email a password. Send a secure request link instead; it's quicker for them and safer for both of you.
Print this list, put a date in the calendar, and run through it every quarter. It's the cheapest insurance your agency will ever buy.
