Every protection on this list — backups, permissions, region protection — assumes nobody else is logged in as you. The account is the single point where all of it can be undone at once, and it is usually the least protected thing anyone owns.
The three things worth doing today
- Use a password that exists nowhere else
Reuse is how accounts are taken. A breach at any unrelated site hands someone a working password, and they will try it here. A password manager makes this free; a pattern you can remember does not.
- Turn on two-factor authentication
If your panel offers it, this is the highest-value five minutes on the list. A stolen password stops being enough on its own.
- Secure the email address behind it
Whoever controls your email can reset your password. An email account with a weak password and no second factor makes everything downstream of it weak too.
What an intruder can do with each thing they get
| They get | They can |
|---|---|
| Your panel password | Delete worlds, download everything, reinstall the server |
| Your email | Reset the panel password and lock you out |
| Your SFTP details | Read and replace every file, including configs with database credentials |
| A subuser account | Whatever you ticked — which is why you tick carefully |
Someone logged in as you can delete the backups along with the world. That is the argument for keeping at least one copy downloaded somewhere they cannot reach — a backup that only lives inside the account is not insurance against losing the account.
It records logins with addresses. Reading it once a month takes a minute and is the only way you would ever notice a login you did not make, because nothing else announces one.
Your panel password appears in no other account you own, and a login attempt from a new device asks for a second factor.