Securing your HostingSwift account
Two-factor authentication, API keys, session hygiene and what to do if you suspect a breach.
Your hosting account is the keys to everything you run. Treat it like the master key it is.
Enable two-factor authentication (2FA)
Account → Security → Two-factor authentication. Use an authenticator app (Aegis, Raivo, or your password manager's built-in TOTP) rather than SMS where possible — SMS can be intercepted via SIM-swap. Save the recovery codes somewhere offline. Without them, losing your phone means losing your account.
Use a strong, unique password
Covered in Resetting your password, but it bears repeating: a unique passphrase stored in a password manager defeats the most common attack (credential stuffing from an unrelated breach).
Manage API keys carefully
The AI Router and several integrations issue API keys. Rules:
One key per application or person. Never share a single key across tools.
Scope keys to the minimum: if a tool only needs read access, do not give it write.
Rotate keys on a schedule and immediately if a key may have leaked (committed to a public repo, pasted in chat, sent to a third party).
Revoke keys you no longer use. An unused key is pure risk.
Watch your sessions and activity
Account → Activity logs sign-ins with IP and time. If you see a login you do not recognise:
Change your password immediately (this invalidates other sessions).
Enable or reset 2FA.
Review team members and remove anyone you do not recognise.
Rotate API keys.
Check your services for unauthorised changes and your billing for unexpected orders.
Team access, least privilege
If you use the Team feature, give each person their own sub-account with only the permissions they need. Shared logins destroy accountability — the activity log becomes useless if five people use one password.
Harden the services themselves
Your account is the front door; the servers are the house. An account breach plus an open SSH port plus a weak root password is how real intrusions happen. Read:
SSH keys and access — disable password login.
Harden your VPS — firewall, updates, fail2ban.
Fail2ban basics — automatic brute-force blocking.
Related reading