Three accounts sit behind every business website. The registrar is the company where you bought your domain name. The DNS provider holds the records that tell the internet where your website and email live; often it’s the same company. The web host runs the website itself, sometimes with an FTP login, an older way to upload files.

ICANN’s guidance for domain owners says changing DNS records is a common goal when someone breaks into a registration account [1]. With that access, an attacker can send your web visitors to a fake site, route your mail through a server they watch, or move the domain away from you entirely [1]. ICANN recommends a different password for each account, never sharing passwords, using MFA where the registrar offers it, removing access when people leave, and turning on transfer lock so the domain can’t be moved without your approval [1].

When CISA saw this happen in 2019, it ordered federal agencies to change the passwords on every account that can edit DNS records, registrar accounts included, and put MFA on all of them [2]. MFA means a second proof after your password, like a phone prompt or security key [3]. CISA advised against text-message codes for these accounts [2].

The FTC’s advice on choosing a web host makes the same point for small businesses: decide up front who will manage the site, and ask who can edit it after launch and whether MFA is available for logins [4].

Your report may also list a few related website items:

• Security headers. These are short instructions your website sends to browsers, like “only connect over HTTPS” (Strict-Transport-Security) or “don’t let other sites frame this page” (X-Frame-Options) [5]. Missing headers are a low priority; most web hosts can add the standard ones.

• Certificate expiring soon. A certificate, also called TLS, is what lets your site load over https [4]. Renew it, and ask whether renewal is automatic, since shorter lifetimes make manual renewal harder to keep up with [6][7].

• Google flags the site as unsafe. Google may label a site in search results or show a browser warning when it finds hacked content, harmful software or deceptive pages [8][9]. The Security Issues report in Google Search Console shows what was found; the whole site must be fixed before requesting a review [8]. Have your web provider investigate.

• Sensitive documents in search results. Google’s guidance is to delete or password-protect the file first [10]. A noindex tag keeps a page out of Google’s results but not out of reach, and robots.txt shouldn’t be used to hide a page [10]. The Removals tool hides a result quickly but only temporarily [10].