Your hosting credentials may be more exposed than you think
Most people who run a website set their hosting passwords once and forget them. That habit is exactly what makes incidents like the one at DreamHost worth paying attention to — not just if you use DreamHost, but as a reminder of how quickly access to your site can slip away.
DreamHost, one of the older shared hosting providers still operating today, has been contacting affected customers and telling them to reset both their email and FTP passwords. FTP, or File Transfer Protocol, is the method many site owners use to upload files directly to their server. If someone else gets hold of those credentials, they can silently replace your website files, inject malicious code, or steal everything stored there.
What we know so far
Details remain thin. DreamHost has not published a full public statement explaining what went wrong, how many accounts were affected, or how the credentials may have been exposed. What is confirmed is that the company reached out proactively to a subset of customers and told them to change their passwords as a precaution.
That kind of targeted outreach usually means the provider has identified a specific set of accounts at risk — rather than issuing a blanket warning to everyone. It also suggests the incident was real enough to act on, even if the scope is still unclear.
What you should do right now
If you have or have ever had a DreamHost account, check your inbox for any message from them. Even if you did not receive one, this is a good moment to log in and change your FTP and email passwords anyway. Use a long, random password that you do not reuse anywhere else — a password manager makes this easy.
While you are in your control panel, it is also worth checking whether your account supports two-factor authentication, which adds a second step to log in and makes stolen passwords far less useful to an attacker. Not all shared hosts offer this everywhere, but it is worth enabling wherever it is available.
If you connect to your server via FTP, consider switching to SFTP instead. SFTP — Secure File Transfer Protocol — encrypts your connection, so credentials cannot be intercepted in transit the way they can over plain FTP.
The bigger picture
Hosting providers hold the keys to everything you have built online. When credentials leak, the damage is not just to your account — attackers can use compromised sites to spread malware to your visitors or send spam under your domain name, which can destroy your email reputation for months. Treating your hosting password with the same care as your bank password is no longer optional. Incidents like this one are a reminder that providers, however established, are not immune to problems.
