Motta Industries Blog

Walk into almost any small office and you may find it: a sticky note on the edge of a monitor holding the password to the website’s admin panel. Sometimes it lives in a shared spreadsheet, a group chat or the memory of one developer who left years ago. However it is stored, a shared admin password is one of the most common weak points in a small business website.

Admin accounts control everything. Whoever signs in can change content, install code, read customer data, redirect payments or lock out the owner. Attackers know this, which is why login pages for content management systems, hosting dashboards and domain registrars are constant targets.

Passkeys offer a practical way to retire the sticky note. This guide explains what passkeys are, why they resist the attacks that defeat passwords and many one-time codes, and how to move a small team’s admin logins to them step by step.

Why admin passwords keep failing

Passwords fail in predictable ways. People reuse them across sites, so a breach somewhere else exposes your admin login. They are phished through fake login pages that look exactly like the real one. They are guessed, shared, written down and rarely changed when someone leaves.

Adding multifactor authentication helps a great deal, but not every form of it holds up equally. In its fact sheet on implementing phishing-resistant MFA, published in October 2022, the Cybersecurity and Infrastructure Security Agency described several ways attackers get around weaker MFA:

• Phishing. A fake login portal collects the username, password and the six-digit code from an authenticator app, then uses them immediately.
• Push bombing. Attackers bombard a user with push notifications until they press accept.
• SS7 exploitation. Weaknesses in telecommunications infrastructure are used to obtain codes sent by text message or voice call.
• SIM swap. Attackers convince a mobile carrier to transfer the user’s phone number to a SIM card they control.

CISA was clear that any form of MFA is better than no MFA. But it described phishing-resistant MFA as the gold standard and said organizations should make migrating to it a high priority. It also stated that the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication, the standards that passkeys are built on.

What passkeys are

A passkey replaces a password with a pair of cryptographic keys. The private key stays on your device or in your password manager, and the website stores only the matching public key. When you sign in, your device proves it holds the private key, usually after you unlock it with a fingerprint, face scan or device PIN.

Several properties make this a strong fit for admin accounts:

• Nothing to phish. A passkey only works on the genuine website it was created for, so a look-alike login page cannot collect anything useful.
• Nothing to reuse. Each passkey is unique to one site and one account.
• Nothing to steal from the server. A breach of the website exposes public keys, which cannot be used to sign in.
• Nothing to write down. There is no string of characters to put on a sticky note.

Passkeys can be synced through a platform account or password manager so they are available across a person’s devices, or they can be bound to a single device such as a hardware security key.

Where federal guidance landed

The final version of NIST’s SP 800-63B-4 digital identity guidelines, published in July 2025, gives useful direction even though it was written for federal agencies. It requires verifiers to offer at least one phishing-resistant authentication option at its second authentication assurance level and says they should encourage phishing-resistant authentication at that level.

The guidelines include a normative appendix on syncable authenticators, the category that covers most synced passkeys, and they note that because syncable authenticators require the private key to be exportable, they shall not be used at the highest assurance level. For a small business, that distinction suggests a sensible pattern: synced passkeys for everyday admin users, and device-bound hardware keys for the handful of accounts that control everything, such as the domain registrar and hosting owner account.

Protect the devices that hold passkeys

A passkey moves the important protection from a typed string to a device, so the device itself deserves attention. Every phone, laptop or tablet used for admin work should have a screen lock, current operating system updates and full-disk encryption, which most modern devices enable by default. Biometric unlock is convenient, but the device PIN or passcode behind it should also be strong, because that is what protects the passkey if biometrics fail.

If staff use personal phones for work logins, agree on minimum standards and what happens when a phone is lost or replaced. If passkeys sync through a password manager, protect that manager’s own account with phishing-resistant authentication too, since it now holds the keys to many systems at once.

People are getting used to passkeys

One worry about any new login method is whether staff will accept it. Consumer familiarity is growing. The FIDO Alliance’s 2024 Online Authentication Barometer, published in October 2024, reported that passkey familiarity had risen from 39% of respondents in 2022 to 57% in 2024, and that 62% of those familiar with passkeys had enabled them. The same survey found that 42% of consumers had abandoned a purchase in the past month because they forgot a password.

The survey covered 10,000 consumers across ten countries and was conducted online in August 2024, so it describes general attitudes rather than any particular workplace. Still, many employees will already have used a passkey for a personal account, which makes rollout at work easier.

Take stock of every admin login

Before changing anything, list every account that can change your website or the services it depends on. Small businesses often find more than they expect:

• Content management system administrator and editor accounts.
• Hosting control panel and server access.
• Domain registrar and DNS provider.
• Email and identity provider accounts used for password resets.
• Ecommerce platform, payment processor and shipping tools.
• Analytics, tag manager and advertising accounts.
• Code repositories and deployment services.

For each account, note who has access, whether it is shared, what MFA is in place and whether the service supports passkeys or security keys. Our website maintenance reviews include this inventory because forgotten accounts are a frequent source of trouble.

A step-by-step migration plan

1. Eliminate shared logins. Give every person their own named account with only the permissions they need. Shared credentials cannot be traced or revoked individually.
2. Start at the top. Protect the domain registrar, hosting owner account and the email account used for password resets first. If an attacker controls these, they control everything else.
3. Enroll passkeys where supported. Many hosting providers, registrars, identity providers and some content management systems now support passkeys directly or through plugins.
4. Register at least two authenticators. Every admin should have a backup, such as a second device or a hardware key stored safely, so a lost phone does not mean a lockout.
5. Replace weak MFA where passkeys are not available. Use an authenticator app with number matching or a hardware security key instead of text message codes.
6. Remove the old fallback. Once passkeys work reliably, disable password-only sign-in or restrict it where the service allows.
7. Update the offboarding checklist. When someone leaves, remove their account and registered authenticators the same day.

When a service does not support passkeys yet

Not every tool a small business depends on offers passkeys today. Some older content management plugins, niche industry platforms and smaller vendors still rely on passwords. That does not mean those accounts should be left as they are.

For each service without passkey support, use a unique, long password generated and stored by a password manager, so nothing needs to be remembered or written down. Turn on the strongest MFA the service offers, preferring a hardware security key or an authenticator app with number matching over text messages. Limit who has access, and check the vendor’s roadmap each year. Many vendors are adding passkey support, so the gaps on your list should shrink over time.

Plan account recovery carefully

Strong logins are only as strong as the recovery process behind them. If a support agent can reset an admin account after a phone call, an attacker can try the same thing.

• Document how each critical account is recovered and who is authorized to request it.
• Keep backup authenticators in a secure, known place.
• Use a business email address on a domain you control for account recovery, not a personal address.
• Ask providers whether they offer recovery protections, such as waiting periods or verified contacts.

Recovery planning is also a hosting question. Our web hosting setups document owner access and recovery steps so a business is not locked out of its own site.

Help the team through the change

New login methods fail when people do not understand them. Before switching, explain to staff why the change is happening and what will be different. Show them how to create a passkey, how to sign in with it and what to do if they get a new phone. A short written guide with screenshots of your own systems helps.

Roll out to one or two people first and fix any confusion, then expand gradually. Expect questions early and make it clear whom to ask.

A fictional example

Consider a fictional landscaping company whose website, hosting and domain were all managed through one shared login written on a note in the office. When a former employee’s personal email was breached, the owner realized that person still knew the password.

A developer helped the company create named accounts for the owner, office manager and developer, each with only the permissions they needed. The owner enrolled a passkey and a hardware security key for the registrar and hosting owner accounts. The office manager used a synced passkey for the content management system. Text message codes were replaced, the shared password was retired and the sticky note went into the shredder. Offboarding now takes ten minutes instead of an afternoon of password changes.

An admin login checklist

• Every admin account is listed with its owner and permissions.
• No admin login is shared between people.
• Domain, hosting and recovery email accounts use phishing-resistant authentication.
• Passkeys are enrolled wherever services support them.
• Every admin has at least two registered authenticators.
• Text message codes are replaced where possible.
• Recovery steps are documented and protected.
• Offboarding removes accounts and authenticators the same day.
• Devices holding passkeys are locked, updated and encrypted.
• Services without passkeys use unique managed passwords and strong MFA.
• Staff know how to use and replace passkeys.

Retiring the password sticky note is one of the simplest and most effective security improvements a small business can make. For a broader review of your defenses, explore our trust and security services.