Use a trusted route and device
If a hosting password may have been exposed, regain a trusted route, change the credential and ask the service owner to check for misuse.
Treat a password entered on a suspect page as exposed until the account owner has secured the login. Stop using the suspicious link. Open the panel through a previously known Novasean client-area route or contact support through a known channel; check the full hostname before signing in. If the device may have malware, use a trusted device or get security help before entering a replacement password.
This is response to suspected exposure, not routine password hygiene. Notify Novasean promptly if hosting files, mail or customer data may have been affected. Do not wait for a confirmed attacker login before reporting a credible compromise.
Replace the affected credential
If you can reach your own panel account safely, change its password to a new unique value through the available user-level control. Update the password in your approved password manager and any legitimate application or transfer tool that used it. Do not reuse a password from a WHMCS, registrar or mailbox account. If you cannot sign in or do not have permission to change the credential, ask support to recover access; do not ask an unverified sender to reset it for you.
DirectAdmin can provide login keys and two-step authentication, but availability and your permission to manage them depend on the installed service. Review keys you own and revoke an unexpected or exposed one with support if needed. Keep recovery codes private.
Check for misuse with the operator
Record when and how the password may have leaked, the account name, suspect URL and any unusual site change. Ask support to review relevant access or service evidence and help determine whether files, DNS, mail or other account settings changed. Customers should not assume access to server-wide logs or all active sessions. Preserve suspicious messages and redacted screenshots; never include the old or new password in a ticket.
If the same password was reused elsewhere, change those credentials through each service’s genuine route. If an automation depended on the old credential, replace it with the approved least-privilege access method rather than restoring the exposed value.
Confirm access and service behaviour
Sign out and test the new credential and any required second factor from the genuine route. Check the website and other entitled functions for unexpected changes, then record the support case and follow-up owner. If an unauthorised change is found, pause normal deployments and agree recovery from known-good files or backup with the operator. A password rotation blocks future use of the old password but does not undo actions already taken with it.
For example, an unknown mail forward or new panel user created during the exposure window is evidence of possible misuse. Preserve its details and coordinate removal with the account owner before changing production settings.
Frequently asked questions
Should I disable two-step authentication while recovering? No. Use the approved recovery route and support; removing a second factor increases exposure.
Is changing the password enough? It is necessary, but review other keys and possible account changes with the operator when compromise is plausible.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.