Principle of Least Privilege
What the Principle of Least Privilege Means
The principle of least privilege is a security rule that gives every user, program and account only the access it needs to do its job, and nothing more. In web hosting, it applies to hosting logins, FTP users, database accounts, control panel staff and API keys.
The idea is simple. If an account can do less, a stolen or misused account can do less damage. A visitor who breaks into a website's upload form should not be able to read the database passwords of every other site on the same server. The rule limits what an attacker can reach after the first break-in.
Many hosting problems come from the opposite habit: one all-powerful login used for everything. When the same password opens the control panel, the email accounts and every database, a single leak exposes the whole operation.
Where Least Privilege Applies on a Hosting Account
Least privilege works best as a set of separate decisions, one for each type of account.
- Database users: a website usually needs to read and write its own database, not create or delete other databases.
- FTP and SFTP users: an account used to upload files to one folder should be limited to that folder, not the whole home directory.
- Control panel and team access: a person who edits content does not need billing or server-level rights.
- API keys: a key that only reads statistics should not be able to change DNS records.
Each account should have a clear answer to one question: what is this account for? Access that goes beyond that answer is excess privilege, and excess privilege is what attackers look for.
How Excess Privilege Spreads a Breach
A small business runs an online shop and a blog on one shared hosting account. The shop owner gives a freelance designer an FTP login with access to the whole account rather than the theme folder. When the designer's laptop is infected with malware, the attacker receives those FTP details and can change files for both the shop and the blog.
With a narrower login, the same infection would reach only the theme folder. The incident would still need attention, but it would not spread to every site on the account.
Frequently asked questions
Is least privilege the same as two-factor authentication?
No. Two-factor authentication checks that the person logging in is who they claim to be. Least privilege decides what that person can do after logging in. The two work together: strong login checks reduce the chance of a takeover, and limited access reduces the harm if one happens anyway.
How does least privilege limit damage after a breach?
It limits the reach of a compromised account. An attacker who takes over a login with narrow rights can only touch what that login could already touch. Separate accounts for separate jobs also mean one stolen credential does not expose unrelated sites, databases or services. The same idea applies between customers on one server, which is the subject of account isolation.