Secure your NeoHeberg account

Your dashboard account controls your VPS, services, Coins and invoices. A compromise does not just expose data: it can reinstall a machine, delete a service or change a contact address. Four actions cover most of the risk, and they should be repeated after any device change.

Use a unique password

Use a password manager and a long passphrase generated for this account only. A password reused elsewhere becomes a shared key: one leak on a forum is enough to open your dashboard. Do not keep it in a plaintext synced file, and never send it by email or in a ticket.

Also confirm that the account email is one you actually read. A school or work address can disappear, and recovery disappears with it.

Turn on two-factor authentication

In the dashboard settings, enable 2FA with a TOTP application (Aegis, Authy, 1Password, Google Authenticator). Keep the backup codes offline, in a place separate from the TOTP app.

2FA does not protect against a phishing site that captures the password and the code in real time. Before typing credentials, check the dash.neoheberg.fr URL and the certificate. A link received in a message is not proof of origin.

Watch sessions and access

After a password change, close other sessions if the dashboard offers it, or contact support. Do not leave a session open on a shared computer, and log out after configuring a public service.

Account security and server security are separate perimeters, but they are linked: an SSH key stolen from your laptop can undo the work done on the dashboard. Protect your machine, not only the website.

Prepare recovery

A verified email address is the main recovery channel. If you lose access to that mailbox, you lose recovery. Keep 2FA backup codes somewhere offline and know what the support team will ask for. Use the contact page, and never attach a password, private key or backup code.

If you suspect a compromise, change the password, enable or reset 2FA, review services and invoices, then report it to support. Do not delete evidence before the review.

Verify

Test the setup in a private browsing window: log out, log in, request the TOTP code, then use a backup code. If all steps pass, recovery works. Repeat the test after every phone or password manager change.

A secure account is one you still control: keep the email, the TOTP device and the backup codes in three places you own.