Passkeys: protect the accounts behind your website

01A dated update worth acting on

The government’s collection of cyber security guidance for businesses was updated on 16 September 2026 to include passkey advice. The NCSC recommends using passkeys instead of passwords where services support them. Passkeys are designed to resist phishing by tying authentication to the genuine service.

This 1 November briefing applies that existing advice to the accounts behind a website. A secure-looking homepage can still depend on a poorly protected registrar, DNS administrator, hosting account or email inbox. A public website scan cannot inspect those account settings.

02Start with accounts that can change ownership

1. Inventory accounts that control the domain, DNS, hosting, content management, business email and billing. Assign a named owner and check that recovery details belong to the business.
2. Where supported, enrol a passkey using a trusted device or an approved credential manager. Test sign-in before removing an existing recovery option.
3. Review how another authorised person could recover access if a device is lost or an administrator leaves. Protect any recovery codes and follow the service’s recovery instructions.
4. Where passkeys are unavailable, use a strong unique password stored in a password manager and enable two-step verification.

03Record the decision, not the secret

Keep an account inventory with the owner, authentication method and last recovery review. Do not place passwords, recovery codes or passkey exports in a scan report. Revisit the inventory when providers or administrators change, and ask your IT provider to demonstrate the recovery process rather than relying on an unchecked tick box.