Behind every business website there is an account through which someone edits pages, reads enquiries and publishes. Often it is protected by a password that was set up years ago, is now saved in several browsers and nobody can say for certain on which devices it is currently signed in. Yet signing in without a password is reaching everyday life: 21 percent of internet users aged 16 and over in Germany now sign in without a password, and 40 percent use two-factor sign-in (BSI and ProPK, Cybersecurity Monitor 2026). This article shows how a business protects its own website account in day-to-day operation: a passkey instead of a password plus code, backup codes that can actually be found in an emergency, a regular look at the active sessions, connected accounts and shared devices at the front desk or in the workshop. How to assign roles and what to do when staff change is covered in Maintaining a website as a team; the full attack surface of a website is the subject of Website security: keeping the attack surface small.
The website account is a master key
Whoever signs in to a website account can do more than edit text.
They can publish, read contact enquiries with names, phone numbers and requests, connect or disconnect a domain and, in the worst case, swap content that then appears under the name of the business. That makes the account closer to the master key of the shop than to the key of a locker. Credentials are correspondingly sought after: in the 2026 industrial security survey, attacks on passwords caused damage at 18 percent of the companies surveyed with ten or more employees, and phishing attacks at 16 percent of companies (Bitkom, Wirtschaftsschutz 2026). Attackers rarely need technical finesse to get in. According to the EU Agency for Cybersecurity, phishing, including fraudulent calls, malicious emails and rigged advertising, was the way in for about 60 percent of the observed cases (ENISA Threat Landscape 2025). On top of that come credentials from other people's leaks: between July 2024 and June 2025, 461 data leaks containing data of institutions and of consumers in Germany became known, and passwords were among the affected data (BSI, State of IT Security 2025). Anyone who uses the same password for the website account as for an online shop may hand over the key with the next leak without noticing.
A passkey instead of password plus code
A passkey replaces the password with a key pair. During setup the device, meaning a smartphone, laptop or security key, creates two matching keys.
The public key is stored with the service, the private key either does not leave the device or is synchronized through the cloud with other devices belonging to the same person. At sign-in the service sends a task, the so-called challenge, which can only be answered correctly with the private key (BSI, Management Blitzlicht Passkeys). The answer is approved on the device itself, by fingerprint, face recognition or device PIN. The service therefore holds nothing that could be tried elsewhere as a password after a leak, and there is nothing to remember or write down.
The decisive difference from password plus code is phishing. The BSI explicitly describes passwordless sign-in as phishing-resistant (BSI, Management Blitzlicht Passkeys). A code from an authenticator app protects well against a stolen password, but it is typed in by hand, and whatever can be typed can also be typed into a fake sign-in page. The US standards agency NIST therefore states that methods involving manual entry are not considered phishing-resistant, because the entry is not bound to the specific sign-in (NIST SP 800-63B-4). ENISA describes kits for fake sign-in pages that place themselves between user and service and bypass the two-factor prompt (ENISA Threat Landscape 2025). A passkey, by contrast, only answers the address it was created for. A copied page under a different address therefore receives no usable answer, and that is what phishing resistance rests on.
Scroll table sideways
| Situation | Password only | Password plus code | Passkey |
|---|---|---|---|
| Password shows up in someone else's leak | Access for anyone who tries it | No access without the code from the app | The service only holds the public key |
| Fake sign-in page | Password is intercepted | Password and code can be intercepted and used right away | Answers only the real address |
| Smartphone lost | No effect on sign-in | Sign in with a backup code, then set up again | Second passkey or another route needed |
| Shared computer at the front desk | Password often stays saved in the browser | Code comes from a personal phone | Create only on personal devices |
| Effort at every sign-in | Typing or a password manager | Plus the current code from the app | Fingerprint, face or device PIN |
The method is not yet familiar everywhere. In a BSI consumer survey in 2024, only 38 percent said they knew the term passkey, and 18 percent said they already used passkeys themselves (BSI, consumer survey 2024). In the annual survey by the BSI and the police, 21 percent of internet users aged 16 and over sign in without a password at the start of 2026, up from 16 percent the year before (BSI and ProPK, Cybersecurity Monitor 2026). As a reason for not using all protective measures, 23 percent of respondents say it is too complicated (BSI and ProPK, Cybersecurity Monitor 2026). For a business this means: when switching over as a team, it is better to go through the setup together at the device once rather than ordering it by circular email. A joint session at the meeting table saves the later question of why the fingerprint suddenly asks for a password.
Setting up and naming a passkey
In XICflow everything related to sign-in sits on the “Security & sign-in” page, which you open from the account page.
The cards appear there in this order: “Two-factor authentication (2FA)”, “Passkeys”, “Connected accounts”, “Active sessions” and “Change password” (XICflow documentation). Each step is described with the exact labels in the documentation on account, plans and security. A passkey is created quickly:
- In the “Passkeys” card, choose “Add passkey”.
- Under “Name for this passkey”, enter a label that clearly identifies the device, such as “Owner's smartphone” or “Office laptop”.
- Confirm the prompt from your device, depending on the device by fingerprint, face recognition or security key.
The name is more than tidiness. Anyone who later loses, sells or replaces a device has to be able to tell which entry needs to go. You adjust existing passkeys with “Rename” and delete them with “Remove”; before deleting, XICflow asks “Really remove this passkey?”. If a browser cannot handle passkeys, the card reads “This browser does not support passkeys.” and the button for adding one is missing (XICflow documentation). The “Sign in with passkey” route on the sign-in screen also appears only in browsers that support passkeys. That is not a fault of the account but a hint to stay with password plus code on that device until a current browser is installed.
Two passkeys, two devices
Two-factor with an app and backup codes
Two-factor sign-in stays important as long as the account has a password, and in XICflow it has one as soon as it was created with email and password. A passkey does not close the password route, it only opens a better route next to it.
The second step therefore protects exactly the case in which the password does end up in the wrong hands. You set it up in the “Two-factor authentication (2FA)” card via “Set up 2FA”: the authenticator app takes over the displayed key via a link or by hand, then you enter the current code and choose “Enable”. The code changes every 30 seconds (XICflow documentation), so it pays to use a fresh one. After that, every sign-in with a password is followed by the prompt to enter the code from the app. If a wrong code is entered five times during sign-in, XICflow accepts no further code for around ten minutes, not even a correct one (XICflow documentation). That slows down anyone trying to work through the digits.
Right after switching it on, XICflow shows eight backup codes in the format “abcde-12345”, each usable once and shown this one time only (XICflow documentation). They replace the code from the app when the phone is not at hand. Later the card shows “Backup codes left:” with the number remaining. If it drops because codes were used, or if it is unclear who has seen the list, you create a new list through the fields “Password” and “2FA or backup code” with “Regenerate backup codes”; the previous codes stop working. If the phone with the app is gone, sign in with a backup code, switch off the second step with “Disable 2FA” and set it up again with the new device right away. Where the codes are kept decides whether this route works in an emergency:
- Printed in a sealed envelope in a lockable place, labeled with the date the list was created
- In the personal password manager of the person who owns the account, not in the team's shared folder
- Not as a photo on the same smartphone that runs the authenticator app
- Not in the email inbox, otherwise anyone who takes over the inbox would hold codes and contacts in one place
- After every regeneration, destroy the old printout and record the new storage place in the emergency plan
There is no “forgot password”
Keeping an eye on active sessions
Every sign-in that was not ended remains as a session: the laptop in the home office, the tablet in the workshop, the computer the temporary help used over the summer.
In the “Active sessions” card, XICflow lists every open sign-in with an identifier made of browser and operating system and the time under “Last active”. The session you are working in is marked “This session”. You sign out individual devices with “Sign out”; as soon as there is more than one session, “Sign out all others” appears and ends all the rest at once (XICflow documentation). Important for everyday use: “Sign out” in the account menu only ends the session of the device you are sitting at. On other devices you stay signed in; those sessions can be ended from the list or by changing the password, which signs out every other session.
A look at the attack routes shows why this matters. According to ENISA, malware that harvests credentials from computers mainly serves credential theft, the hijacking of running sessions and the resale of access (ENISA Threat Landscape 2025). A hijacked session needs neither password nor code. How long a session may last at most is not prescribed for every service. As a point of reference, NIST recommends for US government systems with two-factor sign-in a new sign-in after 24 hours at the latest and a sign-out after at most one hour of inactivity (NIST SP 800-63B-4). A small business does not have to adopt these values, but they show that a sign-in left open for months on someone else's device should not be the norm.
Scroll table sideways
| Occasion | What you do in XICflow | Where |
|---|---|---|
| Smartphone lost or stolen | Sign in with a backup code, remove the device's passkey, set up two-factor sign-in again and sign out the device's session | “Passkeys”, “Two-factor authentication (2FA)”, “Active sessions” |
| Unknown device in the list | Sign out the session and change the password; this signs out every other session | “Active sessions”, “Change password” |
| Laptop goes in for repair | Sign out on the device beforehand or end the session from the list | Account menu, “Active sessions” |
| Temporary help or intern leaves | Remove the member; this ends all of that person's sign-ins | “Team” area |
| List of backup codes left lying around | Regenerate backup codes, the old ones stop working | “Two-factor authentication (2FA)” |
| Password leaked somewhere else | Change the password, check two-factor sign-in, use the passkey as the main route | “Change password”, “Passkeys” |
Connected accounts and the last external route
Besides password and passkey, an account can be reachable through an external sign-in service. The “Connected accounts” card lists these links with the address stored there, and “Disconnect” releases one of them.
You can only disconnect the last external route if a password is set or a passkey is registered for the account; otherwise XICflow rejects the action with a note to add a passkey first (XICflow documentation). The lock prevents anyone from shutting themselves out while tidying up. For the business it raises a simple question: which account does the website access actually depend on? A connected account is only as well protected as its own sign-in. If it is a private account with an old password and no second factor, the website account inherits exactly that weakness. For owners the same applies as for domain and mailbox: the access belongs to an address of the business whose mailbox is itself well protected. What happens when the contact address at the domain leads nowhere is described in Losing your domain: causes and safeguards; how to set up domain and business mailbox properly is covered in Domain and business email basics.
Shared devices at the front desk and in the workshop
Many businesses have devices that several people work on: the computer at a practice's front desk, the tablet in the workshop, the laptop in the shop that also handles orders.
Things get tricky there when one person's website account stays signed in permanently or a personal passkey sits in the shared device account. Then anyone who unlocks the device can edit and publish pages in that person's name, and the wrong name ends up in the change history. Three rules keep this under control:
Front desk computer
Personal passkeys do not belong on the shared computer. There, staff sign in with password and code and sign out again at the end of the shift via “Sign out” in the account menu. Passwords for the account saved in the browser are deleted.
Workshop tablet
Anyone who only needs to read incoming enquiries there does not need the right to publish. The “Viewer” role may look at everything and export, but change nothing; setting the status of an enquiry takes “Editor” or higher.
Personal device at home
A passkey on your own device is fine if it is locked with your own PIN or biometrics. A family computer with a shared user account, on the other hand, is a shared device and is treated as one.
Anyone who brings in temporary help for the season should plan that access as limited from the start. Each person gets their own access with the smallest suitable role, and on the last working day the member is removed. XICflow then deletes the person's account, ends all of their sign-ins and frees the seat; the website content stays unchanged (XICflow documentation). Roles, invitations and removal are described in the documentation on requests and team. How businesses address temporary staff on their website is covered in Mini-job earnings limit 2027: job ads for temporary help; how a practice relieves its front desk through the website is the subject of Psychotherapy practice website: phone hours and waiting list. How many people can have their own account at the same time depends on the plan; the team seats per plan are listed in the features overview.
Duty or extra: what law and statistics say
The General Data Protection Regulation does not prescribe a particular sign-in technology.
But anyone who receives enquiries containing personal data through the website, such as a brokerage through its enquiry form and initial disclosure, has to take appropriate technical and organizational measures; where appropriate, these include a process for regularly testing, assessing and evaluating their effectiveness (Article 32 GDPR). A passkey, active two-factor sign-in and a regular look at the session list are such measures, and a fixed date in the calendar makes their regular review traceable. The rules are stricter for businesses covered by the German NIS-2 implementation. Important entities include, among others, companies from the sectors listed in the law that employ at least 50 people or have an annual turnover and an annual balance sheet total of more than 10 million euros each (Section 28 BSIG). For them, the use of multi-factor or continuous authentication solutions is one of the minimum measures (Section 30 (2) no. 10 BSIG). Most small businesses are not covered, but the catalog works as a point of reference for your own business.
How far businesses in Germany have come is shown by the European statistics office's survey on ICT usage in enterprises. A sign-in combining at least two methods was used in 2024 by 35.4 percent of micro businesses with fewer than ten people employed, 39.8 percent of companies with 10 to 49 people employed and 81.9 percent of companies with 250 or more, in each case excluding finance, agriculture and mining (Eurostat). Among companies with 10 to 49 people employed, the share was still 28.7 percent in 2022 (Eurostat). So the direction is right. In small businesses in particular, where one person looks after website, domain and mailbox on the side, the second factor is still often missing, and often it is exactly this one account that everything else depends on.
The quarterly account check
- Review sessions. Under “Active sessions”, match every line to a device. Whatever nobody recognizes is signed out, and then the password is changed.
- Check passkeys. Does every name still match an existing device? Remove entries for sold, lost or retired devices.
- Count backup codes. Note the number under “Backup codes left:”. If it has dropped without anyone needing a code, regenerate the codes and change the password.
- Look at connected accounts. Does every link still belong to an address of the business, and is that account itself protected with a second factor?
- Reconcile the team. Does every person in the “Team” area still have a reason to be there, and the right role?
- Update the emergency plan. Where are backup codes and security keys kept, who may open the envelope, who stands in during vacation?
The check fits well with dates that are coming up anyway: the quarterly close, the test of the backup or the return of keys when a mini-job ends. How a website backup is restored in an emergency is described in Website backup and restore plan. In XICflow all the building blocks for this are in the account: passkeys with their own name per device, two-factor sign-in with eight single-use backup codes, the list of active sessions with “Sign out all others” and roles that grade rights by task. What the builder offers beyond that for website, enquiries and team is shown on the features page.