Most authors think about protecting their work in terms of copyright. Far fewer think about the accounts that hold that work: the KDP dashboard where royalties land, the email inbox that resets every other password, the cloud folder with five years of manuscripts, the newsletter platform with the reader list you spent years building. Lose control of one of those and the damage is rarely dramatic. It is slow, expensive and exhausting to undo.

This guide walks through a practical security setup for working writers. None of it needs technical training, most of it is free, and the whole thing can be done in an afternoon.

Disclosure: this article contains an affiliate link. If you buy through it, Freyja Publishing may earn a commission at no extra cost to you. It does not change what we recommend. See our Affiliate Disclosure for details.

Why Authors Are a Target

Independent authors run small businesses, usually alone, and usually without an IT department. That combination makes them attractive. A self-published author’s online footprint typically includes:

• A retailer account (Amazon KDP, Kobo, Apple Books, Draft2Digital) connected to a bank account
• An email address published on a website, in back matter and on social profiles
• A mailing list platform holding thousands of reader email addresses
• Cloud storage holding unpublished manuscripts, cover files and contracts
• Social media accounts that are often the main way readers find new releases

The most common problems are not elaborate hacks. They are reused passwords, phishing emails dressed up as “your book has been flagged” notices, and logging in over public Wi-Fi at a conference, café or airport. Each has a simple fix.

Step 1: Secure the Email Account First

Your email account is the master key. Almost every other service lets you reset a password by email, so whoever controls your inbox can, in time, control everything else. Start here.

• Give it a long, unique password that you use nowhere else.
• Turn on two-step verification, ideally with an authenticator app rather than text messages.
• Check the recovery details. Make sure the backup phone number and backup email are current and belong to you.
• Review connected apps and remove anything you no longer use.

It also helps to keep a separate, private address for account logins and a different, public-facing address for readers and business enquiries. If the public address is targeted by phishing, your logins are not sitting in the same inbox.

Step 2: Stop Reusing Passwords

When a website suffers a data breach, the leaked email and password combinations are routinely tried on other sites. If your newsletter platform password is the same as your KDP password, one breach becomes two problems.

Nobody can remember dozens of unique, strong passwords, which is why a password manager is the single most useful security tool an author can adopt. It generates a different password for every account, stores them in an encrypted vault and fills them in for you. You remember one strong master password; it remembers the rest.

When choosing one, look for:

• Apps for every device you write on, including your phone
• Support for two-step verification codes
• Secure sharing, if an assistant, co-author or cover designer ever needs access to a specific login
• Breach alerts that tell you when a saved password has appeared in a leak

Step 3: Turn On Two-Step Verification Everywhere It Matters

Two-step verification means a stolen password alone is not enough to get in. Prioritise these accounts:

1. Your email account
2. Retailer and distributor dashboards (anything that pays you)
3. Your bank and payment accounts, including PayPal and Stripe
4. Your mailing list platform
5. Your website’s admin login
6. Social media accounts you use for book promotion

Store the backup codes each service gives you somewhere safe and offline, or in your password manager. They are what gets you back in if you lose your phone.

Step 4: Be Careful on Public Wi-Fi

Writers work everywhere: libraries, cafés, writing retreats, hotel rooms and conference halls. Public Wi-Fi networks are convenient, but you have no control over who runs them or who else is connected. A network called “Free Café WiFi” may not belong to the café at all.

A virtual private network (VPN) encrypts the connection between your device and the internet, so other people on the same network cannot read what you send. For an author, that means you can check royalties, update a book listing or answer business email from a public network with far less exposure.

A VPN also helps when you travel. Some retailer and banking sites flag logins from unfamiliar locations; a VPN lets you connect through a server in your home country so your accounts see a familiar location.

If you want a straightforward option, NordVPN (affiliate link) offers apps for computers, phones and tablets, covers several devices on one subscription, and can be set to connect automatically whenever you join an untrusted network. Whatever provider you choose, look for:

• A clear no-logs policy that has been independently audited
• Apps for all your devices and an automatic “connect on untrusted Wi-Fi” setting
• A kill switch that blocks traffic if the VPN connection drops
• Servers in the countries you travel to and the country you live in
• A money-back guarantee, so you can test it on your own devices

A VPN is not a cure-all. It will not stop you clicking a phishing link or reusing a password, which is why it belongs in this list rather than at the top of it.

Step 5: Learn the Author-Specific Phishing Patterns

Scammers know what authors care about, and their emails are written to trigger urgency. Common patterns include:

• Fake retailer notices claiming your book has been blocked, reported or flagged for copyright, with a link to “verify your account”
• Too-good-to-be-true offers from “film producers”, “audiobook studios” or “book clubs” that require an upfront fee
• Fake collaboration requests with attachments that are not what they claim to be
• Payment notices about royalties or invoices that ask you to log in through an emailed link

The rule is simple: never log in through a link in an email. Open a new browser tab, type the retailer’s address yourself or use your saved bookmark, and check your dashboard directly. If the notice is real, it will be there.

Step 6: Back Up Your Manuscripts Properly

Security is also about not losing your work. A practical backup routine for writers follows the familiar three-two-one idea: three copies of anything important, on two different kinds of storage, with one copy kept somewhere other than your home or office.

• Your working copy on your computer
• An automatic cloud backup that keeps previous versions, so an accidental overwrite or a ransomware infection can be rolled back
• A periodic copy on an external drive kept somewhere safe

Test the backup once in a while by restoring a file. A backup you have never restored is a hope, not a plan.

Step 7: Protect Your Reader List and Website

Your mailing list is one of the most valuable assets you own, and it is also personal data that readers have trusted you with. Use two-step verification on your email platform, limit who has login access, and export a copy of the list regularly so you are never locked out of your own audience.

If you run an author website, keep the software, themes and plugins updated, remove plugins you no longer use, and use a unique administrator username rather than “admin”. Publish a contact form rather than your personal email address, which keeps your inbox out of spam lists and scrapers.

What to Do If an Account Is Compromised

If you notice a login you do not recognise, a changed payment detail or emails you did not send, act quickly and in this order:

1. Secure your email account first: change the password from a device you trust and sign out of all other sessions.
2. Change the password on the affected account and turn on two-step verification if it was off.
3. Check payment and bank details on every retailer and distributor dashboard, and contact their support team through the official site if anything has changed.
4. Check your email for new forwarding rules or filters that someone else may have added.
5. Change any other account that shared the same password.
6. Tell your readers through your usual channels if your newsletter or social accounts sent anything unusual.

Keep a short note of what happened and when. Retailer support teams resolve cases faster when you can give them dates and details.

A One-Afternoon Security Checklist

• Change your email password to a long, unique one and turn on two-step verification
• Install a password manager and move your most important logins into it
• Turn on two-step verification for retailers, banks, your mailing list and your website
• Save backup codes somewhere safe
• Install a VPN on your laptop and phone and set it to connect on untrusted networks
• Set up automatic cloud backup for your manuscripts folder
• Export a copy of your mailing list
• Update your website and remove unused plugins

The Bottom Line

Running an author business means you are responsible for its security as well as its books. The good news is that a handful of habits — unique passwords, two-step verification, a VPN on public networks, and regular backups — close off most of the common problems. Do them once, review them once a year, and get back to writing.