Your Kajabi account holds your sites, contacts, and settings, so keeping it secure protects your whole business.
Use this article to build good security habits, recognize phishing emails, spot signs that someone else got into your account, and lock them out. If someone is in your account right now, go straight to "Resolve a compromised login" on this page.
Prevent unauthorized access
To prevent unauthorized access to your Kajabi account, build the habits in this section. Each one makes it harder for someone else to get in, or limits the damage if they do.
Use strong passwords and 2FA
To protect your Kajabi login, use a long, unique password and turn on two-factor authentication (2FA). 2FA asks for a code after your password, so a stolen password isn't enough to get in.
We recommend a trusted password manager to create and store a different long password for every account you use, including your email, Kajabi, bank, and payment processor. You can test how strong a password is with a tool like security.org.
For the rules a Kajabi account password must follow, see "Password strength, reuse, and expiry rules" in Log in to a Kajabi account. To turn on 2FA, follow "Set up 2FA" in the same article.
We also recommend turning on 2FA for your email account and anywhere else it's offered, with recovery options set up. Anyone who can open your email inbox can reset your Kajabi password.
Give each person their own login
To keep your Kajabi account secure when other people help you, give each person their own account user login instead of sharing yours. That way no one shares passwords or 2FA codes, and you can suspend one person's login without changing your own.
Limit permissions
Don't give an account user the Co-owner or Administrator role unless it is necessary. To add account users and pick their roles, see Add and manage account users.
Recognize phishing emails
Phishing emails pretend to come from a company you trust, such as Kajabi, to get your password, 2FA code, payment details, or personal information. They often sound urgent or ask for payment.
To protect your Kajabi account from phishing:
Don't click links in emails that seem urgent or ask for payment. Instead, go to the Kajabi login page in your browser and check your account there.
Never share your password, 2FA code, or personal information (such as a Social Security number or card number) by email, phone call, text message, or chat.
Don't post personal or sensitive information on your public website.
If you're not sure whether a message is really from Kajabi, contact Kajabi Support before you reply or click anything.
Warning:
Kajabi never asks for your password or your 2FA code. If someone asks you for either one, reset your password and contact Kajabi Support.
Keep devices and connections secure
To protect the devices and connections you use for your Kajabi account, build these habits:
Turn on antivirus software (such as Windows Defender) and a firewall on your computer.
Keep your operating system, browser, and apps up to date. Updates fix security holes that could let someone watch or control your device.
Log out of your Kajabi account when you finish working on a shared or public computer.
Avoid public WiFi when you work in your Kajabi account, or in any account with sensitive information like your bank, because someone on the same network can intercept your data. If you need to work in public, we recommend a virtual private network (VPN) or a mobile hotspot that you control.
Back up important data
We recommend backing up important Kajabi data, like your contacts, regularly. That way you still have a copy if your device is compromised or someone changes something in your account.
To download your contacts, see Export contacts. For other site content, see Back up site content.
Signs of unauthorized access
These emails from Kajabi can be signs of unauthorized access, meaning someone else is using your login:
An email with the subject line Your Kajabi user password has been updated when you didn't change your password.
An email with the subject line Email change requested when you didn't change your email address. Kajabi sends this email to the old address, and to the account owner if an account user's email changed. If this happens, contact Kajabi Support right away.
An email with the subject line Account Blocked when you didn't try to log in. Someone tried to log in with wrong passwords.
Changes you didn't make in your Kajabi account can also be signs of unauthorized access:
Contacts were imported or deleted, or email campaigns appeared that you didn't create.
The site title, plan, or billing details changed.
Account users you don't recognize appear in the account.
If you think someone got into your account but you haven't seen any of these signs, still follow the steps in "Resolve a compromised login" on this page.
Resolve a compromised login
To secure your Kajabi login after unauthorized access, do every step:
Go to the Kajabi login page and check that you can still log in.
Change your password:
If you can log in, change it in Account Settings > Sign In & Security.
If you can't log in, click Forgot your password? on the login page and reset it.
If the reset email doesn't arrive because someone changed your account's email address, or you still can't log in, contact Kajabi Support.
Click Disconnect next to any Google account you don't recognize in the Social Accounts section of Sign In & Security. Logging in with Google doesn't use your password, so a Google account someone else connected still works after you change your password.
Change the password for the email provider you use with Kajabi. Anyone who can open that inbox can reset your Kajabi password.
Check the Two-factor authentication (2FA) section in Sign In & Security:
If 2FA is off, turn it on using the steps in "Set up 2FA" in Log in to a Kajabi account.
If 2FA is already on, click Change and set 2FA up again. Changing 2FA removes every authenticator app and phone number on your account, including any the hacker added.
Suspend any account user you don't recognize in Settings > Manage Users. Suspending an account user blocks their login right away. For the steps, see Add and manage account users.
Contact Kajabi Support to report unauthorized access. Include the following:
The IP address (network address) of each account user. Find yours with a site like whatismyipaddress.com.
Whether you use a password manager.
Whether you share login details with anyone, such as a service provider or colleague.
Whether you use the same email and password on other sites (email, bank, social media).
The changes you found.
Resolve a compromised account user's login
If someone else got into an account user's login, follow these steps to secure your account user's login:
Suspend the account user right away. Suspending logs them out everywhere and stops any more changes.
Ask the account user to reset their password with Forgot your password? on the Kajabi login page. They can do this while they're suspended, but they can't log in until you unsuspend them. Use this instead of the Reset password button on their account user page, because that button asks for the current password at the next login, and the other person may know it.
After they've changed their password, unsuspend the account user.
Ask the account user to check the Social Accounts section in Account Settings > Sign In & Security and click Disconnect next to any Google account they don't recognize. Logging in with Google doesn't use a password, so a Google account the other person connected still works after the password reset.
If the account user thinks someone else has their 2FA device, ask them to reset 2FA. See "Reset 2FA from the login page" in log in to a Kajabi account.