What is least privilege?

Least privilege means giving each account only the access it needs to do its job, and nothing more:

• Not everyone is an administrator - administrator access should be the exception, held by the fewest people who need it.
• It limits the blast radius - a compromised account can only reach what it was allowed to reach.
• It applies to suppliers too - the bookkeeper needs the accounting file, not the domain registrar.

Review who holds administrator rights on your email and your website. It is usually more people than you expect.