GoDaddy touted its web hosting services as “Ridiculously fast. Seriously secure.” The FTC found that statement deceptive because three breaches proved the company’s security was critically flawed and inadequate. Last month, the FTC’s settlement with GoDaddy included multiple requirements to secure application programming interfaces (APIs), which are the data gateways that have proliferated in an era of cloud-based applications and AI. This article examines noteworthy provisions in the GoDaddy settlement, discusses benchmarks for API security addressed in a Salt Labs survey published last week and offers fundamental API security steps that companies can consider. See “Restricting Super Users and Zombie IDs to Increase Cloud Security” (Jul. 31, 2024).