Most hacked websites are not targeted personally. Bots scan millions of sites for weak passwords and outdated plugins. Covering a short list of website security basics stops the large majority of these attacks. This guide explains what to do, in order of impact, and which parts your hosting provider already handles.
Before you start
- Logins for your hosting account, control panel, CMS, domain registrar and email.
- A password manager.
Shared responsibility: host vs site owner
| Your host handles | You handle |
|---|---|
| Server OS and software updates | CMS, theme and plugin updates |
| Network and server firewalls | Passwords and two-factor authentication |
| Account isolation (CloudLinux on MdmHost) | Who has access to your accounts |
| Server-side malware scanning where offered | Removing unused plugins, sites and users |
| Daily server backups | Your own offsite backups and restore tests |
Secure every login
- Use a unique, long password for each account, stored in a password manager.
- Enable two-factor authentication on your hosting dashboard, cPanel, CMS admin, registrar and email.
- Never share one admin login. Give each person their own account with the lowest role that works.
- Remove accounts for former staff and freelancers.
Keep software updated
Outdated plugins and themes are the most common entry point. Turn on automatic updates for minor versions, check for updates weekly, and delete anything you do not use, including old test installs in subfolders. Use a supported PHP version, which you can select per site in cPanel.
Use HTTPS everywhere
Install a certificate on every hostname (free AutoSSL in cPanel), redirect HTTP to HTTPS and enable HSTS once everything works. HTTPS protects logins and form data in transit.
Back up and test restores
Backups are your safety net when everything else fails. Follow the 3-2-1 backup rule: host backups plus your own offsite copy, and test a restore regularly.
Add a web application firewall
A WAF blocks common attacks such as SQL injection, cross-site scripting and brute-force logins before they reach your application. Server-level ModSecurity rules are a good base, and a CMS security plugin or CDN firewall adds login protection and rate limiting.
Harden files and configuration
- Files usually
644, folders755, configuration files with passwords stricter where possible. Never use777. - Disable directory listing and file editing from the CMS admin.
- Keep secrets and backups outside
public_html. - Use SFTP instead of plain FTP.
Monitor and respond
- Set up uptime monitoring and Google Search Console, which warns about hacked content.
- Watch for warning signs: unknown admin users, new files, spam pages in search results, sudden outgoing email.
- If you are hacked: change all passwords, restore a clean backup or clean the site, update everything and find the entry point.
Tip: Put security reviews in your calendar: a quick monthly check of updates, users and backups prevents most emergencies.
Frequently asked questions
Is my website too small to be hacked?
No. Automated bots attack any site they can, to send spam, host phishing pages or mine resources.
Does an SSL certificate make my site secure?
It encrypts traffic only. It does not protect against weak passwords, outdated plugins or malware.
Should I install several security plugins?
No. One well-maintained security plugin plus server-side protection is better; overlapping plugins cause conflicts and slow the site.