Most hacked websites had a weak password, an outdated plugin or no backup. Work through this checklist once, then repeat the monthly part.
Each point links to the article with the exact steps. Tick off what you've done and come back to the rest later: every item makes an attack harder on its own.
Your logins
- A different, strong password for each login. Your client area, cPanel, every mailbox and the WordPress admin each need their own. A password manager creates and stores them for you. See Change your client area password and Change or reset your cPanel password.
- Two-factor authentication on the client area. A stolen password alone then isn't enough to get in. See Turn on two-factor authentication (2FA).
- Own logins for helpers. Give your web designer a user of their own instead of your password, and remove it when the work is done. See Give other people access to your account (users).
- A safe mailbox for your account email. Password resets go there. Protect it with a strong password and 2FA too.
Your website software
- Update WordPress, plugins and themes, and turn on automatic updates. Most break-ins use a security hole that an update had already fixed. See Update WordPress, plugins and themes.
- Delete what you don't use. A switched-off plugin or theme can still be attacked while its files are on the server. Old test copies and forgotten installs in subfolders count too.
- Apply the WordPress security measures in cPanel's WordPress Management. See Secure your WordPress site from cPanel.
- Use a supported PHP version. Old PHP versions no longer get security fixes. See Change the PHP version and PHP settings.
- Get plugins and themes only from their official source. Free copies of paid ("nulled") plugins often contain malware.
Your server settings
- HTTPS everywhere. Check that your certificate is valid and send all visitors to HTTPS. See Free SSL: check and fix your certificate (AutoSSL) and Redirect HTTP to HTTPS.
- Password-protect private folders, such as a test site or an admin area that only you use. See Password-protect a folder.
- Block attackers you can see in your logs, for example an IP address that tries to log in hundreds of times. See Block an IP address.
- Keep file permissions tight. Folders 755 and files 644 is the usual setting; never set 777. See Manage files: edit, move, zip and set permissions.
Your backups
- Make your own backups and keep a copy on your computer. For WordPress, use Back Up / Restore in WordPress Management and download the file (see Back up and restore a WordPress site). For other sites, download the site's folder from File Manager and export the database in phpMyAdmin (see Open and manage a database in phpMyAdmin).
- Make a backup before every big change, such as a WordPress update, a new theme or a PHP version change.
- Keep several backups, not only the newest. Malware is often found weeks after it arrived, and a fresh backup may already contain it.
Every month
- Install waiting updates in WordPress Management.
- Check the malware scanner: Scan your website for malware with Imunify360.
- Make a backup and download it.
- Look through Account > User Management in the client area and the WordPress users, and remove anyone who no longer needs access.
- Glance at the error log for anything new and strange (see View the error log).
Common problems
Your site already shows signs of a hack
Strange redirects, unknown pages or a malware warning mean it's too late for prevention. Follow Your website was hacked: what to do first, then come back to this checklist to close the hole.
An update broke your site
Restore the backup you made before the update, then update one plugin at a time to find the one that causes it. Don't stay on the old version for long: the update usually fixes a security problem.
You get an email that asks for your password
We never ask for your password. See Spot fake emails that pretend to be from ElySpace.
Related articles
- Security tips for your ElySpace account
- Secure your WordPress site from cPanel
- Scan your website for malware with Imunify360
- Your website was hacked: what to do first
Still stuck? Open a support ticket and we'll help.
