Last updated: November 10, 2026.
Website security has two parts: the server side (the hosting company's job) and the site side (your job). If both are not right, protection stays incomplete. In this guide we explain both sides and what to do if your site is hacked.
What we protect on the server
- Firewall (iptables): only the necessary ports are open, unauthorized access is blocked
- Fail2Ban: blocks IPs that make repeated failed login attempts
- CSF: additional network protection and port scan detection
- ClamAV: scans files for malware
- Automatic updates: system security patches are applied on time
- Backup: data is backed up regularly
- Free SSL: your site works over HTTPS
What are SSL, backup and a firewall for?
- SSL (HTTPS): encrypts the data between the visitor and the site. It matters for login forms, payments and contact forms, prevents the browser's "not secure" warning, and search engines prefer HTTPS sites.
- Backup: lets you return the site to its previous healthy state after a hack, an accidental deletion or a failed update. Without a backup, recovery is sometimes impossible.
- Firewall: filters the traffic coming to the server and blocks suspicious requests.
Steps you should take
- Use strong and different passwords. Do not use the same password everywhere; a password manager can help.
- Update WordPress, themes and plugins. Most attacks come through outdated plugins.
- Delete plugins and themes you do not use. Simply deactivating them is not enough.
- Enable two-factor authentication for the admin panel login.
- Download plugins and themes only from trusted sources. Stay away from cracked ("nulled") versions.
- Keep your own backup too, at least before important changes.
- Check that the site redirects to HTTPS.
Extra rules for WordPress
- Do not use "admin" as a username.
- Install a plugin that limits login attempts.
- Delete user accounts you do not use and give the others only the role they need.
- Check the site's files regularly through the panel, and investigate any file you do not recognize right away.
How do I know my site is hacked?
- Posts, links or ads that you did not put appear on the site.
- In Google search your site's title or description shows strange text.
- Visitors are redirected to unknown sites.
- The site suddenly became slow or the browser shows a warning.
- Files or users you do not recognize appear in the hosting panel.
What to do if the site is hacked
- Change all passwords right away (panel, FTP, database, admin).
- Open a ticket with the support team and we will check together.
- Restore from a clean backup and apply updates.
- After restoring, update plugins and themes and delete the unneeded ones.
Security checklist
- HTTPS works on the site.
- All passwords are strong and different.
- WordPress, themes and plugins are up to date.
- Two-factor authentication is enabled.
- Daily backup works and restoring has been tested.
- Unneeded plugins and users are removed.
The 3-2-1 backup rule
To make backups reliable, use the simple "3-2-1" rule:
- 3 copies: the live site and two backup copies.
- 2 different places: for example the hosting backup and your own computer or cloud storage.
- 1 copy off the server: so the data remains even if the server is completely damaged.
Also check from time to time that the backup can actually be restored. A backup that has never been tested cannot be considered reliable.
Password rules in practice
- Choose a password of at least 12–16 characters mixing letters, digits and symbols.
- Do not use easy-to-guess information such as a birth date, phone number or company name.
- Use separate passwords for the hosting panel, FTP, database, WordPress admin and email.
- Keep passwords in a password manager, not in a notepad or a messaging app.
- Do not send your password to anyone, even someone claiming to write from "support". Real support does not ask for your password.
Phishing and fake messages
A large share of attacks target people, not servers. A fake message with an urgent warning such as "your hosting will be blocked" or "your domain is expiring" sends you to a fake login page. Protection rules: check the sender's address carefully, hover over a link to see the real address before clicking, check that the browser address is correct on the login page and, if in doubt, log in to your account directly by typing the address yourself.
File permissions and protecting the admin panel
- In WordPress, keep file permissions at 644 and folder permissions at 755. Do not give open-to-everyone permissions such as 777.
- Keep configuration files (for example
wp-config.php) open only to the level that is needed. - Limit login attempts to the admin panel and delete unneeded user accounts.
- Where possible, use an encrypted (SFTP) connection instead of plain FTP.
Monthly security routine
- Apply all updates (WordPress, themes, plugins).
- Check that the backup is running and test a restore once a month.
- Review the user list and delete unneeded accounts.
- Open the site from several devices and check for unusual behaviour, ads or redirects.
- Check the expiry dates of the SSL certificate and the domain.
Common SSL problems
- Mixed content: the page opens over HTTPS, but some images or scripts load over HTTP. The browser shows this with a warning. Switch all links to HTTPS.
- No redirect from HTTP to HTTPS: the site opens at two addresses, which is bad for both security and search engines.
- www and non-www address: make sure both are covered by the certificate and redirect to each other.
Frequently asked questions
Should I take backups myself too?
Yes. Hosting backup is the main layer of protection, but keeping your own copy before important changes is the safest way.
If SSL is free, is it lower quality?
No. Free SSL encrypts the data at the same level. Free SSL is included in our hosting packages.
Is deactivating a plugin enough?
No. A deactivated plugin's files stay on the server and can still pose a risk. Delete the plugin you do not use completely.
How often should I take backups?
For frequently changing sites (stores, news sites) daily backups are advisable, for rarely changing sites weekly. Take an extra copy before any big change.
Our hosting packages include free SSL and daily backups. For questions about security features, contact support. If you use a VPS, also see the article What is a VPS server about server security.