Most attacks aren't aimed at a particular site — bots automatically scan thousands of sites on the internet and find outdated, poorly protected ones. That's why "my site is small, who'd want it?" is the wrong way to think: a hacked small site gets used to send spam, host fake pages or attack other sites. The steps below cut the risk considerably.
7 steps
- Keep everything up to date. WordPress core, the theme and plugins — old versions are the most exploited gap. How to update safely: How to update and protect your WordPress site.
- Delete plugins you don't use. A deactivated plugin can still be a threat — its files stay on the server.
- Strong, non-repeated passwords. Use different, long passwords for the admin panel, hosting and email, and use a password manager. A password leaked in one place gets tried in others.
- Two-step login (2FA). Even if the password is stolen, nobody can log in without the code from your phone.
- Regular backups. Having a backup isn't enough — check that restoring from it works (see the 3-2-1 rule).
- SSL (https). Visitors' data is sent encrypted, and the browser shows no warning. The certificate should renew automatically (why).
- Limit access. Give admin accounts only to people who need them, and close a departing employee's access immediately.
How can you tell a site has been hacked?
- When opened on a phone, the site redirects to another site (sometimes only for visitors coming from Google);
- Pages in a foreign language or on unrelated topics appear under your site's name in Google results;
- The browser or Google shows a "This site may be harmful" warning;
- Your host reports a sudden spike in resource use, or spam being sent from the site;
- Unknown users have appeared in the admin panel.
What should you do if it's been hacked?
- Don't panic and delete the site — you'll need the traces and the cause;
- Change every password (admin, hosting, FTP, database, email);
- Contact your host or technical support: the malicious code must be cleaned out, or the site restored from a backup taken before the infection;
- Close the hole — an old plugin, a weak password and so on. Otherwise the attack will be repeated;
- If there's a security warning in Google Search Console, request a review once the site is clean.
What should the hosting side provide?
Some attacks can be stopped before they ever reach the site: DDoS protection, malware scanning, and isolation between accounts. Our hosting plans include Cloudflare protection, and sites are scanned for malware with ImunifyAV+.
If you'd rather not do this yourself, our technical support packages take on updates, backups and monitoring: Services.
