Most compromised websites are not sophisticated targets. They are ordinary sites running software that was out of date, found by an automated scanner. The defences are correspondingly ordinary.
- Update everything, promptly. Core, plugins, themes. Outdated plugins are the single largest cause of hacked sites we see.
- Delete what you are not using. A deactivated plugin still has files on disk, and those files can still be exploited.
- Use unique passwords everywhere. A password manager makes this effortless.
- Turn on two-factor authentication on cPanel, your client area and your website admin.
- Never use admin as a username. It removes half the work for an attacker.
- Keep SSL on and force HTTPS so logins are never sent in the clear.
- Check your own backups restore. An untested backup is a hope, not a plan.
- Limit who has access. Contributors do not need administrator accounts.
- Remove old installs. That test site in /old from 2019 is a live door into your account.
- Scan your own computer. Stolen FTP passwords usually come from malware on a laptop, not from the server.
None of this is glamorous. All of it works.
