Protect Your Website from Hacking: A Practical Security Checklist

Most hacked websites are not targeted because they are important. They are compromised because they run an outdated plugin or use a weak password that automated tools can exploit. This guide lists the steps a site owner controls, in order of priority, and explains where your hosting company's role starts and ends.

1. Know who is responsible for what

On shared hosting, the hosting company secures the server and operating system, while your website files, plugins and passwords remain your responsibility. On a Linux VPS, Windows VPS or dedicated server it is different: under EngHosting's acceptable use policy, once the login details are delivered the server becomes the customer's full responsibility, including files, updates, protection and settings, and managing the server from the inside is a separate service. Knowing this split defines your task list before anything else.

2. Updates come first

Known vulnerabilities in content management systems such as WordPress, and in their plugins and themes, are the most common way in. Attackers do not need to discover anything new; they simply scan for sites that have not been updated.

• Update WordPress core, plugins and themes as soon as security releases appear, and test major updates on a staging copy where possible.
• Delete unused plugins and themes instead of just deactivating them; a file left on the server can be exploited even when disabled.
• Never install "premium" themes or plugins from unofficial sources; many of those copies contain hidden malicious code.
• On a VPS: update the operating system and packages regularly, and follow kernel security updates.

3. Strong passwords and two-factor login

Use a long, unique password for every account: cPanel, your site's admin panel, email accounts, the database and FTP accounts. Reusing one password means a single leak opens everything else. A password manager makes this practical without memorising anything.

Turn on two-factor authentication in cPanel, in your site's admin panel and in the client area wherever it is available. This step alone blocks most login attempts even when a password is known.

4. Least privilege everywhere

• Give each user of your site's admin panel the lowest role they need; an author does not need administrator rights.
• Set file permissions to 644 and folders to 755 as a general rule, and never use 777.
• Create a separate FTP account for each developer or agency and delete it as soon as the work is done.
• On a VPS: use SSH keys instead of passwords, disable direct root login, and open only the firewall ports you actually need.

5. Server-level malware scanning

Tools such as Imunify360 add a firewall and malware scanning at server level. According to EngHosting's plan pages, this protection comes with shared hosting and WordPress hosting from the Advanced plan upwards and with the reseller plans, and VPS or dedicated server owners can add it from the extra services, together with tools such as CXS and KernelCare. We explain what each tool does and who needs it in our server security add-ons guide.

6. HTTPS on every page

An SSL certificate encrypts data between the visitor and your site, such as passwords and contact form details. It does not stop hacking on its own, but it prevents data from being intercepted in transit, and browsers warn visitors about unencrypted pages. If parts of your site still load over HTTP, follow our steps for moving a website to HTTPS.

7. Backups are your recovery plan

No protection is perfect, so you must be able to restore your site to a clean state. EngHosting's acceptable use policy states that customers are responsible for taking regular backups of their data, especially if they are not subscribed to one of the backup plans. Keep at least one copy outside the hosting account itself, and test a restore before you need it. Read about backup types and the 3-2-1 rule, then how to take and restore a backup in cPanel.

What to do if you find a hack

• Change every password immediately: cPanel, the site's admin panel, the database, email and FTP accounts.
• Do not delete files at random; keep a copy of the current state so the entry point can be identified.
• Restore the last clean backup, then update all plugins and themes before reopening the site.
• Contact technical support to scan the account at server level and review the logs.

A ten-minute monthly review

• Are any security updates pending for the site, its plugins or the operating system?
• Are there users or FTP accounts that are no longer needed?
• Is two-factor authentication enabled on the important accounts?
• When was the last backup taken, and has a restore been tested?
• Has the scanner raised alerts, or have you noticed unusual email activity?

Useful links: Shared Hosting, Linux VPS, Domain Registration, Contact Us.