Preventing hackers and cyberattacks

The methods hackers use to compromise websites and hosting accounts are constantly shifting. What worked as a defence a few years ago may no longer be enough, and attackers are increasingly automated, probing thousands of sites at once rather than targeting individuals by hand. If your site holds customer data, processes payments or simply represents your business online, the consequences of a breach go well beyond a temporary outage.

The good news is that most successful attacks exploit predictable weaknesses. Addressing those weaknesses does not require specialist knowledge, but it does require consistency. The steps below cover the areas where sites are most commonly compromised.

Keep software updated

Outdated software is one of the most common entry points for attackers. This applies to your CMS, plugins, themes and any server-side applications your site depends on. When a vulnerability is discovered in a piece of software, the developer typically releases a patch. The window between that disclosure and the patch being applied is when sites running the old version are most at risk, because the vulnerability is now public knowledge.

For WordPress sites, updates can be applied directly from the dashboard. If you are managing multiple sites, a tool like WP Toolkit makes it possible to update plugins and themes across all of them from a single interface. Our guide to how plugins compromise security covers this in more detail, including what to look for when choosing plugins in the first place.

Use strong, unique passwords

Weak passwords remain a significant problem. Credential stuffing attacks, where lists of username and password combinations leaked from other breaches are tested against new targets, are now largely automated. If you reuse passwords across accounts, a breach on one platform can expose all of them.

A strong password is long, random and not based on dictionary words or personal information. A password manager removes the burden of remembering unique credentials for every account. For hosting control panels, admin accounts and email, this is non-negotiable. Where two-factor authentication (2FA) is available, turn it on. It adds a second verification step that makes stolen passwords far less useful to an attacker.

Install an SSL certificate

An SSL certificate encrypts data transmitted between your site and its visitors. Without one, information submitted through forms, including login credentials and payment details, travels in plain text and can be intercepted. Beyond the security benefit, browsers now flag sites without SSL as “Not Secure”, which affects visitor trust and can influence search rankings.

SSL certificates are available for most hosting plans. If you are on cPanel hosting, AutoSSL can handle installation and renewal automatically. You can find out more about the options available on our SSL certificates page.

Back up your site regularly

Backups do not prevent attacks, but they determine how quickly you recover from one. Ransomware, defacement and accidental data loss all become far less damaging when you have a recent, clean copy of your site to restore from. A backup stored only on the same server as your site offers limited protection if that server is compromised.

Aim for daily backups stored in a separate location. Check periodically that your backups are actually completing and that the files can be restored. A backup you have never tested is a backup you cannot rely on. Our knowledgebase covers backing up WordPress if you need a starting point.

Limit login attempts and access

Brute force attacks work by trying large numbers of password combinations until one succeeds. Limiting the number of failed login attempts before an IP address is temporarily blocked cuts this off at the source. Most security plugins for WordPress include this as a standard feature.

Restricting access to sensitive areas of your site is equally worthwhile. If your hosting control panel or WordPress admin area does not need to be accessible from every location, IP allowlisting adds a layer of protection that is difficult to bypass even with valid credentials. Remove user accounts that are no longer needed, and audit permissions regularly so that access reflects what people actually require.

Use a web application firewall

A web application firewall (WAF) sits between your site and incoming traffic, filtering out requests that match known attack patterns. This includes SQL injection attempts, cross-site scripting and probing from known malicious IP addresses. A WAF does not replace the other measures above, but it adds a meaningful layer of automated filtering that catches a large proportion of common attacks before they reach your site.

Services like Cloudflare offer WAF functionality at the DNS level, meaning traffic is filtered before it reaches your server. Some hosting plans include firewall protection at the server level. Our post on better website security covers additional measures worth considering alongside a WAF.

Monitor for suspicious activity

Knowing when something has gone wrong is as important as trying to prevent it. Access logs record every request made to your site and can reveal unusual patterns, such as repeated failed logins, unexpected file access or traffic spikes from unfamiliar locations. Most hosting control panels give you access to these logs directly.

For WordPress sites, a security plugin that monitors file integrity and alerts you to changes in core files can catch compromises early. The sooner you identify a breach, the less damage it causes and the faster you can recover. Our knowledgebase article on removing malware from WordPress is worth bookmarking before you need it.

Protecting your site is an ongoing process rather than a one-time task. Keeping software current, using strong credentials, maintaining backups and monitoring for unusual activity together form a baseline that addresses the majority of common attack vectors. None of these steps are complicated, but skipping any one of them leaves a gap that attackers will find.

If you are looking for hosting with security built into the platform, take a look at our secure hosting plans.

If you have questions about securing your hosting account or site, our team is available via the contact page.