Most hacked websites are not hacked by geniuses. They are hacked through old plugins, weak passwords and small settings nobody checked. This guide gives you a simple server security checklist in plain words, explains which parts your host handles and which parts are yours, and shows how to keep your email off spam blacklists.
Quick answer
Keep everything updated, use strong passwords with two-factor login, keep off-site backups, and run a malware scanner. If you have your own server, also hide your server and PHP version numbers. To protect your email, set up SPF, DKIM and DMARC and check that your domain is not on spam blacklists.
Who is responsible for what?
Security is shared between you and your host. What you need to do depends on your type of hosting:
|
Task |
Shared or managed hosting |
VPS or dedicated server |
|---|---|---|
|
Server software updates |
Your host |
You (unless managed) |
|
Firewall and DDoS protection |
Your host |
You or your host |
|
WordPress, plugins and themes |
You |
You |
|
Passwords and logins |
You |
You |
|
Backups |
Your host, plus your own copy |
You |
|
Server settings (versions, PHP) |
Your host |
You |
If you are not technical, shared or managed hosting is safer because experts handle the server side for you. See how to choose web hosting.
The simple server security checklist
- Update everything. Keep WordPress, plugins, themes and PHP up to date. Old plugins are the most common way in.
- Delete what you do not use. Remove unused plugins, themes and old test sites.
- Use strong, unique passwords. Use a password manager so every account has its own password.
- Turn on two-factor login (2FA). For your hosting account, WordPress admin and domain registrar.
- Keep off-site backups. Store at least one backup outside your hosting account, so you can restore if the server is hacked.
- Run a malware scanner. Many hosts include one. Plugins like Wordfence also work.
- Use a web application firewall (WAF). It blocks many attacks before they reach your site. Many hosts and services like Cloudflare offer one.
- Check user accounts. Remove admin users you do not recognize.
- Check your redirects. Hackers sometimes add hidden redirects in your SEO plugin or .htaccess file. Look for strange entries pointing to odd websites or code.
- Use HTTPS everywhere. Free SSL protects logins and forms.
Hide your server and PHP version (VPS and dedicated servers)
By default, many servers show which software and version they run. Attackers use this to look for servers with known holes. Hiding it does not fix holes, but it makes you a less obvious target.
|
Software |
Setting to change |
Where |
|---|---|---|
|
Apache |
ServerTokens Prod and ServerSignature Off |
Apache config file |
|
Nginx |