Quick answer
- Most website hacks come from weak passwords, outdated software and vulnerable plugins, not from sophisticated attacks on the server.
- Keep everything updated, use strong unique passwords with two-factor authentication, and remove unused plugins and themes.
- Choose a host with a firewall, malware scanning, isolated accounts and automatic backups.
- Keep off-site backups so you can restore quickly if something goes wrong.
Whether you’re on shared hosting or run your own server, security is mostly about good habits. Here’s a practical checklist, starting with the steps that prevent the most problems.
1. Keep software updated
Update WordPress, plugins, themes and PHP. Many attacks target known bugs that have already been fixed.
2. Use strong logins
- Unique, long passwords stored in a password manager.
- Two-factor authentication on WordPress, your host and your domain registrar.
- Don’t share admin accounts. Give each person their own login with only the access they need.
3. Remove what you don’t use
Delete inactive plugins, themes and old staging copies.
4. Use HTTPS everywhere
Install a free SSL certificate and force HTTPS. See SSL certificates explained.
5. Add a web application firewall
A WAF blocks common attacks before they reach your site. Many hosts include one, and services like Cloudflare offer one too.
6. Scan for malware
Use your host’s scanner or a security plugin.
7. Back up off-site
Keep automatic backups in a separate location and test a restore occasionally.
8. Use secure file access
Use SFTP rather than FTP, and set correct file permissions.
9. Choose a secure host
For example, HostArmada includes a web application firewall and daily backups, and Rocket.net includes a WAF and malware protection (checked November 2026).
- Account isolation on shared servers.
- Server-level firewall and malware scanning.
- Automatic daily backups.
- Quick security updates.
If your site is hacked
- Change all passwords.
- Restore a clean backup.
- Update everything.
- Ask your host’s support for help and a malware scan.
FAQs
Most often through weak passwords, outdated software and vulnerable plugins.
Good hosts isolate accounts and add firewalls, but your own habits matter most.
It helps, especially if your host doesn’t include malware scanning.
A web application firewall that filters malicious traffic.
Daily for active sites, stored off-site.
It encrypts data in transit, but you still need updates, strong logins and backups.
