Principles that apply regardless of platform.
THE ESSENTIALS
Keep everything updated: core, themes, extensions
Remove what you do not use, rather than disabling it Strong unique administrator passwords Two-factor authentication where available An administrator username that is not admin or your domain name
Correct file permissions: 755, 644, 600 for configuration
Never nulled software
PROTECTING THE ADMIN AREA
Limit login attempts Change the login URL where the platform allows it Add cPanel Directory Privacy in front of the admin directory, so bots never reach the application
USER MANAGEMENT
Give each person their own account Use the lowest role that lets them work Remove accounts when people leave Review the user list periodically; an administrator you do not recognise is a compromise
CONFIGURATION
Debug mode off Error display off, logging on Credentials in a file outside the web root, or blocked by .htaccess
BACKUPS
Off the server, tested, with enough retention to predate a slow-burning infection.
