Work through this list on every site you host with us. Most compromises we see come from skipping two or three of these items.
- Keep everything updated — core, themes and plugins. Out-of-date plugins are the most common entry point.
- Never install nulled themes or plugins. Cracked premium software almost always ships with a backdoor.
- Delete what you do not use. An inactive plugin is still code on the server and can still be exploited.
- Do not use "admin" as a username, and use a long unique password.
- Enable two-factor authentication for every administrator account.
- Limit login attempts so brute-force attacks are locked out.
- Disable the built-in file editor so a stolen login cannot be used to inject PHP.
- Use HTTPS everywhere with AutoSSL and forced redirects.
- Set correct file permissions — 755 for folders, 644 for files, 600 for wp-config.php.
- Disable XML-RPC if you do not use the WordPress mobile app or Jetpack.
- Take regular off-server backups that you have actually tested restoring.
- Remove unused user accounts, and give contributors the lowest role that lets them do their job.
- Run a security plugin such as Wordfence or Solid Security, and act on what it reports.
Our servers run ImunifyAV scanning at the account level, but server-side scanning is a safety net, not a substitute for the list above.
