Most hacked websites are not targeted personally. Automated bots scan for outdated software and weak passwords. These ten steps close the most common doors.
- Keep everything updated: WordPress core, themes and plugins.
- Use strong, unique passwords for hosting, cPanel, WordPress and email. Use a password manager.
- Enable two-factor authentication where possible.
- Do not use "admin" as a username.
- Limit login attempts to block brute-force bots.
- Delete unused plugins and themes, and install only from trusted sources.
- Use HTTPS. See SSL guide.
- Back up regularly and keep copies off the server. See backup guide.
- Set safe file permissions and protect wp-config.php.
- Scan for malware periodically and watch for unexpected changes.
What to do if you are hacked
- Change all passwords.
- Restore from a clean backup.
- Update everything.
- Scan and remove unknown admin users and files.
- Contact support if you host with us.
How websites actually get hacked
- Outdated software: known vulnerabilities in old plugins or themes.
- Weak or reused passwords: leaked from other websites and tried automatically.
- Nulled (pirated) themes and plugins: frequently contain hidden backdoors.
- Compromised devices: malware on your computer steals saved logins.
- Insecure file permissions or exposed configuration files.
Signs that your site may be compromised
- Unknown admin users or sudden changes in settings.
- Strange redirects to unrelated websites, especially on mobile.
- Pages or links you did not create, often about pills or gambling.
- Google warning "This site may be hacked".
- Hosting suspension notice or unusually high resource use.
Defence in layers
| Layer | What to do |
|---|---|
| Account | Strong passwords, 2FA, unique logins |
| Software | Updates, trusted plugins only |
| Server | Current PHP, correct permissions, HTTPS |
| Monitoring | Security scans and uptime alerts |
| Recovery | Tested backups |
Recovery plan
- Put the site into maintenance mode if possible.
- Change passwords for hosting, cPanel, FTP, database, WordPress and email.
- Restore a clean backup from before the infection.
- Update all software and remove unused or nulled components.
- Request a review from Google if your site was flagged.
If you host with us and need help, open a ticket as soon as you notice a problem.
FAQ
Is WordPress insecure?
WordPress itself is actively maintained. Most problems come from outdated plugins and weak passwords.
Related: WordPress hosting checklist.
Ready to launch? Compare SyllHost hosting plans, or search for your domain on our domain search page. Questions? Talk to our team.