The twelve-point checklist
- HTTPS everywhere. Serve every page over HTTPS with a valid certificate and redirect the old http address. Free certificates are as strong as paid ones for encryption. Cloud Cabin includes free SSL for every site you host.
- Keep everything updated. Your CMS (such as WordPress), themes, plugins and the PHP version. Out-of-date software is the most common way sites are compromised. Turn on automatic updates for minor releases.
- Delete what you do not use. Unused plugins, themes, old test sites and forgotten admin accounts are doors left open.
- Use strong, unique passwords. A password manager makes this easy. Never reuse the password from your email on your hosting.
- Turn on two-factor authentication for your hosting account, your site's admin login and your email. Our client area supports it.
- Give people only the access they need. An editor does not need to be an administrator. Remove accounts when people leave.
- Back up, and test the restore. Follow the 3-2-1 rule: three copies, on two kinds of storage, with one away from the server. Cloud Cabin web plans include daily offsite backups, but keep a copy of your own too, because a host's backups are a convenience and not a substitute for yours.
- Scan for malware and filter attacks. Our plans include Imunify360 malware protection and 2 Tbps+ DDoS mitigation, and a web application firewall stops many common attacks before they reach your site.
- Protect your forms. Use a bot check on contact and login forms and limit login attempts. This site uses Cloudflare Turnstile on its forms for the same reason.
- Authenticate your email. SPF, DKIM and DMARC stop criminals sending email that looks like it comes from you. See the email authentication guide.
- Monitor. An uptime monitor and a look at your status page tell you quickly if something changes. See what uptime numbers mean.
- Write down your plan. Who to call, who can restore a backup, and where the passwords and backups are. Do it while it is calm.
If your site is hacked: the first hour
- Stay calm and limit the damage. If the site is serving harmful content, put up a maintenance page or take it offline.
- Change the passwords for hosting, the site admin, databases, FTP and email, from a device you trust. In WordPress, also reset the security keys in
wp-config.php. - Restore from a clean backup made before the problem started, then update everything straight away so the same hole is not reused.
- Scan and find the way in. Look at logs and recently changed files. If you do not know how they got in, they can come back.
- Tell the people affected if their data was exposed, and tell your host so it can check the rest of the server.
- Report if required. See the next section.
Reporting a breach in the UK
If you hold personal data (customer names, emails, orders) and a breach is likely to result in a risk to people's rights and freedoms, UK GDPR requires you to tell the Information Commissioner's Office within 72 hours of becoming aware of it. If the risk is high, you must also tell the people affected. Not every incident is reportable, but you must record your decision either way. The ICO's page on personal data breaches (opens in a new tab) explains what to do and has a reporting form.
What your host does and what is up to you
A host looks after the server: the operating system, the firewall, the network and the platform tools. You look after your own website: the content, the software you install and the passwords you choose. Cloud Cabin's web plans include free SSL, daily offsite backups with JetBackup, Imunify360 malware protection, DDoS mitigation and two-factor login for your client area. Keeping WordPress, themes and plugins up to date is yours to do from cPanel. See what is included on every web hosting plan.
Frequently asked questions
Yes. Most attacks are automated scans looking for out-of-date software and weak passwords. They do not check whether a site is large or small.
For encryption, yes: the strength is the same. Paid certificates add other things, such as extra identity checks and warranties, which most small sites do not need.
As often as the content changes. A busy shop or blog needs a daily backup. A site that rarely changes can manage weekly. Always keep one copy away from the server.
A second check when you log in, usually a code from an app on your phone, so a stolen password alone is not enough to get in.
No. You must report a personal data breach that is likely to put people at risk, within 72 hours. Record every incident and your decision, and use the ICO's guidance to decide.
