Keep your website secure

Websites are usually hacked through out-of-date software and weak passwords, not through anything the hosting company does. These habits stop most attacks.

1. Update everything. If you use WordPress or another system, keep the core software, themes and plugins up to date. Remove ones you no longer use.
2. Use strong, unique admin passwords and do not use admin as the username. See How to create a strong password.
3. Only install software from sources you trust. “Free” copies of paid themes and plugins often contain hidden malware.
4. Use https. Your free SSL certificate protects data between visitors and your site. See SSL certificates and fixing “Not secure” warnings.
5. Keep backups. A recent backup turns a disaster into an inconvenience. See How to back up your website.
6. Keep your computer clean. Many website passwords are stolen by malware on a personal computer. Keep your device updated and run a security scan.
7. Use a current PHP version. See How to change your PHP version.

If you think your website has been hacked, read What to do if your website or email is hacked.