Hostking UK — web hosting and domains

Start with SSL

An SSL certificate encrypts traffic between your visitor and your server. Without it browsers show a “not secure” warning, which costs you trust before anyone reads a word.

  • Free on every Hostking plan — there is no reason not to have it
  • Check every page loads over https, not just the homepage
  • Fix mixed-content warnings caused by images still on http
  • Set up automatic renewal so it never lapses
Start with SSL

Updates are the boring answer that works

The overwhelming majority of hacked websites were running known-vulnerable software with a patch already available. Attacks are automated and indiscriminate — they scan for old versions rather than choosing targets.

  • Keep WordPress, plugins and themes current
  • Enable automatic updates for security releases at minimum
  • Delete plugins and themes you are not using — inactive code is still code
  • Abandoned plugins never get patched; replace them
Updates are the boring answer that works

Passwords and access

Weak credentials remain the second most common way in. This costs nothing to fix and takes an afternoon.

  • A unique password per account, generated rather than invented
  • Two-factor authentication on hosting, WordPress and your registrar
  • Never share one admin login across a team
  • Remove accounts for people who have left
  • Give contributors the least access that lets them do their job
Passwords and access

Backups are what make the rest survivable

Everything above reduces the chance of a problem. Backups are what mean a problem is an inconvenience rather than a catastrophe.

  • Daily automatic backups, included on every plan here
  • Keep at least one copy off the server
  • Test a restore before you need one — untested backups fail
  • Back up before any major update or migration
Backups are what make the rest survivable

If you have been hacked

Work in this order. The instinct is to delete things first, which destroys the evidence you need to find out how they got in.

  • Take the site offline or into maintenance mode
  • Change every password — hosting, WordPress, database, FTP
  • Scan for and remove malicious files and unknown admin users
  • Restore from a clean backup from before the compromise
  • Update everything before going live again
  • Our WordPress malware cleanup guide covers the detail
If you have been hacked

Get Online with Hostking

Hosting from £2/month billed annually, with a free domain, free SSL, business email and daily backups included. Choose Starter or above and we design your website free — no agency fee, no contract.

See hosting plans Talk to our team

Hostking support team

How to Secure Your Website — Common Questions