The Complete Guide to Web Hosting Security

Most “hacked WordPress” stories are outdated plugins, reused passwords, and FTP left open. Hosts can patch the hypervisor, offer a WAF, and isolate accounts. They cannot make you stop installing nulled themes. SiteGround, WP Engine, and Kinsta sell a harder default. Shared cPanel can be fine if you behave. This is the behavior.

PHP, WordPress core, plugins, and themes are a supply chain you adopted. Hosts that lag PHP versions (old shared leftovers) force you to run software that no longer gets security fixes. Managed WordPress at WP Engine or Kinsta will constrain plugins and push PHP; that is a security feature disguised as a support policy. On A2, DreamHost, Cloudways, or any VPS, you still click updates—or automate them on staging first. Nulled plugins are not a discount; they are a backdoor with a readme. Delete unused themes. Remove the default admin user name if you can. Patching is boring and beats every scanner upsell that promises to watch you stay unpatched.

FTP sends credentials in ways the internet outgrew. Disable it in cPanel if the host still enables it by default (many Bluehost and HostGator-style accounts still might). Use SFTP or SSH keys on A2, Cloudways, InMotion VPS, or DreamHost. Protect wp-admin with two-factor authentication and a unique password in a manager. Limit XML-RPC if you do not need it. Do not share the host panel login in Slack. Rotate keys when a contractor leaves. The control panel is a privileged endpoint; treat it like a bank. If you must give an agency access, use a role that is not the owner, and calendar a revocation. Stolen SFTP keys are how “we have a WAF” still becomes a defacement.

A web application firewall (host-provided or Cloudflare) filters obvious exploit traffic before PHP runs. SiteGround, WP Engine, and Kinsta include stronger defaults than bargain shared. Malware scanners catch aftermath; they are not a patch strategy. If the host sells a scanner as a monthly add-on, price it—or use Cloudflare plus disciplined updates. Isolation matters: a compromised neighbor on ancient shared should not be able to read your files. Cloudways containers and Kinsta’s isolation exist for that reason. Do not confuse a padlock (TLS) with a secure application. TLS stops coffee-shop snooping. It does not stop a vulnerable contact-form plugin. Layer: patched apps, least privilege, WAF, backups you can restore after a bad day.

Every leftover Administrator is a door. Authors do not need install_plugins. Shop managers do not need theme edit. Turn on 2FA for anyone who can change plugins. Hide or protect phpMyAdmin; do not bookmark it on a shared laptop. On sites with WooCommerce, customers should never share an admin path mentally with you—use a custom login path only as extra friction, not as the only control. Review users quarterly. Agencies forget to leave. Interns forget to leave. If you use WP Engine or Kinsta SSO-style workflows, still audit WordPress users. Hosting security is half account hygiene. The other half is not installing the plugin a banner said was required for “performance and security.”

Take it offline if it is serving malware to visitors. Rotate every password: WordPress, cPanel, registrar, Cloudflare, database, SSH keys, associated mail. Restore from a backup from before the incident if you have one that is clean—this is why off-site copies matter. Scan, but do not trust a single plugin to have found every web shell. Reinstall core from wordpress.org. Diff wp-content. Ask SiteGround, WP Engine, or your host’s incident people if you pay for that; they have seen this. Change DNS only if the registrar was the compromise. Document what you did. Then patch the hole that let them in, or you are scheduling the sequel. A scanner subscription after a restore is not a postmortem.

Patch, kill FTP, lock admin, keep a WAF, and hold backups you have restored once on purpose. Let’s Encrypt is not a security program. WP Engine, Kinsta, and SiteGround make the defaults harder; they cannot out-secure a nulled theme. Hygiene beats badges.