Skip to content
NexthostingNexthostingNexthosting Help

08Website know-how & errors

Website security – protect WordPress and web hosting properly

Updates, strong passwords, two-factor login, backups and protection filters (WAF) – how to secure your website at Nexthosting and react correctly to a hack.

In short

Most hacked websites had outdated software, weak passwords or unnecessarily many permissions. If you apply updates, use strong passwords with two-factor login, install only what is necessary and check backups regularly, most of the risk is taken care of. Nexthosting secures the server itself; you secure your website and its logins.

Who is responsible for what?

Section titled “Who is responsible for what?”
Area Who takes care of it?
Server, operating system, network, operation Nexthosting
Your website: WordPress, plugins, themes, your own scripts You
Passwords and logins You
Content and consents You

With web hosting and WordPress hosting, Nexthosting takes care of operation, updates and securing the server. You keep the software you install on it up to date.

The most important measures

Section titled “The most important measures”

1. Apply updates

Section titled “1. Apply updates”

Outdated plugins and themes are the most common entry point. Update WordPress, plugins, themes and PHP regularly, ideally weekly. Enable automatic updates for plugins you trust. Test larger updates on a copy first (Staging and cloning). More in Maintaining WordPress.

  • Remove plugins and themes you do not use (deactivating is not enough).
  • Download software only from the official directory (wordpress.org) or from reputable vendors, never “cracked” premium plugins.
  • Use a current PHP version (PHP settings).

2. Strong passwords

Section titled “2. Strong passwords”
  • At least 14 characters, random, a different one for every service. A password manager takes care of that.
  • Never use admin as a username.
  • Identical passwords for several accounts are the reason for many account takeovers.

3. Two-factor login (2FA)

Section titled “3. Two-factor login (2FA)”

Besides the password, a second proof is needed, usually an app with a one-time code. Switch it on wherever possible: for the WordPress admin account (plugin), for your Nexthosting account and for your email mailbox. See also Account security.

4. Backups

Section titled “4. Backups”

A good backup saves you after a hack, user error and defects. At Nexthosting, web hosting runs automatic backups twice a day with 30 days of retention. You create backups and restore them yourself in the web panel. In addition, you should make a backup yourself before major changes. Make sure restoring works: Backups and restoring.

5. Principle of least privilege

Section titled “5. Principle of least privilege”

Give everyone only what they need:

  • WordPress users with the smallest suitable role (Editor instead of Administrator).
  • A separate account for each person, no shared logins.
  • File permissions 644 for files, 755 for folders, 600 for wp-config.php, never 777 (File permissions).
  • Database users only with access to their own database.
  • SFTP instead of FTP: unencrypted FTP gives away passwords.

6. https everywhere

Section titled “6. https everywhere”

Use https on the whole site, remove mixed content (SSL and mixed content) and redirect http to https (.htaccess basics).

7. Less attack surface

Section titled “7. Less attack surface”
  • Disable file editing in the WordPress backend if you do not need it:
define( 'DISALLOW_FILE_EDIT', true );
  • Block sensitive files (wp-config.php, .env, backups) via .htaccess.
  • Limit login attempts (plugin), and do not hide the login page needlessly if that locks you out yourself.
  • Delete old test sites, backups (.zip, .sql) and installers in the public directory.

Filters and protection on the server (WAF, ModSecurity)

Section titled “Filters and protection on the server (WAF, ModSecurity)”

Web servers often use a filter that checks requests for typical attack patterns, a so-called WAF (Web Application Firewall) such as ModSecurity. Think of it as a doorkeeper: it lets normal visitors through and stops requests that look like SQL injection, script injection or the exploitation of known vulnerabilities.

This helps you, but it can occasionally block a harmless request. Then you see an error 403 even though your file permissions are correct. How to deal with it:

When a filter blocks a genuine request
  1. Action triggers a 403e.g. saving a post or an upload
  2. Permissions and .htaccess checkedBoth fine?
  3. Note the time and addressWith seconds, full URL
  4. Ticket to supportSupport finds the rule in the log
  5. Rule is adjustedAfterwards the action works

More on this in Error 403. Do not switch the protection off on your own, and rather send support exact details (Describing errors well).

Phishing and social engineering

Section titled “Phishing and social engineering”

Not every attack is technical. Fake emails in the name of hosting providers, banks or “support” want your login details. Remember:

  • Nexthosting never asks you for your password by email or chat.
  • Check the sender and links. The real addresses are nexthosting.net and the subaddresses for the panel and web panel.
  • Do not open unexpected attachments.

Signs of a hacked website

Section titled “Signs of a hacked website”
  • Unknown administrators in WordPress.
  • The site redirects to other sites or shows ads for medication or gambling.
  • Search results show foreign text under your domain.
  • Suddenly high mail sending or load.
  • Files you do not recognise, or freshly changed core files.
  • A warning from Google or the browser (“This website is dangerous”).
You suspect a hack – what now?
The website is still reachableChange passwords, secure a backup, then contact support
A clean backup existsReset to the state before the hack and close the gap
No clean backupCheck files and database, reinstall core and plugins
Mail sending abusedChange email passwords and inform support

After a hack: the order of steps

Section titled “After a hack: the order of steps”
  1. Save what is there (for analysis), without putting it back online.
  2. Change all passwords: WordPress, SFTP, database, email, web panel. Also enter the new credentials in wp-config.php.
  3. Restore from a clean backup, or reinstall the WordPress core, plugins and themes from the source.
  4. Close the vulnerability: update or remove the outdated plugin.
  5. Check: user list, scheduled tasks (cron), foreign files.
  6. If personal data is involved: check your obligations under data protection law (notification deadlines).
  7. Inform support so they can help on the server side.

Security for game servers, VPS and the like

Section titled “Security for game servers, VPS and the like”

This page covers websites. For securing a VPS see Securing your VPS; for DDoS protection on game servers see DDoS protection and attacks.

Checklist

Section titled “Checklist”
  • WordPress, plugins, themes and PHP up to date
  • Unused plugins and themes deleted
  • Strong, unique passwords; password manager
  • Two-factor login for admin, account and email
  • Backups checked, restore tested
  • File permissions 644/755, wp-config.php 600
  • https active, no mixed content
  • Only necessary users, smallest role
  • SFTP instead of FTP

Frequently asked questions

Section titled “Frequently asked questions”

Is my website at Nexthosting automatically secure?

Section titled “Is my website at Nexthosting automatically secure?”

The server is protected. You have to look after your website software and your passwords yourself.

Do I need a security plugin?

Section titled “Do I need a security plugin?”

A good plugin can limit login attempts and scan files. But it does not replace updates and backups. Install only one.

How often should I change passwords?

Section titled “How often should I change passwords?”

Only on suspicion or after an incident. It matters more that they are long and unique.

Further reading

Section titled “Further reading”