Skip to content
Sign In Get Started

Security

SSH keys, firewalls, permissions, malware, and headers.

  1. Password hygiene and 2FAPassword hygiene and 2FAUse a password manager so every login gets a unique secret. Add TOTP on cPanel, WordPress, your registrar, and mail so one leaked password cannot empty the shop.Updated Aug 29, 2026
  2. SSH keys instead of passwordsSSH keys instead of passwordsSSH keys replace password logins: generate ed25519 locally, install the public key, prove a second session, then disable password SSH on your VPS or use cPanel keys on…Updated Aug 29, 2026
  3. Firewalls: CSF, firewalld, nftablesFirewalls: CSF, firewalld, nftablesA host firewall should allow only the ports you mean to expose. Use one tool—CSF, firewalld, or nftables—check listeners with ss, and enable rules before you install apps.Updated Aug 29, 2026
  4. Fail2ban and Imunify360Fail2ban and Imunify360Imunify360 is the WAF and malware scanner on shared and cPanel plans. Fail2ban bans noisy IPs from VPS logs. Use one clear layer, keep plugins updated, and know…Updated Aug 29, 2026
  5. File permissions: 644 and 755File permissions: 644 and 755On shared hosting, use directories at 755 and files at 644. Keep wp-config at 640 or 644, avoid 777, and fix ownership before you chmod after a restore.Updated Aug 29, 2026
  6. Malware in PHP appsMalware in PHP appsPHP malware is usually a webshell, prepend, extra admin, or cron. Imunify catches signatures, not stolen passwords. Restore from a known-good backup rather than deleting one file.Updated Aug 29, 2026
  7. Disable unused servicesDisable unused servicesUnused services leave extra ports open on your VPS. List listeners with ss, then use systemctl disable --now so they stay off after a reboot.Updated Aug 29, 2026
  8. Security headers that do workSecurity headers that do workSecurity headers tell the browser how to treat your site. Enable the useful ones once, avoid duplicates, and confirm with curl after you purge the cache.Updated Aug 29, 2026
  9. Least privilege, said plainlyLeast privilege, said plainlyLeast privilege means each login does only its job: separate SSH keys, a limited database user, and 2FA on the panel. Shared secrets and excess plugins often cause…Updated Aug 29, 2026
  10. What to do after a compromiseWhat to do after a compromiseAfter a site compromise, take a JetBackup copy first, rotate every secret, restore a known-good date, and patch the hole. Do not reinstall WordPress over damaged files.Updated Aug 29, 2026
  11. XML-RPC brute force looks like trafficXML-RPC brute force looks like trafficXML-RPC brute force is bulk POSTs to xmlrpc.php that pin CPU and trip LVE, so it looks like traffic. Disable the endpoint if you do not need it…Updated Aug 29, 2026
  12. Disable directory listingDisable directory listingDirectory listing turns folders like /uploads/ into a public file menu. Disable it with Options -Indexes in .htaccess, confirm with curl, and move dumps out of the web…Updated Aug 29, 2026
  13. wp-config.php outside the document rootwp-config.php outside the document rootWordPress walks up parent folders to find wp-config.php, so you can keep the wp-config location above public_html. That stops a mis-set document root from serving the file as…Updated Aug 29, 2026
  14. Changing the SSH port is not a planChanging the SSH port is not a planChanging the SSH port reduces scanner noise but does not replace keys, locked-down root, or a working console. Use it only after those controls already work on your…Updated Aug 29, 2026
  15. PHP disable_functions, without breaking WordPressPHP disable_functions, without breaking WordPressdisable_functions blocks risky PHP calls. Shared hosting already covers the dangerous ones; on a VPS, test WordPress plugins before you tighten the list.Updated Aug 29, 2026
  16. Rate-limit wp-login without locking yourself out in a hotelRate-limit wp-login without locking yourself out in a hotelSet a wp-login rate limit that allows a few failures, then delays access. That slows guessing without locking you out on hotel Wi-Fi, especially with 2FA and XML-RPC…Updated Aug 29, 2026
  17. Hide the PHP version headerHide the PHP version headerHide the PHP version header by setting expose_php to Off in MultiPHP INI Editor or php.ini, then confirm X-Powered-By is gone with a simple curl check.Updated Aug 29, 2026
  18. What CageFS actually isolatesWhat CageFS actually isolatesCageFS is CloudLinux’s per-account filesystem jail on shared hosting. It blocks neighbor files and system-wide installs while leaving your home, PHP, mail, and MySQL sockets usable.Updated Aug 29, 2026
  19. Backup before you “clean” anythingBackup before you “clean” anythingTake a backup before cleanup with JetBackup or a VPS snapshot, then remove only what you can name. Cleanup without a restorable copy can leave a blank site…Updated Aug 29, 2026
  20. Hotlink protection without breaking yourselfHotlink protection without breaking yourselfHotlink protection checks the Referer header so other sites cannot embed your files. Allow your HTTPS hostnames, CDN names, and usually blank referrers so you do not 403…Updated Aug 29, 2026