Security best-practices checklist

Applies to: All plans (this checklist matters most on Self-Managed, which is self-serve — you own day-to-day security; on Managed we handle patching and monitoring for you).

Use this checklist to harden a self-managed site. Every node already runs the ModSecurity firewall (with the OWASP Core Rule Set), server-side malware scanning, CageFS isolation and cPHulk brute-force protection, and AutoSSL issues free certificates automatically — but the items below are yours to keep on top of. Work through them top to bottom.

1. Keep everything updated

Outdated software is the single most common way sites get hacked.

Update your CMS core, themes and plugins promptly (in WordPress, WordPress admin -> Dashboard -> Updates).
Remove software you no longer use rather than leaving it stale.
Run a modern, supported PHP version (PHP 8.x) via cPanel -> Software -> MultiPHP Manager.

Result: No update badges or "out of date" warnings remain in your CMS.

2. Use strong logins and turn on 2FA

Set a long, unique password for each account: your client area, cPanel, your CMS admin and every mailbox.
Turn on two-factor authentication (2FA) in the client area (account/profile menu, top right) and in cPanel (Security -> Two-Factor Authentication).
Never reuse the same password across sites; a password manager makes this easy.
Remove old admin users and rename any default "admin" account.

3. Run the fewest plugins and themes you need

Every plugin and theme is extra code that can be exploited.

Install only what you actively use, from reputable sources.
Delete (don't just deactivate) anything unused — deactivated code can still be exploited.
Avoid nulled or pirated plugins entirely.

4. Keep your own backups

We run JetBackup to Backblaze B2, but you should keep independent copies too.

Restore points in cPanel -> Files -> JetBackup cover a file/folder, a database, or a full account.
Self-Managed self-restore retention: Lite weekly, Plus 7 days, Pro 14 days. Managed keeps daily backups for 30 days off-site.
Restore points include your mailboxes, so lost mail can be restored from JetBackup too — see How to restore a mailbox or deleted email from a backup.
On Self-Managed you can add the Managed Backups add-on (EUR 5/mo) for managed 30-day off-site backups.
Download an occasional copy and store it somewhere off-server.

5. Force HTTPS everywhere

AutoSSL issues and renews a free certificate for every plan automatically — confirm it is active in cPanel -> Security -> SSL/TLS Status.
Redirect all traffic to HTTPS so visitors never load the insecure version.
Fix any "Not Secure"/mixed-content warnings, which come from hard-coded http:// asset links.

6. Lock down file permissions

Use 644 for files and 755 for folders as a safe default; never set anything to 777.
Protect sensitive folders with cPanel -> Files -> Directory Privacy (password protection).
Keep configuration files (for example wp-config.php) readable only where needed.
Set the permissions in cPanel -> Files -> File Manager (right-click a file -> Change Permissions) or over SFTP.

7. Tighten access and watch for trouble

Block abusive IPs with cPanel -> Security -> IP Blocker.
Enable Hotlink Protection and Leech Protection in cPanel where relevant.
We scan for malware at server level and will tell you if something is found — there is no scan for you to run in cPanel, so contact support if you suspect an infection.
If a legitimate action is blocked by ModSecurity (a false positive), contact support to whitelist it — don't disable the firewall yourself.

A note on email security

For the mailboxes included with your plan:

Give every mailbox its own long password, and update it on every device when you change it.
Keep the SPF, DKIM and DMARC records that new hosting zones get automatically: receiving servers use them to check that mail claiming to come from your domain really does. If your zone has none, ask us to add them.
Newsletters and bulk mail are not allowed from mailboxes: use a dedicated sending service. Each domain also has an hourly sending limit — see Mailbox and sending limits.
Likely spam sent to you is filtered into the Junk folder, so check it before you decide a message never arrived.

For Professional Email (Microsoft 365 or Google Workspace), security settings live in those consoles. Add the correct SPF, DKIM and DMARC records for your provider in your client area DNS manager to stop spoofing — if you ordered your seats through us, we configure these for you, whatever your hosting plan.