Security best-practices checklist

Applies to: All plans (this checklist matters most on Self-Managed, which is self-serve — you own day-to-day security; on Managed we handle patching, monitoring and email DNS for you).

Use this checklist to harden a self-managed site. Every node already runs the ModSecurity firewall (with the OWASP Core Rule Set), server-side malware scanning, CageFS isolation and cPHulk brute-force protection, and AutoSSL issues free certificates automatically — but the items below are yours to keep on top of. Work through them top to bottom.

1. Keep everything updated

Outdated software is the single most common way sites get hacked.

Update your CMS core, themes and plugins promptly (in WordPress, WordPress admin -> Dashboard -> Updates).
Remove software you no longer use rather than leaving it stale.
Run a modern, supported PHP version (PHP 8.x) via cPanel -> Software -> MultiPHP Manager.

Result: No update badges or "out of date" warnings remain in your CMS.

2. Use strong logins and turn on 2FA

Set a long, unique password for each account: your client area, cPanel and your CMS admin.
Turn on two-factor authentication (2FA) in the client area (account/profile menu, top right) and in cPanel (Security -> Two-Factor Authentication).
Never reuse the same password across sites; a password manager makes this easy.
Remove old admin users and rename any default "admin" account.

3. Run the fewest plugins and themes you need

Every plugin and theme is extra code that can be exploited.

Install only what you actively use, from reputable sources.
Delete (don't just deactivate) anything unused — deactivated code can still be exploited.
Avoid nulled or pirated plugins entirely.

4. Keep your own backups

We run JetBackup to Backblaze B2, but you should keep independent copies too.

Restore points in cPanel -> Files -> JetBackup cover a file/folder, a database, or a full account.
Self-Managed self-restore retention: Lite weekly, Plus 7 days, Pro 14 days. Managed keeps daily backups for 30 days off-site.
On Self-Managed you can add the Managed Backups add-on (EUR 5/mo) for managed 30-day off-site backups.
Download an occasional copy and store it somewhere off-server.

5. Force HTTPS everywhere

AutoSSL issues and renews a free certificate for every plan automatically — confirm it is active in cPanel -> Security -> SSL/TLS Status.
Redirect all traffic to HTTPS so visitors never load the insecure version.
Fix any "Not Secure"/mixed-content warnings, which come from hard-coded http:// asset links.

6. Lock down file permissions

Use 644 for files and 755 for folders as a safe default; never set anything to 777.
Protect sensitive folders with cPanel -> Files -> Directory Privacy (password protection).
Keep configuration files (for example wp-config.php) readable only where needed.
Set the permissions in cPanel -> Files -> File Manager (right-click a file -> Change Permissions) or over SFTP.

7. Tighten access and watch for trouble

Block abusive IPs with cPanel -> Security -> IP Blocker.
Enable Hotlink Protection and Leech Protection in cPanel where relevant.
We scan for malware at server level and will tell you if something is found — there is no scan for you to run in cPanel, so contact support if you suspect an infection.
If a legitimate action is blocked by ModSecurity (a false positive), contact support to whitelist it — don't disable the firewall yourself.

A note on email security

Email is Professional Email (resold Microsoft 365 or Google Workspace), not hosted on the server, so its security lives in those consoles. Add the correct SPF, DKIM and DMARC records for your provider in your client area DNS manager to stop spoofing — on Managed we configure these for you.