Why Are Small Sites Targeted?

The vast majority of attacks aren't carried out by people — they're carried out by bots. These bots automatically scan millions of sites across the internet, and the moment they find an outdated PHP version, an unpatched WordPress plugin, or a weak password, they launch an attack. In other words, the target isn't "you" specifically — the target is any site with an exploitable weakness.

Compromised small sites get used to send spam, host phishing pages, mine cryptocurrency, and launch attacks on other sites. The result: a "This site may be hacked" warning in Google, a blacklisted IP, and lost customer trust.

💡 Good to know: according to Sucuri's data, more than 90% of hacked sites are CMS-based, and most of those are compromised because of an outdated plugin or theme. In other words, most of these measures are free — they just take discipline.

Measures 1-2: A Strong Password Policy and 2FA

1. Strong, unique passwords: your cPanel, FTP, database, and WordPress admin passwords should all be different from one another. Minimum standard:

  • At least 14 characters, mixing upper/lowercase letters, numbers, and special characters
  • No dictionary words, birth dates, or company names
  • Use a password manager like Bitwarden or 1Password — a random password for every account
  • Rotate passwords every 6-12 months, and cut off access immediately when an employee leaves

2. Two-factor authentication (2FA): even if your password leaks, 2FA stops the attacker cold. In cPanel, you can turn it on in about two minutes with Google Authenticator from the Security → Two-Factor Authentication menu. For WordPress, the Wordfence or WP 2FA plugin does the same job. Be sure to enable it in your hosting client panel too — critical actions like domain transfers and DNS changes go through there.

Measures 3-4: Software Updates and a WAF

3. Keep everything up to date: your CMS core, themes, plugins, and PHP version. Running PHP 8.3+ gets you both security patches and a 10-20% performance boost — see our PHP version upgrade guide for details. Set WordPress to auto-update minor releases, and instead of just deactivating plugins you don't use, delete them entirely.

4. WAF (Web Application Firewall): a WAF filters incoming traffic for malicious requests, blocking SQL injection and XSS attempts before they ever reach your site. You can apply it at two levels:

  • At the DNS level: even Cloudflare's free plan includes a basic WAF and DDoS protection. Follow our Cloudflare setup guide to get started.
  • At the server level: ModSecurity or Imunify360 — included in the package at good hosting companies.

Measures 5-6: Malware Scanning and File Permissions

5. Regular malware scanning: Imunify360 provides real-time malware scanning, automatic cleanup, and proactive defense on the server side. Before you buy, ask whether your hosting provider runs Imunify360, or at least ImunifyAV. As an extra layer, run Wordfence scans on WordPress and do an external scan once a month with Sucuri SiteCheck.

6. Correct file permissions: the wrong permissions let an attacker who slips into a single file take over your entire site. Standard values:

  • Folders: 755
  • Files: 644
  • Configuration files like wp-config.php: 600 or 640
  • No file or folder should ever be 777
⚠️ Warning: if a plugin or theme tells you to "set it to 777 permissions for it to work," that's a serious red flag. 777 grants write access to everyone on the server — never use it.

Measures 7-8: SSL/HTTPS and Backups

7. SSL certificate and forced HTTPS: SSL encrypts the traffic between a visitor and the server, keeping login credentials from being read on the network. The free Let's Encrypt certificate is enough for most scenarios — we cover the setup in our SSL guide. Once it's installed, redirect all traffic to HTTPS via .htaccess and add an HSTS header.

8. Automatic and manual backups: security measures don't come with a 100% guarantee — your backup is your last line of defense. Aim for at least a daily automatic backup (with JetBackup/Acronis giving you 7-30 days of history) plus a full backup you download to your own computer once a month. For a detailed plan, read our 3-2-1 backup strategy article.

Measures 9-10: Restricting Access Points and Continuous Monitoring

9. Restrict your access points:

  • Change your WordPress login URL (e.g., with WPS Hide Login) or add an IP restriction to wp-login.php
  • Limit failed login attempts (5 tries → 30-minute lockout)
  • Use SFTP instead of FTP — FTP sends your password as plain text
  • Delete unused FTP accounts and old admin users
  • Disable xmlrpc.php if you're not using it (it's commonly abused as a brute-force and DDoS tool)

10. Continuous monitoring and uptime tracking: catch problems before your customers do. Get downtime alerts with free tools like UptimeRobot, and keep an eye on security warnings in Google Search Console. You can also track your hosting provider's live status on the HostScore360 status page.

How to Choose Security-Focused Hosting

Half of these measures are in your hands; the other half depends on your hosting provider's infrastructure. Use this table as a reference when comparing plans:

Security Feature Is It a Must-Have? Why It Matters
Imunify360 or a similar WAF+AV Yes Real-time malware blocking and cleanup
Daily automatic backup (JetBackup) Yes Fast recovery after a hack
Free SSL (Let's Encrypt/AutoSSL) Yes Encrypted traffic, SEO, and browser compatibility
Account isolation (CloudLinux/CageFS) Yes (on shared hosting) Stops a hack on a neighboring site from spreading to you
DDoS protection Strongly recommended Keeps your site reachable during volumetric attacks
2FA-enabled client panel Strongly recommended Makes it harder to hijack your domain/DNS

You can filter for providers that offer these features on our hosting comparison page, and use our comparison tool to see two providers side by side. For those who want full control, VPS options offer more security customization — but the responsibility shifts to you as well.

💡 Recommendation: you can roll out all 10 of these measures in a single weekend. Priority order: backups → updates → 2FA → WAF. These four alone neutralize the vast majority of attacks.

Frequently Asked Questions

My site got hacked — what should I do first?

First, without panicking, change all your passwords (cPanel, FTP, database, WordPress). Notify your hosting provider's support team, and restore the most recent backup you know to be clean. Then run an Imunify360/Wordfence scan, finish installing updates, and request a review from Google Search Console.

What is Imunify360, and is it free?

Imunify360 is a server-side WAF, antivirus, and intrusion-prevention suite. The hosting company pays for the license; it's included free with quality packages. Before you buy, it's enough to ask, "Does this include Imunify360?"

Is Cloudflare alone enough protection?

No. Cloudflare filters traffic at the DNS level, but it can't protect you from an outdated plugin vulnerability or a weak password on your own server. Cloudflare needs to work together with server-side scanning, up-to-date software, and backups.

Is shared hosting safe, or should I move to a VPS?

A quality shared hosting plan with account isolation through CloudLinux/CageFS is safe for most sites. A VPS gives you more control, but the security setup becomes entirely your responsibility; a misconfigured VPS can be riskier than a well-managed shared hosting plan.

Do security plugins slow down a site?

Plugins that scan continuously do consume resources. Schedule scans for nighttime hours, and where possible, move protection to the server/DNS level (Imunify360, Cloudflare) — leaving only login protection at the application level.