Keep your WordPress site secure

Almost every hacked WordPress website was running something out of date, or a password that had leaked.

The habits that matter

• Update everything: WordPress, every plugin and your theme. Turn on automatic updates for plugins you trust.
• Delete what you do not use. A deactivated plugin can still be attacked. Remove it completely.
• Use strong, unique passwords for WordPress admin, email, SFTP and your Hosteaze account, and turn on two-step login.
• Do not use "admin" as the administrator username.
• Only install plugins and themes from the official WordPress directory or from sellers you trust. "Free" copies of paid plugins are a common way to get hacked.
• Limit who has an admin account, and remove people who have left.

If you think you have been hacked

1. Change your WordPress, SFTP and email passwords.
2. Open Security in the control panel and choose Scan now.
3. Open a support ticket and tell us what you saw.