How to Secure WordPress on cPanel Hosting: 8 Essential Steps

To secure a WordPress site on cPanel hosting, do eight things: keep WordPress, themes and plugins updated, use strong and unique passwords, turn on two-factor login, limit login attempts, keep automatic backups, use HTTPS everywhere, delete what you do not use, and tighten file permissions. Most hacked sites were not targeted individually. Automated tools found an outdated plugin or a weak password, and a few simple habits close almost all of those doors.

The steps are written for cPanel hosting, where you manage the server side through cPanel and the site through the WordPress dashboard. None of them needs coding, and each one has a clear undo. If you want to see how scanners probe a server for exposed files, read how to block .env and scanner probes on Nginx, which uses real log numbers. A site that is under attack also often looks slow, so keep these five checks for a slow site in mind.

Step 1: Set up backups before anything else#

A backup is the one security measure that fixes almost everything, because it lets you go back to a clean state. In cPanel, open Backup Wizard, choose Back Up and download a Full Backup, or the home directory and databases separately. Store the file somewhere that is not on the same server, such as your computer or a cloud drive.

Make this a habit and not a one-time job. Check whether your hosting plan includes automatic backups, and ask support how long they keep them. Do not rely on them alone, because a copy that you downloaded yourself is the one you control.

Step 2: Keep everything updated#

Outdated plugins are the most common way WordPress sites are broken into. When a flaw is found in a plugin, the fix is published with an update, and attackers then scan the web for sites that have not installed it.

1. In WordPress, open Dashboard, then Updates.
2. Update WordPress itself, then your plugins, then your themes.
3. In Plugins, Installed Plugins, use Enable auto-updates for the plugins you trust, and check the site afterwards.
4. In cPanel, open MultiPHP Manager and make sure your PHP version is a current one. Old PHP versions stop receiving security fixes.

Take a backup before large updates, and update one thing at a time on a busy site.

Step 3: Use strong, unique passwords#

Attackers try passwords leaked from other sites, and they try them against thousands of WordPress logins. A password you have used elsewhere is only as safe as the weakest place it was used.

• Use a long, random password for each of: your WordPress admin account, your cPanel login, your database user and your FTP accounts.
• Use a password manager so you do not have to remember them.
• Do not use admin as a username. In Users, create an administrator with a different name, log in with it, and delete or demote the old one.

Step 4: Turn on two-factor login#

Two-factor login asks for a code from your phone as well as the password, so a stolen password alone is not enough. For WordPress, install a well-known two-factor plugin and require it for administrators and editors. For cPanel, look for Two-Factor Authentication under Security. If you do not see it, ask support whether it is available on your plan.

Step 5: Limit login attempts and hide the obvious doors#

Bots try passwords on /wp-login.php all day. A limit on failed logins stops them from guessing without end.

• Install a login-limiting plugin, or use the setting for it in a security plugin you already trust. Do not install two security plugins that do the same job.
• In cPanel, use IP Blocker under Security to block an address that attacks repeatedly. Make sure it is not your own address first.
• Look at Visitors or Raw Access under Metrics from time to time. Thousands of requests to the login page from one address are a sign of an attack.

Also add this line to wp-config.php, above the comment that says That’s all, stop editing. It switches off the built-in file editor, so an attacker who gets into the dashboard cannot rewrite your plugin and theme files from it:

define( 'DISALLOW_FILE_EDIT', true );

Copy wp-config.php to wp-config-backup.php in File Manager before you edit it.

Step 6: Use HTTPS on every page#

HTTPS encrypts the connection between your visitor and your site, and it protects your own login. Browsers also mark sites without it as not secure.

1. In cPanel, open SSL/TLS Status and check that your domain has a valid certificate. If not, select it and run AutoSSL.
2. In WordPress, go to Settings, then General, and make sure both the WordPress Address and the Site Address start with https://.
3. Open your site and click through a few pages. If the padlock disappears on a page, an image or script is still loaded over plain HTTP, and it needs to be updated to HTTPS.

Step 7: Delete what you do not use#

Every plugin, theme and user account is a possible way in, whether or not you use it. An unused plugin still has to be updated, and an unused administrator account still has a password that can be guessed.

• Deactivate and delete plugins you no longer use, in Plugins, Installed Plugins.
• Delete unused themes, keeping your active theme and one default WordPress theme.
• Open Users and look at every administrator. Delete or demote any you do not recognize.
• Only install plugins and themes from the official WordPress directory or a developer you trust. Downloaded copies of paid plugins from unofficial sites are a common way malware spreads.

Step 8: Check file permissions#

File permissions decide who on the server can read and change your files. Safe settings for WordPress are 755 for folders and 644 for files, with wp-config.php set tighter at 640 or 600. In cPanel, open File Manager, right-click a file or folder and choose Change Permissions.

Never set a file or folder to 777. It lets anyone on the server write to it, and attackers look for it.

A quick monthly checklist#

• Updates are installed for WordPress, plugins, themes and PHP.
• A fresh backup is downloaded, and the last one has been tested.
• The user list contains only people you know.
• Unused plugins and themes are deleted.
• The padlock shows on the home page and on a few inner pages.
• Resource Usage and the access logs show no unusual spikes.

What to do if your site is already hacked#

Signs include redirects to other sites, unknown administrator users, spam pages in search results and a warning from your browser or search engine. If this happens:

1. Do not delete anything yet. Contact support and describe what you see.
2. Change your cPanel, WordPress, database and FTP passwords from a clean device.
3. Restore a backup from before the problem started, then update everything immediately.
4. Look for the way in. It is nearly always an outdated plugin or a stolen password, and if you do not close it, the problem returns.

Common mistakes to avoid#

• Treating a security plugin as the whole answer. It cannot protect a site with weak passwords and outdated plugins.
• Installing several security plugins. They conflict and slow the site down. Choose one.
• Putting off updates. The longer a known flaw stays on your site, the more likely it is to be used.
• Sharing one admin login. Give each person their own account, so you can remove one without affecting the others.
• Never testing a restore. Find out that your backup works before you need it.

Hosting that helps you stay secure#

Good habits matter, and so does the platform they run on. Our shared hosting plans run on cPanel with tools such as Backup Wizard, SSL/TLS Status and IP Blocker built in, and our support team can help you check an account that looks wrong.

Related guides: what a wildcard SSL certificate covers, fixing WordPress emails going to spam and setting up DMARC without losing email. To lock down the account itself, read how to keep your cPanel account and sites secure.

Frequently asked questions#

Is WordPress secure?#

The core software is well maintained and fixed quickly. Most problems come from outdated plugins and themes, weak passwords and unused accounts, which you control.

Do I need a security plugin?#

It can help with login limits, scans and alerts, but it is optional. The eight steps above matter more. If you use one, use only one.

How often should I back up?#

As often as your content changes. A site with a daily shop needs daily backups. A site updated once a month can be backed up monthly, and before every large update.

Is a free SSL certificate good enough?#

Yes. A free certificate encrypts the connection in the same way. Paid certificates add extras such as business validation, which most small sites do not need.

How do I know if my site was hacked?#

Look for unknown administrators, strange redirects, spam content in search results, or a warning from your browser. A malware scan from a security plugin can also find changed files.

The short version: back up, update everything, use unique passwords and two-factor login, limit login attempts, use HTTPS, delete what you do not use, tighten file permissions and repeat the checklist every month.