Secure your hosting

This guide covers the everyday steps that keep a hosting account and its website safe: strong passwords, file permissions, safer file transfer, least privilege and regular backups.

Before you begin

• Your Client Area and Hosting and Reseller Panel sign-in details.
• Access to your website files and FTP or SFTP accounts. See File manager and FTP and SFTP.

Steps

1. Use strong, unique passwords for your Client Area, your hosting panel and every FTP or database account. A password manager helps.
2. Turn on two-step verification where it is offered. See Account security.
3. Use SFTP instead of FTP wherever your plan offers it, because SFTP encrypts the connection.
4. Set safe file permissions. Use 755 for folders and 644 for ordinary files. Do not use 777. See File manager.
5. Remove access you no longer need. Delete old FTP accounts, unused database users and old mailboxes.
6. Keep your software current. Use the latest supported version of your application, its plugins and themes. Remove plugins you do not use.
7. Force HTTPS so visitors use the secure address. See SSL and HTTPS settings.
8. Keep backups and test that you can restore one. See Website backups.
9. Give each person the least access they need, whether in a team account, a reseller account or a hosting account.

Do not use 777 permissions to fix an error

Setting 777 on a folder lets anyone change its contents. Find the real cause of the error instead. See File permission problems.

Expected result

Your passwords are unique and strong, access is limited, the site uses HTTPS and file permissions are safe, and you have a tested backup.

If something goes wrong

• You find a file you did not upload. Treat it as a possible compromise. Read Recognise a compromised account.
• An application update breaks the site. Restore the backup you made before the update, then check the application's update notes.
• You are not sure which account has access. Review the FTP, database and mailbox lists, and contact support if needed.

Related articles

• Recognise a compromised account
• Phishing and scams
• Account security
• File permission problems

Last reviewed

2026-10-27