Website security is essential for protecting your data, your visitors, and your online reputation. While SIRSTEVEHQ maintains a secure hosting environment, website security is a shared responsibility between the hosting provider and the website owner.
Following good security practices can significantly reduce the risk of hacking attempts, malware infections, data breaches, and unauthorised access.
1. Use Strong and Unique Passwords
Use strong, unique passwords for all accounts associated with your website, including:
- SIRSTEVEHQ Client Area.
- Hosting control panel.
- WordPress administrator accounts.
- FTP/SFTP accounts.
- SSH accounts.
- Email accounts.
- Database users.
Avoid simple or easily guessed passwords based on names, birthdays, common words, or other publicly available information.
2. Enable Two-Factor Authentication (2FA)
Enable Two-Factor Authentication (2FA) for your SIRSTEVEHQ Client Area and other supported accounts.
2FA adds an additional layer of protection by requiring a verification code or other authentication method in addition to your password.
Where available, enable 2FA for your website administrator accounts, email accounts, and other services that provide access to your website.
3. Keep Your Software Updated
Outdated software can contain security vulnerabilities that attackers may exploit.
Keep the following updated:
- WordPress core.
- Themes.
- Plugins.
- CMS software.
- PHP versions.
- Custom applications.
Updates often include important security fixes, so install them promptly after confirming they are compatible with your website.
4. Install Software Only from Trusted Sources
Download themes, plugins, applications, and extensions only from reputable developers or official marketplaces.
Avoid nulled, cracked, or pirated software. These may contain malicious code, hidden backdoors, or other security risks that can compromise your website.
5. Use HTTPS and a Valid SSL Certificate
An SSL certificate enables encrypted HTTPS connections between your website and its visitors.
HTTPS helps protect information transmitted between the visitor and your website, including login credentials, contact form submissions, and other sensitive data.
It also helps visitors identify that their connection to your website is encrypted.
6. Remove Unused Plugins, Themes, and Applications
Unused software can introduce unnecessary security risks, particularly if it is no longer maintained or receives security updates.
Remove plugins, themes, applications, and other components that you no longer need.
Keep the software you continue using updated and obtain it from trusted sources.
7. Back Up Your Website Regularly
Regular backups give you a way to restore your website if it is compromised, damaged, or affected by an unexpected change.
We recommend:
- Maintaining regular backups.
- Keeping multiple backup copies where possible.
- Storing important backups in a secure location.
- Creating a fresh backup before major website changes.
A backup is most useful when you know it is complete and can be successfully restored.
8. Limit User Access
Only give website and hosting access to people who genuinely need it.
Use the lowest level of permissions necessary for each user and remove accounts that are no longer required.
Regularly review administrator accounts and other users with access to your website.
9. Monitor Your Website
Regularly check your website for unusual activity, including:
- Unexpected changes to website content.
- Unknown administrator accounts.
- Suspicious files or folders.
- Unusual redirects.
- Failed login attempts.
- Unexpected emails or messages being sent.
- Unusual website behaviour.
- Unexpected performance changes.
Early detection can help you respond to a security issue before it becomes more serious.
10. Use Reputable Security Tools
If you use WordPress, consider using a reputable security plugin that provides features appropriate for your website.
Depending on the plugin, security features may include:
- Malware scanning.
- Firewall protection.
- Login protection.
- File integrity monitoring.
- Brute-force protection.
- Security notifications.
Choose security tools from trusted developers and keep them updated.
SIRSTEVEHQ also uses security technologies, including Imunify360 on supported hosting platforms, to provide additional server-level protection.
11. Use Secure File Transfer Methods
When transferring website files, use secure protocols such as:
- SFTP.
- FTPS.
- SSH, where supported.
These protocols provide encryption during data transmission and are preferable to standard FTP when secure file transfers are required.
12. Be Careful with Third-Party Integrations
Only connect your website to trusted third-party services.
Before installing a plugin, application, or integration, review the permissions it requests and consider whether those permissions are necessary.
Remove integrations and access permissions that are no longer required.
13. Protect the Devices You Use to Manage Your Website
Your website security can also be affected by the devices and networks you use to access your accounts.
Keep your computers and mobile devices updated, use reputable security software where appropriate, and avoid accessing sensitive hosting or administrator accounts from untrusted or unsecured devices.
Be especially careful when using public computers or unsecured networks.
What Does SIRSTEVEHQ Do to Help Protect My Website?
SIRSTEVEHQ maintains a secure hosting infrastructure and uses multiple security technologies to help protect our hosting environment.
Depending on the hosting platform, these measures may include malware detection, firewall protection, intrusion prevention, security monitoring, and other server-level security controls.
However, hosting security does not replace website-level security.
Website owners remain responsible for:
- Securing their website applications.
- Keeping software updated.
- Using strong and unique passwords.
- Managing user accounts and permissions.
- Maintaining regular backups.
- Removing vulnerable or unused software.
- Following good security practices.
A secure hosting environment cannot prevent every compromise, particularly when a website contains vulnerable software, insecure custom code, compromised credentials, or other weaknesses.
Need Help Securing Your Website?
If you believe your website has been compromised or you need assistance with a security-related issue, please open a support ticket through your SIRSTEVEHQ Client Area.
When contacting our Support Team, include:
- Your domain name.
- A description of the issue.
- Any error messages or security warnings you received.
- Recent changes made to your website.
- Any suspicious activity you have noticed.
- Any steps you have already taken.
We'll investigate whether the issue may be related to your hosting environment and provide guidance to help you secure your website and reduce the risk of future incidents.
