Secure your hosting account

None of this is difficult. Almost every compromise we help clean up would have been prevented by one item on this list.

1. A unique password on every account. Client area, cPanel, WordPress, database, each mailbox - all different, all from a password manager. Reused passwords are the second most common route in.
2. Two-factor authentication on the client area and on cPanel. This alone defeats a stolen password.
3. SFTP, not FTP. Plain FTP sends your password in clear text across the network. Use port 22 and SFTP, and do not save the password in the client on a shared machine.
4. Keep software updated. WordPress core, plugins, themes - automatically. Outdated plugins are the most common route in, and the gap between a vulnerability being published and being scanned for is measured in days.
5. Delete what you do not use. An inactive plugin, an old staging copy, a test subdomain from two years ago. Files on disk are reachable whether or not anything links to them.
6. Check your file permissions. Folders 755, files 644, and nothing world-writable. An uploads folder that will execute PHP turns any upload form into a way in.
7. Know where your backups are and that they restore. A backup nobody has ever restored is a hypothesis. Test one.
8. Review who has access. Remove the developer who finished last year, demote contributors who do not need administrator, and delete the shared account everybody used during the build.

If you think something is already wrong

Do not start deleting files. Change every password from a clean machine, tell us, and we will look at the logs with you. Knowing how they got in matters more than removing what they left - otherwise the same route is used again next month.