Secure your WordPress or Joomla website
WordPress, Joomla and similar applications are safe to use, as long as you keep them up to date. Most hacked websites were running out-of-date software. These steps prevent nearly all problems.
Our servers also protect your website automatically with Imunify360. See Imunify360 website protection.
Keep everything updated
- Turn on automatic updates where you can. WordPress installs minor and security updates by itself. In Dashboard > Updates you can also turn on automatic updates for major versions, and for each plugin and theme on the Plugins and Themes pages. In Joomla, check System > Update regularly.
- Log in at least once a month and install any waiting updates.
- Use a supported PHP version. See Change your PHP version and extensions.
Use fewer, well-maintained add-ons
- Install plugins, extensions and themes only from the official WordPress or Joomla directories, or from developers you trust. Never use "nulled" (pirated) copies of paid ones: they often contain malware.
- Choose ones that are updated regularly and widely used.
- Delete the ones you don't use. Deactivating isn't enough.
- Remove old copies of your site, such as test or backup installations in other folders. They get forgotten and stop being updated.
Protect your logins
- Use a strong, unique password for every admin user, and don't reuse it anywhere else.
- Turn on two-factor authentication. Joomla includes it under Users > Manage > your user > Multi-factor Authentication. For WordPress, use a two-factor plugin such as Two Factor or Wordfence Login Security.
- Give admin access only to people who need it, and remove users who no longer do.
- Don't use "admin" as a username.
Keep backups
We back up your account every day. See Restore files, databases and email with JetBackup. For an extra copy that you control, see Back up your website to your own computer with rclone.