A shared hosting account is well isolated from other customers, but its security still depends on how you use it. These steps cover the gaps we see most often.
1. Strong password and two-factor authentication
Use a long unique password for cPanel and turn on two-factor authentication in the security settings. Do the same in the client area that controls the account.
2. Remove what you do not use
Old installations, test sites in subfolders and unused plugins are the most common way in. If it is not used, back it up and delete it.
3. Keep applications updated
WordPress, its plugins and themes, and any other application on the account need regular updates. Enable automatic minor updates where it is safe.
4. Use SFTP or the File Manager, not plain FTP
Plain FTP sends passwords unencrypted. Use SFTP or FTPS, and delete FTP accounts you created for one-off jobs.
5. Separate database users
Give each application its own database user with access only to its own database. One compromised application then cannot read the others.
6. HTTPS everywhere
Make sure every domain and subdomain has a valid certificate, and redirect HTTP to HTTPS.
7. Check file permissions
Folders are normally 755 and files 644. Configuration files with passwords should not be readable by the public; never set anything to 777.
8. Backups off the account
Download a full backup regularly, or keep copies on separate storage. A backup inside the account disappears if the account is compromised or deleted.
At IDX
IDX hosting includes free SSL and the cPanel security tools described above. If something looks wrong, our support team can help investigate. See also what to do if your website is hacked.
IDX on digital infrastructure
Back to blog →