Web hosting security basics
Some links to Bluehost are affiliate links. We may earn a commission. Disclosure.
Access controls
Use unique passwords and multifactor authentication where supported. Give each person only the access they need.
Updates and backups
Maintain software, test restores, and keep an independent backup. A host’s security features do not remove your responsibilities.
Recovery plan
Know who can access the domain, DNS, hosting, and backups if an account is compromised.
Prioritize account recovery
Protect the registrar and hosting account with strong authentication and recovery options. A compromised registrar account can redirect a website even if WordPress itself is patched.
Prepare for an incident
Document who can revoke access, restore backups, rotate credentials, and contact the host. Practice these steps before an emergency.
Put this guide to work
Use this short worksheet before making changes or purchasing a service. Keep your answers with your website records so you can revisit them when your needs or contract change.
- Access controls: Use unique passwords and multifactor authentication where supported. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
- Updates and backups: Maintain software, test restores, and keep an independent backup. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
- Recovery plan: Know who can access the domain, DNS, hosting, and backups if an account is compromised. Write down what this means for your own website, identify the information you still need, and verify it using your current account or the relevant provider’s documentation. Do not substitute a general marketing claim for a plan-specific answer.
If an answer is uncertain, pause that part of the decision and verify it. For changes to a live site, make a restorable backup first and test the result before deleting the previous configuration.