General Web Security Resources

Our shared servers employ an extensive set of security modules to protect accounts from server-level (and, to a certain extent, known application-level) threats, including, but not limited to, CageFS via CloudLinux, ModSecurity, OSSEC, CSF (ConfigServer Security & Firewall), and several virus scanning modules.

The possibility of any account-level compromise having come from an attack that was preventable at the server-level is extremely low. While many customers who have experienced an account-level compromise question how this could have happened on our servers, the reality of the situation is that an overwhelming majority of compromises stem from outdated or otherwise insecure software in the customer's account.

We put a lot of effort into balancing the security of the servers with enough flexibility to allow customers to install a wide variety of software. Accordingly, it is the responsibility of the customer to maintain the security of the web applications within their account.

In addition to seeking out additional resources from experienced software developers, we highly recommend the following general tips:

  • Use secure connections whenever possible, such as connecting to a site with SFTP rather than FTP, or using a secure 'https' link for any login forms that transmit password data.
  • Never store old, unused content in your hosting account, including things like abandoned development installations and zipped files.
  • Be familiar with the documentation for your software, and how to find information on its functionality.
  • Always apply software security updates to core software and any modules, themes, plugins, etc. as soon as possible after they're released.
  • Keep up to date with information regarding current security best practices for the software you're using. Subscribing to the mailing list for the software or regularly reading web security blogs are a couple ways to stay informed about new developments.


Additionally, here are some links to additional resources regarding web security practices:


Tech and Security News

Krebs on Security - Blog
Schneier on Security - Blog
Ars Technica - Tech News
WIRED Security Category - Tech News


Sucuri Blog Security Articles

Sucuri Blog - Security Education
Sucuri Blog - Website Hosting: Security Awareness Can Reduce Costs
Sucuri Blog - What is Cross-Site Contamination and How to Prevent it
Sucuri Blog - How To Create a Website Backup Strategy
Sucuri Blog - When Your Plugins Turn Against You
Sucuri Blog -- Why You Should Care about Website Security on Your Small Site

Sucuri Blog - Website Security: How Do Websites Get Hacked?
Sucuri Blog - The Impacts of a Hacked Website
Sucuri Blog - Why Websites Get Hacked
Sucuri Blog - Why Attackers Hack Small Sites
Sucuri Blog - Content Security Policy


Sucuri Blog - The Art of Website Malware Removal – The Basics
Sucuri Blog - Your Website’s Been Hacked But No Signs of Infection
Sucuri Blog - Website Malware Removal: Phishing
Sucuri Blog - Why Website Reinfections Happen
Sucuri Guides - What is a Google Blacklist?
Sucuri Guides - How to Remove Google Blacklist Warning

Sucuri Hacked Website Reports by Quarter
Sucuri Hacked Reports - 2016 Q3 [PDF]
Sucuri Hacked Reports - 2017 [PDF]

Sucuri Blog Software Specific Categories

Sucuri Blog - WordPress Security
Sucuri Blog - Joomla Security
Sucuri Blog - Magento Security
Sucuri Blog - Drupal Security


Please note that this information is provided as a courtesy for general guidance on application-level security; assistance with customer-installed software and/or web development, however, would be outside the scope of our support. If you’re not comfortable with website administration, we recommend locating an experienced web developer to assist.

Was this answer helpful?

 Print this Article

Also Read

How do I reset my cPanel password?

If you need to reset your cPanel password, this can be done in your client area...

How do I transfer ownership of my account to another party?

If all products, services, domain registrations, etc. are to be transferred from one party to...

WordPress Resources

Getting StartedWordPress Codex - New To WordPress - Where to StartWordPress Codex - First Steps...

Can I have more than one domain with my account?

Yes. With all HostRocket accounts you can have an unlimited number of domain names associated...

Joomla Resources

Getting StartedJoomla Documentation - Main PageJoomla Documentation - Getting Started with...