Français
Nederlands
EnglishSecure your website's CMS
CMSs like WordPress, Joomla or Drupal make building a site enormously easier — but used without precautions, they can become an entry point for attacks.
Above all, keep a recent backup of your site: it's what lets you roll back quickly if something goes wrong.
Backing up your site
Remember to run a new backup after every significant change to your site.
Restricting permissions and blocking PHP execution
After installing your CMS, it's strongly recommended to remove unnecessary write permissions on your files and folders — see our page on permission management for the steps to follow in the File Manager. Remember to keep write permission on the folder that holds your images (often uploads), so you can keep adding content to it.
To protect this folder despite its write permission, create a .htaccess file in it containing:
<FilesMatch "\.(pl|cgi|py|php|php3|php4|php5|phtml?|shtml?)$">
Deny from all
</FilesMatch>This rule prevents any script from running in this folder — a useful safeguard should a malicious file ever end up there. The same principle can be applied to other sensitive directories, such as your admin area.
How hackers target your CMS
Knowing the most common methods helps you better protect against them:
Finding the admin login
An attacker first looks for your admin page, then tries to guess your password using a bot (often a dictionary attack) if you haven't changed the default login.
Outdated version vulnerabilities
Open-source CMSs and plugins can contain unpatched vulnerabilities. An outdated PHP or plugin version is a common entry point.
Malicious use
A compromised site is often used to send spam or host malicious code — which eventually gets your domain blacklisted by antivirus software.
In practice: change the name and login of your admin page, use a strong password, install a module that blocks IPs after several failed attempts, and keep your CMS and its extensions up to date.