Steps to Secure Your Website
A practical checklist for locking down a new website: SSL, strong auth, updates, security headers, backups, and monitoring.
7 min read
This guide lists the security steps that matter most for a new website, in the order to do them. It applies to GoZen Host shared hosting, WordPress hosting, and VPS plans.
Before You Start
You’ll need:
- A live website with a domain name pointing to it
- Admin access to your hosting control panel (cPanel, Enhance, or SSH on a VPS)
- 30–60 minutes
If you’re on a VPS and haven’t done initial server setup yet, start with the VPS Security Checklist first. That covers SSH keys, firewalls, and OS-level hardening. This guide focuses on the website itself.
Step 1: Force HTTPS Everywhere
Without HTTPS, form submissions, logins, and page views travel in plain text and can be read by anyone on the network path.
On GoZen shared or WordPress hosting:
AutoSSL is already enabled. Your site has a free Let’s Encrypt certificate. Verify it’s working:
curl -I https://yourdomain.com
# Look for: HTTP/2 200
The strict-transport-security header only shows up after you add it in Step 4.
If your site still loads over HTTP, force the redirect:
- cPanel: Go to Domains → your domain → toggle Force HTTPS Redirect on
- WordPress: In Settings → General, make sure both URLs start with
https://
On a VPS:
Install a certificate with Certbot and configure your web server. Full walkthrough: How to Install SSL Certificates Manually.
Verify Your SSL Grade
Run your domain through SSL Labs. You want an A or A+. A lower grade means your TLS configuration needs work. See Secure Nginx and Apache for the fix.
Step 2: Lock Down Authentication
Reused passwords and accounts without 2FA are among the most common ways sites get taken over.
Use Strong, Unique Passwords
If any of your hosting passwords are reused from another service, change them now. Credential stuffing attacks try leaked passwords against login forms across the internet.
Every account should have a unique password, at least 16 characters, generated by a password manager:
- Hosting client area (cp.gozenhost.com)
- cPanel / Enhance panel
- WordPress admin
- FTP / SFTP
- Database users
Enable Two-Factor Authentication
Add 2FA to every login that supports it:
- GoZen client area: Security Settings → Two-Factor Authentication
- cPanel: Security → Two-Factor Authentication
- WordPress: install the Two-Factor plugin or use Wordfence
Full setup guide: Enabling Two-Factor Authentication.
WordPress-Specific Auth Hardening
If you run WordPress:
- Delete the default
adminusername. Create a new admin with a different name. - Install Limit Login Attempts Reloaded to block brute-force bots
- Change the login URL with WPS Hide Login
- Disable XML-RPC if you don’t use the WordPress mobile app or Jetpack
Details: Securing WordPress.
Step 3: Update Everything
Outdated plugins, themes, and CMS versions are a common way in. Automated scanners start probing for a vulnerability soon after it is published.
What to Keep Updated
| Component | How to Update |
|---|---|
| CMS core (WordPress, Joomla, etc.) | Enable auto-updates in the CMS dashboard |
| Plugins and extensions | Enable auto-updates or check weekly |
| Themes | Delete unused themes. Update active ones. |
| PHP version | cPanel → MultiPHP Manager → select the latest stable version |
| Server OS (VPS only) | sudo apt update && sudo apt upgrade -y + enable unattended-upgrades |
WordPress Auto-Updates
WordPress auto-updates minor releases by default. For plugins:
- Go to Plugins → select all plugins
- Click Enable auto-updates from the bulk actions menu
Test updates on a staging site first if you run WooCommerce or a complex plugin stack. Fixing a broken checkout takes longer than testing the update.
Step 4: Add Security Headers
Security headers tell browsers how to treat your content. The set below blocks clickjacking and MIME sniffing and limits what the browser shares with other sites, at no performance cost. Protection against cross-site scripting (XSS) needs a Content-Security-Policy, which is covered in the Nginx/Apache guide linked below.
On shared hosting (via .htaccess):
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Strict-Transport-Security "max-age=300"
Raise the HSTS value carefully. Once a browser sees a long max-age, it refuses plain HTTP for your domain until that time runs out, and you can’t undo it from the server. Start with max-age=300. When every page and subdomain works over HTTPS, raise it to max-age=31536000. Add includeSubDomains only after you’ve confirmed every subdomain has a valid certificate.
On a VPS (Nginx or Apache): See the full header configuration in Secure Nginx and Apache.
Verify Your Headers
curl -I https://yourdomain.com
Check that each header appears in the response. You can also use securityheaders.com for a graded report.
Step 5: Set Up Backups
Backups cover the failures that security measures can’t prevent: a bad update, a deleted file, a compromised account. With a recent backup you can restore quickly instead of rebuilding.
On GoZen Shared Hosting
GoZen takes a daily offsite backup of every shared and WordPress plan with Backuply and keeps it for seven days. You can restore from Backuply in cPanel where it’s available, or open a support ticket and we’ll restore it for you. See Using Backuply.
Keep your own copies too:
- cPanel: Backup Wizard → Full Backup → download to your local machine
- WordPress: Use UpdraftPlus to schedule backups to Google Drive, Dropbox, or S3
On a VPS
You’re responsible for backups. Options:
- GoZen automated backup add-on (server snapshots)
- Automated Backups with Restic or Rclone for a proper off-server backup pipeline
- Database-only:
mysqldumpon a cron job
Test your backups. Until you’ve restored one, you don’t know whether it works.
Step 6: Use a Firewall or WAF
A firewall blocks malicious traffic before it reaches your application code.
Shared Hosting
Every GoZen shared and WordPress account gets a web application firewall and malware scanning: cPGuard or Imunify360, depending on the server. It runs automatically, and you can see what it’s blocking from its page in cPanel.
For an extra layer, put Cloudflare in front of your site. The free plan gives you DDoS protection, a basic WAF, and bot filtering.
VPS
Configure your server firewall:
- UFW (Ubuntu/Debian) or firewalld (Rocky/AlmaLinux). On cPanel servers, use the firewall that comes with your security suite. CSF is no longer maintained by its original vendor (ConfigServer closed in August 2025).
- Only open the ports your services need, typically 22, 80, and 443
- Add Fail2Ban for dynamic IP blocking
On VPS and Business Cloud plans, cPGuard is available as an optional paid add-on.
Full guide: How to Set Up a Firewall (UFW and CSF).
Step 7: Monitor and Scan
Set up monitoring so you hear about problems before your visitors do.
Uptime Monitoring
Use a free monitoring service to alert you when your site goes down:
- UptimeRobot: free for up to 50 monitors, checks every 5 minutes
- Better Stack: includes status pages and incident management
Security Scanning
- cPGuard or Imunify360: automatic malware scanning on shared and WordPress hosting (check its page in cPanel)
- GoZen Security Scanner: run an external audit against your site
- WordPress: Wordfence (free) does file integrity checks and vulnerability scanning
- SSL Labs: re-check your SSL configuration every few months
Watch Your Logs
On a VPS, check access logs for suspicious patterns:
# Most active IPs hitting your site
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20
# Login attempts (WordPress), successful and failed
grep "POST /wp-login.php" /var/log/nginx/access.log | wc -l
If you see thousands of login attempts from a single IP, your brute-force protection is either missing or not working.
Security Checklist
Run through this after completing the steps above:
Bookmark this list and check it again every quarter.
| Step | Check | Status |
|---|---|---|
| HTTPS | Site loads over HTTPS, HTTP redirects, SSL grade A or above | ☐ |
| Passwords | All accounts use unique 16+ character passwords | ☐ |
| 2FA | Enabled on hosting panel, cPanel, and CMS admin | ☐ |
| Updates | CMS, plugins, themes, and PHP are current | ☐ |
| Auto-updates | Enabled for CMS minor releases and plugins | ☐ |
| Headers | Security headers present in HTTP response | ☐ |
| Backups | Automated and tested within the last month | ☐ |
| Firewall | Active (cPGuard or Imunify360, UFW/firewalld, or Cloudflare) | ☐ |
| WAF | Server-level or CDN-level WAF active | ☐ |
| Monitoring | Uptime alerts and security scanning configured | ☐ |
| Unused software | Inactive plugins, themes, and test installs removed | ☐ |
What to Do Next
- Securing WordPress: WordPress-specific hardening beyond the basics
- VPS Security Checklist: server-level hardening for unmanaged VPS
- Server Hardening Basics: Fail2Ban, sysctl, and service management
- How to Secure Nginx and Apache: web server hardening deep dive
- How to Set Up Cloudflare with GoZen Host: CDN and DDoS protection layer
Last updated 21 Oct 2026, 00:00 +0300.