In my career as of now, I had the chance to work in many environments’ setups, different cultures, different projects, different challenges, and so on. One of the most difficult ones for me has been to lead a small technical team in a startup-like routine, the kind of company where almost everything was to be done from the decisions side to the processes and applications.

I have been in the center of some important technical decisions, one of my attributions was to manage the company’s private hosting department till we found the right candidate to fill that spot once the financial resources will suffice, with more than 400 active clients that seemed like 4000 clients to me as a single technical person with the help of a nice decentralized team of live support agents, every single day was a battle.

In this small write-up, I’m going to dig a little bit into the situation I have been in to manage more than 400 WordPress installations for paid customers in a subscription model.

The company inherited from these Cpanels (Business acquisition) as do I. The thing behind taking in hand a work that has been done with a previous process is that it can lead to two situations, where the most willing one is for sure that all common best practices have been applied to enable easier management of the resources, and the less good one could be that a few decisions have been missed to make the work even greater. As it’s well-known there are no small risks in the security domain since every single opportunity given to a hacker can lead to service disruption or at least over-exploitation of resources. As you have guessed the work has been started with good intention and of course some interesting automation, but the security side has never been a full concern since most of the company energy was dragged on other (also) important problems still to satisfy the customers.

The fleet of installations was perfectly running for some time now, maybe for almost one year before the first security attacks have been noticed by some team members and also reported by a few customers who couldn’t fully take advantage of resources as specified in the terms of usage that we had with them at that time. It was coming from multiple places so it started to be evident to me that once they have noticed the flaws on one Cpanel/WordPress, the attackers automated the process with many Cpanels/WordPress setups to perform their malicious activities.

The malicious attacks were very difficult because it was far from determining the exact causes because of many breaches that have been found after a thorough check. There are malicious intrusions from many sides to accomplish diverse actions like:

• Spamming other persons (emails).
• Getting sensitive data from the database.
• Backlinking to improve some e-commerce websites’ reputations.
• Almost all core PHP files were infected with encrypted PHP codes you can’t guess their utility at first view.

Moving forward, once I made sure the Cpanels were out of the scope in terms of security improvements, I went down add more flesh to the websites themselves. Somehow, we have been lucky since each website has at least an existing backup that we kept secured.

As part of the suggested solutions for the customers, we started helping some of them to apply a few of these items in the following list:

• Enforced a strong password policy for administrators.
• Installing (on their behalf) WordPress’s Wordfence security plugin which is shipped with many interesting options: enforcing strong password for users, scanning core WordPress files to determine those which have been tampered with and recovering their initial content, enabling 2FA for administrators accounts, IP address blocking strategy for multiple failed login attempts.
• Making sure WordPress websites could redirect HTTP traffic to HTTPS, some plugins are available for that. Another alternative is to configure this at the Cpanel level (.htaccess file).
• Make sure the MySQL databases couldn’t be accessed remotely (non-localhost connection).
• Replaced corrupted core WordPress files with their original content got from wordpress.org while making sure to respect the version in use.
• Always use the latest versions of WordPress, active themes, and plugins since they keep fixing flaws once discovered.
• Recommend to add websites on Google Search Console to fight against these hackers who are making false indexes on Google search results using your domain name to promote their content.

We are all tempted to buy a Cpanel account for any new ideas that pop up in our minds so that we can create a quick website for it in a few minutes before even thinking about anything else. Just to confess, I’m into that flow as well, I bought many Cpanels for myself during the past 7 years, some have been shut down while I’m still managing a few as of today. Along the way, I experienced difficulties keeping them secure.

For me, the Cpanel dashboard has been easier to secure than WordPress. In addition to all the recommendations listed in the former parts of this article, here’s a special and non-clean approach I still use today to keep my WordPress out of certain security attacks: Always disabling access to wp-login.php and wp-admin.php files by using a few Apache directives in the .htaccess config file, that’s all. By doing so, there are a lot of attacks that will never reach inside my website if they need to perform a login action before their main actions. Then, whenever I want to use the admin part of the website again, I jump into my Cpanel File Manager to disable these directives for the login and dashboard pages/actions to work normally.

I put this in the wp-admin folder .htaccess file so that the admin dashboard remains unreachable:

<Files *.php>
deny from all
</Files>

Disabling the login page by pasting the following three lines in the .htaccess file in WP root folder:

<Files wp-login.php>
deny from all
</Files>

Sometimes, I feel like maybe Cpanel is over-rated for some particular cases. In my humble opinion, if the intent is just to run a single WordPress website considering that you don’t want to deal with any hassle regarding the security aspect of it, I strongly recommend using a fully-managed service like the dotcom version of WP that comes with everything put in place. This puts all the responsibility on the SAAS service that you chose so that you can simply focus on the management of your website which is much easier for non-technical users, here are some examples:

• wpengine.com
• siteground.com
• hostinger.com

The fully managed WordPress alternative may come in handy but also costly but if you are truly looking for a scalable and cost-effective alternative to start writing right away while benefiting from fast page rendering (speed) and a high level of security, you should check the following article: ghost as choice over traditional CMS.

I will never regret going on that path to solving these security issues since they opened my perspectives in terms of security concerns, allowed me to surpass myself, and brought my Cpanel skills to the next level that I even decided to take the Cpanel Professional certification (CPP).

For some individuals, it all boils down to the real cost of owning and managing a Cpanel installation themselves instead of gaining knowledge and/or recruiting/paying a webmaster/SAAS to take full responsibility for their system. Yes me also, at some point, I let that responsibility to the right person the company looked for to continue the task.

To summarize, we concluded that WP is easy, but as an end-user, keeping a production-grade WordPress installation on a Cpanel is a difficult process that demands constant attention since security is very important and should be taken seriously from day one.