Soft2Hosting

WordPress Security on Shared Hosting: User Accounts, Updates and a Hacked-Site Recovery Plan

30 Oct 2026 · 3 min read

On shared hosting, most WordPress security comes down to two habits and one plan: strong, separate logins with two-factor authentication, prompt updates to WordPress, themes and plugins, and a written recovery plan you can follow if the site is hacked anyway. File permissions and configuration matter too, but stolen passwords and outdated plugins are where most trouble starts.

Our earlier post covers wp-config protection, file permissions and XML-RPC hardening. This one covers the people and process side.

Part 1: Accounts

Strong, unique passwords everywhere

WordPress's hardening guide advises against passwords built from names, usernames or the site name, dictionary words, short passwords, or passwords that are all numbers or all letters. Use a password manager to generate them. That applies to every way into the site: the WordPress dashboard, cPanel, FTP or SFTP accounts, and the MySQL database user.

Turn on two-factor authentication

The hardening guide recommends two-step authentication as an extra layer. Add a two-factor plugin and require it for administrators and editors at minimum.

No "admin" username, and fewer administrators

Avoid obvious administrator usernames like "admin" or "webmaster". Give each person their own account at the lowest role that lets them work: editors for content staff, authors for writers, and administrator only for the one or two people who install plugins.

One database user per site

The guide recommends a separate database and database user for each site where possible. On a shared hosting plan with several WordPress sites, create each from its own database in cPanel so a problem in one site cannot read the others' data.

Part 2: Updates

Older WordPress versions stop receiving security fixes. WordPress has had automatic updates since version 3.7; leave them on, and enable automatic updates for plugins and themes you trust from the Plugins and Themes screens. Download WordPress and plugins only from wordpress.org or the developer's own site.

Remove plugins and themes you are not using; deactivated code can still be attacked.
Replace plugins that have not been updated in a long time.
Check the dashboard for pending updates at least weekly.

Part 3: Backups you can trust

WordPress's guide recommends regular backups of files and database, kept as dated snapshots so you still have a copy from before a compromise was noticed. Soft2Hosting's Starter Pro plan includes weekly backups and the Business Pro and Enterprise Pro plans daily backups; still download your own copy before big changes, and keep a few older ones, because the newest backup may already contain the infection.

Part 4: If the site is hacked

WordPress.org's "My site was hacked" FAQ lists clear signs: the site is blacklisted by search engines, the host disables it, visitors' antivirus flags it, unknown users appear, or the hack is visible on the page. If you see any of them, work through these steps in order:

Write down what you see. Note the symptoms, when you noticed them and anything you changed recently, such as a new plugin. This becomes your incident record.
Tell your host. On shared hosting the problem may affect more than your site, and the host can confirm whether it is a hack or a service fault. Email support@soft2hosting.com with your notes.
Scan the site and your own computer. Use a security scanner plugin and a remote scanner on the site, and run a full antivirus scan on every computer used to log in; the FAQ notes that infections often start with stolen logins from a local machine.
Reset all access. Change passwords for WordPress users, cPanel, FTP or SFTP and the database. Then generate new secret keys and replace them in wp-config.php, which logs everyone out.
Take a snapshot of the infected site. Back it up before cleaning, so you have a reference if the clean-up goes wrong.
Restore or clean. If you have a clean backup from before the hack, restore it. Otherwise replace the wp-admin and wp-includes folders with fresh copies of the same WordPress version, uploaded by FTP or File Manager rather than the dashboard's reinstall button, which only overwrites existing files and leaves added ones behind.
Check the usual hiding places. Look at .htaccess files, and at index.php, header.php, footer.php and functions.php in your theme, for code you did not add.
Update everything. Bring WordPress, themes and plugins to current versions once clean.
Change the passwords again. The FAQ is explicit: change them after the site is clean, not only when you found the hack, and consider changing the database user and password too.
Clear warnings. Register the site with Google Search Console and Bing Webmaster Tools and request a review if it was flagged.

Locked out of wp-admin?

If an attacker has taken over the administrator account, use phpMyAdmin in cPanel to change that user's email address in the users table, then use the "Lost your password?" link on the login page to reset it.

Mistakes that make things worse

Restoring the newest backup without checking it predates the hack.
Changing passwords only once, before the clean-up.
Cleaning the site but not the computer that leaked the password.
Reinstalling with a different WordPress version from the one the site was running.

Every Soft2Hosting shared hosting plan includes cPanel, free SSL and scheduled backups, with basic DDoS protection on Business Pro and advanced DDoS protection on Enterprise Pro.