Securing Your Site and Recovering From a Hack

Your website and newsletter are your printing press. If someone takes the domain, they also take every email address on it and every link you have ever shared. If someone takes the newsletter account, they get your readers' trust and their email addresses. These accounts deserve the strongest protection you own.

The domain registrar

The registrar is the top of the chain. Whoever controls your registrar account can point your domain anywhere, including at a fake copy of your site, or transfer it away.

• Two-factor with a security key on the registrar account (lesson 3). This is one of your six most important accounts.
• Registrar lock on. ICANN's status codes include clientTransferProhibited, which tells the registry to "reject requests to transfer the domain," plus clientUpdateProhibited and clientDeleteProhibited (ICANN). Most registrars bundle these as a "domain lock" toggle. Check that yours is on.
• Registry lock, if your registrar offers it, sets the server-level version. Removing it takes manual steps between registrar and registry. For a solo writer, that slowness is the feature.
• Auto-renew on, with a valid card. Expired domains get scooped up and used to impersonate the former owner.
• Contact email on a different domain. If the registrar's alerts go to an address on the same domain and the domain is hijacked, you lose your alerts with it.
• Privacy service on so your home address does not appear in public domain records.

Hosting and file access

The CMS and its plugins

Most website break-ins come through outdated plugins and themes, not the core software. For WordPress, the developer documentation says minor core releases (maintenance and security) and translations update automatically, and have since version 3.7. Plugins and themes do not update automatically by default except in special cases like critical security patches (WordPress). So:

1. Turn on auto-updates for every plugin and theme you keep.
2. Delete plugins and themes you do not use. Deactivated is not deleted; inactive code can still be attacked.
3. Give every person their own login with the lowest role that works. Guest writers do not need Administrator.
4. Turn on two-factor for admin logins.
5. Check the user list monthly for accounts you do not recognize.

The newsletter account

• Strongest two-factor the platform offers, on the owner account and every collaborator.
• Export your subscriber list monthly and keep it in your encrypted backup. If the account is lost, the list is your audience.
• Review who has access and remove anyone who no longer needs it.
• Connect payouts to a bank account with its own two-factor, and watch for changes to payout details.

Recovering from a hack, step by step

Order matters. Fixing things in the wrong order lets the attacker back in. Work from a device you trust: if the takeover might have come through malware, use a different computer or a freshly updated phone.

If the website itself is hacked

1. Put the site in maintenance mode or ask the host to take it offline, so it does not spread malware to readers.
2. Change the hosting panel, SFTP, database and CMS admin passwords, from a clean device.
3. Look for admin users you did not create, and delete them.
4. Restore from a clean backup made before the break-in. If you do not know when it started, go back further.
5. Update the CMS, every plugin and every theme before going back online. Otherwise the same hole lets them back in.
6. Check that the domain's DNS records and registrar contacts have not changed.
7. Ask Google Search Console to review the site if it was flagged as dangerous.