There is no such thing as zero risk, but a few consistent practices greatly reduce the chance of a website being compromised. Security depends on the whole chain: your device, your accounts, the website software, and your ability to recover.
What to do first if you suspect unauthorized access
- Confirm the scope: check whether the problem affects one website, one hosting account, or several accounts and services.
- Use a trusted device: from a device you believe is clean, change the affected credentials and any reused passwords. Revoke active sessions, API keys, and other access tokens where the service allows it.
- Preserve a copy: before deleting files or disabling components, save a copy of relevant files, logs, and other evidence. A rushed cleanup can make the cause harder to find and recovery harder to verify.
- Contact support: tell Bacan what you observed and when it started so we can help identify the safest next step.
Protect your computer and accounts
- Keep your operating system, browser, and applications updated. Apply security updates promptly.
- Use unique, long passwords or passphrases. A password manager can generate and store them. Do not rely on arbitrary mixtures of character types or routine password changes; change a credential when it is exposed, reused, or suspected to be compromised.
- Enable multifactor authentication. Protect your hosting panel, email, CMS, domain registrar, and administrator accounts. Prefer phishing-resistant methods when available.
- Use reputable device security controls. Keep built-in malware protection and the device firewall enabled, and investigate unexpected programs or network activity.
- Limit access. Give each person only the permissions they need and remove old users, shared credentials, and unused access methods.
Protect the website
- Update the CMS, plugins, themes, libraries, and server-side runtimes. Remove components you no longer use, especially abandoned ones.
- Back up regularly. Keep copies separate from the live website and test that they can actually be restored.
- Use HTTPS. A TLS certificate protects data in transit between visitors and the website.
- Follow the software's permission model. Use least privilege and the hosting or application documentation; there is no universal safe file-permission number for every website.
- Protect forms and administrative endpoints. Validate input, limit abusive requests, and use CAPTCHA or similar controls where they address a real abuse risk.
- Review accounts and activity. Remove unknown administrators and investigate unexpected content, redirects, login alerts, outgoing mail, or traffic spikes.
How can I tell whether a website was hacked?
Warning signs include unexpected pages or redirects, unknown administrator accounts, altered content, security warnings, new outgoing email, unusual traffic, or alerts from your hosting provider or security tools. A site can also be compromised without obvious visual changes, so suspicious account activity deserves attention.
What if Bacan suspends my website?
If Bacan suspends a website because of a security problem, it may contain phishing or other malicious content, or it may be putting visitors or the hosting infrastructure at risk. Suspension can be a protective step while the issue is investigated. Do not simply remove the visible file and restore the site without checking the account, credentials, software, and backups that may have allowed the compromise.