Install protection on your resource

[subornaakter20]

make sure that your site has plugins for regular checking of database files (they need to be installed);

the admin panel should not be easily accessible. Add another password at the entrance or make authorization mandatory (via jp-address);

for all resource elements that remain unchanged forever, mark them as "read only";

go to the php.ini file and disable options that list of timeshare owners are not used;

Disable access to PHP scripts in all folders with cache, temporary files and downloads.

All these actions will strengthen the protection of your resource from external intrusions. Entrust the work to web specialists if you yourself are not very knowledgeable in these matters.

Always remember that any security measures taken do not provide a full guarantee that the site will not be hacked. It should be understood that a number of people have access to both the site and the hosting. These are administrators, SEO and web specialists, content staff, etc. And here it is important to set up work in such a way as to minimize the risks of third-party penetration through site vulnerabilities.

The first thing to do is to properly organize access to the resource. Let each employee have their own zone of action, with an independent password and privileges (there should not be many of them). Each manipulation of the administrator should be recorded in the log (action log). When working with ftp/ssh hosting, the same precautions should be taken.

Second, admin passwords (for the site and hosting) must be strong and changed frequently enough.

Third, use an sftp connection (that is, a secure one), not ftp.

The security of the site must be constantly monitored, and this is not always easy. On the one hand, it is important to ensure reliable protection, on the other - to create conditions in which the administration of the resource will be convenient and effective.

Always keep in mind that no matter what modern tools you use, the probability of vulnerabilities on the site still remains. Moreover, on larger resources there are more threats (after all, they have more extensive functionality). A full system check can sometimes take days or even months.

The most correct approach is to think through the security issues of the resource at the stage of its development. Then you will not have to rack your brains over how to correct the consequences of hacker attacks.