❗ Before You Begin

This checklist is designed for:

• Beginners who want clear instructions
• Business owners who need reliable protection
• WordPress users
• Nairahost customers using cPanel or DirectAdmin
• Anyone who needs an easy, printable security guide

⚠️ A website that is not secured WILL eventually get hacked. This checklist prevents that.

✔️ Step 1 — Hosting Account Security

• ✔️ Strong, unique hosting password
• ✔️ Two-Factor Authentication enabled (cPanel/DirectAdmin)
• ✔️ No sharing login via WhatsApp, email, etc.
• ✔️ Last login checked for unknown IPs
• ✔️ Only trusted developers given access
• ✔️ Password changed after developer work
• ✔️ Correct nameservers in use:

  cPanel → ns1.nairahost.cloud / ns2.nairahost.cloud
  DirectAdmin → ns1.nairahost.com.ng / ns2.nairahost.com.ng
          

✔️ Step 2 — SSL & HTTPS

• ✔️ SSL certificate installed
• ✔️ HTTPS forced using cPanel redirect or .htaccess
• ✔️ No mixed content warnings
• ✔️ Padlock icon visible on all pages
• ✔️ HSTS enabled (optional advanced)

✔️ Step 3 — WordPress or App Security

• ✔️ WordPress fully updated
• ✔️ Plugins & themes updated
• ✔️ No nulled or pirated themes/plugins
• ✔️ Security plugin installed (Wordfence / iThemes / AIO WP Security)
• ✔️ Login URL changed from /wp-admin
• ✔️ 2FA enabled on admin login
• ✔️ Limit login attempts enabled
• ✔️ XML-RPC disabled
• ✔️ File editing disabled:

  define('DISALLOW_FILE_EDIT', true);

• ✔️ Strong passwords for all users
• ✔️ No extra or unknown admin accounts exist

✔️ Step 4 — Malware & Vulnerability Protection

• ✔️ Website scanned regularly for malware
• ✔️ Firewall is active
• ✔️ No suspicious PHP files in uploads folder
• ✔️ No encoded backdoor code (eval, base64, etc.)
• ✔️ Database scanned or cleaned
• ✔️ Restore points / backups available

⚠️ Your website can be hacked even if it looks normal — always scan and check logs.

✔️ Step 5 — Backups

• ✔️ Automatic backups scheduled
• ✔️ Offsite backup stored in Google Drive / Dropbox
• ✔️ Backup contains both files + database
• ✔️ Backup exists before major updates
• ✔️ Restore test completed successfully
• ✔️ JetBackup enabled & usable if available

✔️ A backup stored only inside your hosting is NOT a real backup. Always keep one copy away from your hosting.

✔️ Step 6 — Email Security

• ✔️ SPF record added correctly
• ✔️ DKIM enabled and working
• ✔️ DMARC record created
• ✔️ Mail-tester.com score above 9/10
• ✔️ No duplicate SPF records in DNS

⚠️ Without SPF/DKIM/DMARC, ANYONE can send fake emails pretending to be you.

✔️ Step 7 — DNS & Nameservers

• ✔️ Only ONE set of nameservers in use
• ✔️ DNS records documented
• ✔️ DNS zone checked for unknown records
• ✔️ No strange redirect records exist
• ✔️ A record points to correct server

If using Nairahost DNS, the secure nameservers are:

cPanel:
ns1.nairahost.cloud
ns2.nairahost.cloud

DirectAdmin:
ns1.nairahost.com.ng
ns2.nairahost.com.ng

✔️ Step 8 — Developer & Access Control

• ✔️ Password changed after developer access
• ✔️ No shared credentials exist
• ✔️ Only trusted people have access
• ✔️ No outdated developer accounts remain
• ✔️ Sensitive information is not stored in plain text

⚠️ Most hacked sites are not hacked by “hackers” — they are leaked by old developers or weak passwords.

✔️ Optional Advanced Protection

• ✔️ Cloudflare with WAF enabled
• ✔️ Server firewall rules added
• ✔️ SSH key authentication instead of password
• ✔️ HSTS enabled
• ✔️ Login by IP whitelist

✔️ Complete Printable Checklist (Summary)

[ ] Strong passwords everywhere
[ ] 2FA enabled (cPanel, WordPress, email)
[ ] No unnecessary admin accounts
[ ] SSL installed + forced HTTPS
[ ] Security plugin active
[ ] Firewall enabled
[ ] Malware scan clean
[ ] Backup exists & tested
[ ] SPF / DKIM / DMARC configured
[ ] No nulled plugins/themes
[ ] Login attempt limits enabled
[ ] XMLRPC disabled
[ ] File editing disabled
[ ] Nameservers are correct
[ ] DNS verified
[ ] Emails deliver to inbox
[ ] Last login checked
[ ] Backup stored offsite