Security: Where to Start

The security controls KapsuleHost gives you, the ones you have to switch on yourself, and what to do first if something has already gone wrong.

Security on a hosting platform is shared. We look after the infrastructure, the network, patching the platform layer, and keeping your data backed up. You look after your passwords, your account access, and the application code and plugins you choose to run. Most real incidents start on that second side, which is why this page is mostly about the things you control.

If you think your site or account is compromised right now, stop reading the overview and go to If Your Site Is Hacked. Speed matters more than completeness in the first hour.

Layer 1: Your Kapsule Account

Your Kapsule account can change DNS, read backups, and spend money. It is the most valuable thing to protect, and it is protected by exactly two things: a password nobody else knows, and a second factor.

Turn on two-factor authentication. Settings, then Security. It is the single highest-value ten minutes in this entire help centre. Save the recovery codes somewhere that is not the same phone. See Two-Factor Authentication and Account Security.

Use a unique password. Reused passwords are how most accounts are lost, because the breach happens somewhere else entirely.

Give people their own logins. If a colleague, developer or agency needs access, invite them as a team member with the role they need rather than sharing your credentials. When they leave, you remove one account instead of changing every password you own. See Team Members.

Know what happened. The audit log records account activity, which is what you need when you are trying to work out whether something was you, your developer, or someone else. See Audit Log.

Recovery paths, before you need them: Lost 2FA Recovery and Lost Account Email.

Layer 2: Your Domain

A domain that is taken from you is worse than a site that is defaced, because everything else follows the domain: your website, your email, your password resets.

Registrar lock is on by default and blocks unauthorised transfers. Leave it on except when you are deliberately transferring out.
Keep the registration contact reachable. Registries send expiry and verification notices there, and a bounced verification email can suspend a domain. See Contact Details.
Auto-renew removes the most common way people lose a domain, which is forgetting. See Renewals and Expiry.
DNSSEC signs your DNS answers so they cannot be forged in transit. See DNSSEC.

Removing DNSSEC in the wrong order takes your domain completely offline. The DS record must be removed at the registrar and confirmed gone from the parent zone before you unsign. Read the guide before touching it.

Layer 3: Encryption in Transit

Every Kapsule site should be served over HTTPS, and certificates are issued and renewed automatically once DNS points to us. Two things go wrong:

The certificate never issues. Nearly always because DNS is not resolving to us yet, or a CAA record on the domain forbids the issuing authority. See SSL Certificates.
The padlock breaks on a working site. Mixed content: an HTTPS page loading an image or script over plain HTTP. See Fixing Mixed Content.

If you put a third-party proxy in front of your site, understand what it does to certificate issuance and to the client IP address we see before you switch it on. See Using a Third-Party Proxy or CDN.

Layer 4: Your Site and Its Code

This is where nearly every real compromise happens, and almost always through one of three doors: an out-of-date plugin, a weak application password, or a file uploaded by someone who should not have been able to upload it.

Update things. Not glamorous, and it is the whole game. Automated scanners look for exactly one unpatched, widely-installed plugin. See WordPress Updates, Automatic Updates and WordPress Plugins.

Delete what you do not use. A deactivated plugin still has files on disk, and files on disk can still be reached. Remove it properly.

Use the site security controls. Each site has a Security tab with the platform-level hardening for that site. See Site Security.

Restrict access where it makes sense. Password protection puts an authentication wall in front of a staging or pre-launch site. Geo-blocking refuses traffic from countries you do not serve. Neither is a substitute for patching, but both cut your exposure. See Password Protection and Geo-Blocking.

Keep secrets out of your code. Database passwords and API keys belong in secrets or environment variables, not committed into a repository. See Site Secrets and Environment Variables.

Be careful with file access. SFTP and SSH are key-based and scoped to your site. Do not hand credentials to a contractor you cannot revoke. See SFTP Access and Adding SSH Keys.

Layer 5: Email

Email security is mostly about proving that mail claiming to be from you actually is.

SPF, DKIM and DMARC are the three records that let receivers verify your mail and reject forgeries. Without them, anyone can send as your domain and your own mail lands in spam. See SPF, DKIM and DMARC.
A compromised mailbox is the most common source of a domain suddenly being blocked everywhere. See Spam Sent From Your Domain and Blacklist Delisting.
Phishing that impersonates you or us should be reported, not just deleted. See Phishing and Impersonation.

Layer 6: Being Able to Undo It

Every other layer can fail. This one is what makes that survivable.

Automatic daily backups run for you and are retained for 30 days, stored away from the machine that made them. Longer retention is available as an add-on. Point-in-time recovery narrows how much work a bad change can cost.

The part people skip: test a restore before you need one. A backup you have never restored is a hypothesis. See Taking a Backup, Restoring From a Backup and Point-in-Time Recovery.

If Something Has Already Happened

If Your Site Is Hacked for the immediate sequence.
Malware Cleanup for getting the site clean and keeping it clean.
Account Suspended if access has been cut, which is sometimes a protective response rather than a billing problem.
Reporting Abuse if the problem is someone else's behaviour, not yours.
Opening a Support Ticket, with the domain, the timeline, and what you have already tried.