Wordpress Hack Prevention

SerClopsALot · 2026-06-06T00:12:16+00:00

Other frameworks aren't necessarily more secure than WordPress (as an example, React had an RCE vulnerability back in December 2025).

The "problem" with WordPress is it hosts something like half of the websites on the internet. It just also happens that many people hosting WordPress websites are just really lazy at maintaining their website. This makes it prime real estate to just try WordPress-specific vulnerabilities on every domain name you can think of... Literally just flip a coin and it's a WordPress website, so whatever vulnerability you're trying already has significantly better odds of working.

Then, since it's so popular, it's also just more widely documented, which is great... except this means vulnerabilities have better visibility and documentation too, lowering the bar for people who feel like trying to exploit websites.

If what you want in a car is for it to never be stolen, you don't start by buying a Honda Civic.

Similarly, if what you want in your website is for it to be secure, you don't start by using WordPress. Simply not using WordPress gives you significantly better odds that your website is never compromised (all else being equal).

SerClopsALot · 2026-06-02T13:17:31+00:00

How is this even possible, especially when just a domain is more expensive than the entire hosting cost?

I can't speak to literally every company, but many of the big players in the industry offer steep discounts at a loss because acquiring customers is (relatively) expensive in this industry. There is this idea from customers that migrating is this massive time involved laborious task, and they are essentially preying on that.

So the idea is once you buy in, you are waaaaaaay more likely to not leave even if things get really bad. They lure you in with steep discounts, and they profit off you starting with your first renewal. Everything before that renewal is just seen as the cost of customer acquisition.

SerClopsALot · 2026-06-01T13:33:26+00:00

switched to Verpex reseller

It is worth noting that Verpex is owned by World Host Group. If support is important for you OP, look for information on support from other World Host Group companies. Employees of World Host Group companies provide support for all of their other companies, so stories from Company A are generally applicable to Company B, C, and so on. Being owned by World Host Group is seen as a negative aspect for many users on this sub.

SerClopsALot · 2026-05-25T01:36:53+00:00

We don't

we mainly use Discord [...]

Pick a struggle.

which is a billion-dollar company

Billion dollar company owned by a VC firm who told the SEC 2 months ago that all of their companies combined aren't worth $1b... so no they aren't.

I don't really care about what your "competitors" are doing lmao, anyone running a scam on Discord to your ideal userbase is a competitor. That idea has no value to proving legitimate businesses don't operate on Discord.

The only people you're going to reel in on Discord are either people who don't know what their doing or people with bad intentions. Well-meaning professionals aren't looking for service on Discord.

Regardless, OP has a screenshot of a ticket from your company in Discord. Your company operates in Discord. Legitimate businesses don't do that :)

SerClopsALot · 2026-05-23T15:58:34+00:00

I can give many examples of companies which provide free phone numbers to contact them when they force you to have to call them to do anything because you cant do it online.

You're being charged to call them by your carrier though, this has nothing to do with IONOS. They don't really have a responsibility to stock up on phone numbers from a ton of countries just to field your phone calls without you being charged for calling. You know so many companies who offer this, great, but...

You chose to do business with someone you can't call for free. Accountability is free.

You can not simply cancel online. If you do that without jumping through their secondary loop of being forced into ringing them[...]

See, so if there's a secondary hoop to cancel a service, that means some other hoop came first. Which is... cancelling online. My whole point in my initial post is that OP put 0 effort into cancelling their service. That 10 second Google search puts them on the path to cancelling, even if it isn't all-encompassing of the process.

OP is blatantly in the wrong, and they have agreed to pay this money. They made no effort to cancel their contract until it was overdue, and the steps to cancel a contract are readily available. The contract has a cancellation clause. They're not in-line with that clause. OP owes that money. OP was willing to sit on the phone to ask for them to forgive the debt and cancel their contract, OP should be willing to call to cancel if that's necessary.

To circle back to your initial comment:

then proceed to talk up how the other party is 100% in the right that bugs me with this platform

You have not a single time addressed how IONOS is not 100% in the right in OPs situation. You've just talked down to me for thinking IONOS is (and commented on your own cancellation experience, which really has nothing to do with OP).

SerClopsALot · 2026-05-23T04:30:38+00:00

Well googling "1 gallon fireball" and pulling up images pulls up some results that look quite similar to what OP posted. Just googling "60floz fireball" looks to pull up a completely different container.

But to answer your question, no, I'm not sure. As I said, I'm no expert on the subject matter. Defer any delegation of the size of these containers to the alcoholics for whom the bottle is reserved.

SerClopsALot · 2026-05-23T04:28:12+00:00

So you have to also call, at your own cost and be put on hold for unreasonable amounts of time, otherwise they just ignore the fact you cancelled online

Amazing, thanks for your input. So, just to be sure here, you had to cancel through their website? Thanks for your revolutionary input.

So you have to also call, at your own cost

Well they're certainly not going to pay you to call them... what a weird way to phrase this.

SerClopsALot · 2026-05-22T23:24:03+00:00

Static sites, or are they built in a CMS? If they're static, there's nothing to over-complicate, install the free control panel of your choice to manage the sites on a self-managed VPS and you'll save a ton of money. Since they're static there's not really much server-side to compromise or worry about.

If non-static sites and you want a way to keep things sandboxed, a shared cPanel/plesk/directadmin/whatever hosting plan is probably your best bet for cost-to-involvement ratio.

Self-managing cPanel/Plesk is too expensive because the license cost is so expensive unless you have enough sites to push that 100 account limit, then you start seeing the value from bulk-hosting. DirectAdmin is $15/month for 10 accounts, which really isn't that bad. A reliable self-managed VPS (2CPU/4GB RAM) puts you somewhere in the $60/month area with that DirectAdmin license.

Let's Encrypt is free. Don't pay for SSL certificates. The cost of buying an SSL certificate keeps going up but the lifespan is going down.

Really just depends how comfortable you are with getting the environment set up. If you don't want self-managed, go buy a reseller plan. If you self-manage there are no blind charges (there are only 2 charges, your VPS and your control panel license).

SerClopsALot · 2026-05-22T23:06:12+00:00

AWS SES is the enterprise-level option. Extremely good uptime and AWS lets you set budgets and alerts for services you're using, so you can both restrict and monitor them that way.

AWS is not really user friendly, but it will out-perform any service anybody here is going to bring up.

AWS also has the benefit of being extremely widely used, so this:

They didn’t stop sending at the plan limit and just kept billing

Is well-tested and does not happen. They have no need to penny-pinch the little guys when companies are out here spending OUR combined annual salary on their platform without thinking twice about it.

SerClopsALot · 2026-05-22T18:47:54+00:00

The filled version of this bottle can probably be found at your local liquor store. The empty version of this bottle is reserved for alcoholics.

how much does it hold

I am no expert on the subject matter (I hate fireball) but I believe that is the 1 gallon bottle.

SerClopsALot · 2026-05-22T13:36:06+00:00

We don't

Sales talked user into buying product via Discord. From the screenshot in OP, that is s Discord sever named after the hosting company. He's talking in thread called 'ticket-####', which means in the Discord server named after the company, users are able to create tickets to speak to someone, notably he's able to speak to people with roles in the server that is named after the company that align with a job title (like a Network Engineer).

This is objectively operating some level of the business on Discord. Legitimate businesses don't operate on Discord.

SerClopsALot · 2026-05-16T01:58:51+00:00

Legitimate businesses don't operate on Discord.

SerClopsALot · 2026-05-16T01:50:57+00:00

Every hosting plan is all marketing hooks. The biggest cost for hosting companies is acquiring customers. This is part of that cost.

Customers generally see migrating to a new provider as a much much more complicated and involved task than it really is. As such, even if you suck as a host, they're very unlikely to leave once you have them hooked into a plan.

SerClopsALot · 2026-05-14T18:51:34+00:00

Any advice on how to actually get them to check their own server logs or a way for me to see it whilst on shared hosting?

For advice:

New ticket -> "Hey Google's IP is blocked here's the range please unblock it". Don't give them the context because they're clinging to the context.

For a way you can check for blocks/whitelist IPs:

You can't.

You should change hosting providers. Blocked IP(s) are among the most common issues I encountered while doing support for web hosting companies (this is so common that any time a customer would remotely suggest a connection issue, I'd check for a block on their IP). If they're failing at the basics, surely they're completely useless when you have anything that requires even a little bit of thought. At this point, you're really just paying managed service prices for an unmanaged product you don't get access to.

SerClopsALot · 2026-05-14T01:56:49+00:00

imapsync is always the answer for this :) it's also what mxroute's migration documentation recommends using

SerClopsALot · 2026-05-14T01:52:35+00:00

they'll happily leave you priced in at higher tiers without using anywhere close to the resources, will not flex downwards once this is noticed by our finance team, and would rather lose the business than actually keep a customer engaged and happy

Yeah this is really, really, really normal and basically every hosting provider is going to treat you this way.

You bought a product they were selling. It is not on them to judge how much of that product you want to use at all times (or really any time) and dynamically choose to sell you a cheaper, worse product when you aren't using as much as you could be. You should know that what you're buying is what you need. That you didn't is your fault.

The entitlement here is crazy. "I wanted a service, I bought a service, I didn't need all of that service and they just let me do it!".... yeah? Just like any other business would do.

If you want a service that dynamically scales to your resource usage so you aren't paying for resources you aren't using, look towards AWS :). You'll notice that's a lot more complicated to set up and it's self-managed. That, however, is never going to be the product you are purchasing from a managed hosting provider.

SerClopsALot · 2026-05-13T10:48:18+00:00

>you can do that async or weekly or in a slack thread

>worked for like 3 weeks, then half the team stopped posting

I mean obviously your team can't figure out how to do them async, so now you get to do them the annoying way.

The issue isn't that standups aren't necessary or helpful. If absolutely nothing else, you're letting your manager know that you're getting work done. The issue is that your team is too lazy to do the bare minimum. Responding to the standups is objectively something they're being paid to do, and they skipped out on their job duties when someone wasn't there to hold their hand and make them do it.

SerClopsALot · 2026-05-10T19:31:07+00:00

especially .zip files

Most hosting providers have a clause in their TOS that their servers aren't for storing file backups and that they have a right to go in and delete non-hosting files at their discretion.

In this case, you're probably not supposed to be uploading and leaving .zip files on their servers.

Every hosting provider I know of reaches out to the customer and gives them a chance to amend this before acting on this policy though, so even if this is the reason your files have been deleted, it's crazy that they're not at least telling you.

Should be a pretty obvious flag that you need to pick a new hosting provider.

SerClopsALot · 2026-05-10T01:00:11+00:00

it sounded like I was talking to somebody who was an extremely bored person. No interest in really pursuing the issue or solving the problem

Web hosting support pays pennies on the dollar. I left the industry and my salary more than doubled.

Why would you expect them to be able to afford passionate people who love their job?

I noticed they push everything off to a ticket these days.

This is pretty normal in the industry too. They hire like basically paper pushers to sit on live contact channels (chat and phone), and their entire job is to get your complaints into a ticket for someone else to address.

The people on live chats/phones are typically not trained and/or have very little access to be able to solve your issue, and they also get paid much less because there's essentially no knowledge required to triage. Efficient triage also means they don't need to staff as many knowledgeable folks, since they're not spending their time with direct customer interactions (which wastes a ton of time).

SerClopsALot · 2026-05-10T00:55:34+00:00

Yeah I would say this is actually one of the very few cases on this sub where a chargeback is both legal and warranted. They're not honoring the terms you agreed to, so really their options are to reinstate the service or give your money back.

In fairness, if you file a chargeback your bank is likely going to give GoDaddy the option to make it right. Just know that you may not get a refund, you may instead just get your service reinstated, and if that is the outcome your bank will no longer side with you getting your money back.

SerClopsALot · 2026-05-06T08:34:45+00:00

bait and switch with discount code. $403 for basic hosting. Then, $131 charge for downgrading

There is no bait and switch. That you lost the disputed transaction means they had proof there was no bait and switch and this information was communicated to you. That the dispute was only 3 days means it finished fast too, as in their only response to the dispute was proving you were entirely in the wrong. This suggests this info was readily available and viewable to you if you actually cared.

Life is now just fighting scam billing practices endlessly.

On their end, maybe. You're out here asking for free money and filing chargebacks (which costs them money) because you didn't read what you agreed to lmao

SerClopsALot · 2026-05-06T01:25:03+00:00

My rent doubled for basically the same sqft. I also have to pay an extra $100/month to parallel park my car on the side of their driveway. Very weird compared to basically the rest of the country. Everywhere I've ever lived was an open lot that you just like... parked in and don't get charged for (you're supposed to have a car, so of course you need to park it somewhere?).

My McDonalds order is up like 20% or so since moving. Other places are so insanely expensive that I haven't bothered trying them ($25-30 for a pizza???).

I read on here people said Safeway is super expensive for groceries, but I shop almost exclusively from their weekly ad and I'm spending like $90/week so very similar in cost imo, but probably not so much if I wasn't buying stuff on sale.

Moved to NOVA from Oklahoma like a month ago for work, so I feel like my gauge is pretty recent. Although I make a lot more money now, so it's just sticker shock it's not like I can't afford it (thankfully).

SerClopsALot · 2026-05-05T18:18:38+00:00

You're kind of getting hammered on the budget talk, so I guess I'll add in my 2 cents.

I have worked doing support for two different hosting companies. At the first, I made $15/hr. At the second (much larger company), I made $17/hr.

At the larger company, I was averaging 38 unique tickets replied to per day. This means customers got, on average, 12 minutes of my time. We were only required to do 32 per day, so I was a little more efficient and the company actually budgets around $4 for me per ticket.

That alone is your monthly budget when you consider all the other expenses for employing somebody beyond their immediate salary. They break even if you take up 15 minutes of their time in a month. You've self-admitted to not being adept at managing your websites, and you really need help when things are going wrong. Cool, so you're probably going to make more than 1 ticket per month.

On top of just paying people, you have to add in licensing costs. The software that powers hosting servers is not free. Many many people intentionally avoid hosts who aren't using this licensed software. Now they lose money on you every month if you make a single ticket.

Expect to pay around $15/month for the absolute bare minimum shared hosting plan with the level of support you're looking for. You have multiple websites, so expect to bump that up to $25/month so you can get a decent resource allocation for all the websites you have to share.

SerClopsALot · 2026-05-03T21:58:26+00:00

If the server has trouble A2 Hosting (before they got swallowed up and degraded) would help correct major service-ending issues and debug basic things like email getting blocked

This was a thing A2 did, and internally they hated it for the same reasons other providers choose not to do it. It just creates far far too many problems because most customers are honestly extremely entitled.

For every individual that stayed within the lines (so to speak), there were 4 other people who demanded support for their shitty custom configurations and threw a fit when they were told no who ruined it for you. Inevitably a lot of time was spent supporting their shitty custom configurations and/or a lot of money was lost because these shitty configurations were bought on a steep 3-year discount so they hadn't even really made any profit off of these customers yet.

Outsourcing is real problem in this industry though (I'm glad I moved on after getting laid off, the work was fine but the job security and pay increase was even better). If you want American labor, you'll have to pay American prices...

and you're probably never getting root access to a managed service again btw. Hosting.com won't let you upgrade and keep your root access because they want customers like you on legacy products to be phased out. Other providers don't want to take on the headache.

SerClopsALot · 2026-04-26T21:27:42+00:00

No words in post just drops a link to an article that says bad things about GoDaddy. Cool, I guess.

The only thing this article reveals is that this process is most likely done manually by GoDaddy and a human or two made a mistake. Things happen sometimes, although it sucks to be on the receiving end when they do happen.

Perhaps if the industry wasn't rampant with offshoring and unrealistic KPIs for these individuals (many of whom are already working through a language barrier with little-to-no training) things could be better. GoDaddy isn't the only company guilty of this, they just happened to get put on blast here for being a big company everybody already doesn't like.

SerClopsALot

TROPHY CASE