Ransomware is associated with company computers and hospitals, but it hits servers and websites too. The usual story: an attacker gets into a server with a weak password, encrypts the website files and databases, and leaves a text file demanding payment in cryptocurrency. If the backups sit on the same server, they are usually encrypted or deleted as well.
How does it reach a server or website? #
The most important defence: the right backups #
A backup that helps against ransomware has three qualities:
- Off the server: Somewhere that whoever controls the server cannot reach.
- Several dates: Copies from several days, because you may not notice the infection the same day.
- Tested: You have restored from it at least once and know how long it takes.
The well-known rule: three copies of your data, on two different types of storage, with one off-site. Read why backups matter.
Steps that lower the risk #
- Keep the operating system, control panels and applications updated.
- Use SSH keys and disable password login on servers. Read VPS server security.
- Enable two-factor authentication on every control panel.
- Do not open admin ports to the whole world if you can restrict them to your address.
- Scan sites regularly for malicious files.
If you are hit #
- Isolate it: Stop the affected services or isolate the server, so the infection does not reach other copies or servers.
- Do not pay: Paying does not guarantee you get the key, and it invites more attacks.
- Find the way in: Before restoring, or the attacker will come back the same way.
- Restore from a clean backup: Onto a clean server or after reinstalling the system, then change every password.
How Hyyat Host protects your data #
- On shared hosting, CloudLinux isolates every account, so someone who hacks another site cannot reach your files.
- Imunify360 and ImunifyAV detect the malicious files and backdoors that come before these attacks.
- Each plan’s page lists its backup details, and you can always download a full backup from cPanel to your computer.
For private servers we handle protection and backups with our server management service.
Frequently asked questions #
Does ransomware hit WordPress sites?
Rarely as classic ransomware, but an attacker may encrypt site files after a hack. The protection is the same: updates, strong passwords and off-server backups.
Is a backup on the same server enough?
No. Whoever controls the server can usually encrypt or delete it. Keep a copy off the server.
Can I decrypt without paying?
Tools exist for some older strains, but you cannot rely on that. A backup is the guaranteed answer.
