If your site is a store, or a company site with contact forms and customer accounts, you hold data that belongs to other people. A leak hurts your customers and your reputation. This guide is not about protecting your site from hacking in general; that has its own guide: how to protect your website from hacking. Here we focus on the data itself: what you collect, where you keep it and who can reach it.
What data does your site collect? #
7 rules to protect your customers’ data #
- Collect as little as possible: Every field you do not need is extra data that can leak. Ask yourself: do I really need this?
- Never store card details: Use a trusted payment gateway that takes the card on its own page or encrypted form, so card numbers are never saved on your site.
- Run the whole site on https: Not only the checkout. Any form sent without encryption can be intercepted on the way. Read what an SSL certificate is.
- Never email passwords: WordPress stores user passwords as one-way hashes. Never ask customers for them or send them, and use the password reset link.
- Limit staff access: A support agent does not need administrator rights. Delete the account of anyone who leaves on the same day.
- Protect your backups: A backup contains all your customer data. Keep it somewhere safe, never as a downloadable file inside your site folder.
- Delete what you no longer need: Old form messages, customer accounts inactive for years and export files on your computer.
Where the data lives, and how to protect it #
| Data state | Example | How to protect it |
|---|---|---|
| In transit | A customer submits the order form | An SSL certificate and the whole site on https |
| At rest | The store database and backups | Strong database passwords, backups kept safely, plugins kept updated |
| In use | Staff review orders in the dashboard | Limited roles, two-factor authentication and secured staff devices |
What to do if you suspect a data leak #
- Close the hole first: Update plugins, scan your files with ImunifyAV and follow the malware removal steps.
- Change passwords: Your site dashboard, cPanel, database and email, and force administrators to set new passwords.
- Find out what leaked: Review login logs and change dates; we can help you read the server logs through a ticket.
- Tell your customers clearly: Explain what happened and what they should do, such as changing their password. Transparency keeps trust.
How Hyyat Host protects your site #
- The CSF firewall, Imunify360 and ModSecurity rules stop known attacks at the server level.
- Daily file scans with ImunifyAV, and every account isolated with CloudLinux.
- A free SSL certificate issued automatically on most plans, and each plan’s page lists its backup details.
Frequently asked questions #
Can I store customers’ card numbers on my site?
This is never recommended. Storing card data requires strict security standards. Leave it to the payment gateway, and let your site receive only the result of the payment.
Does an SSL certificate protect stored customer data?
SSL protects data while it travels between the browser and the server. Stored data is protected by strong passwords, updates, limited access and safe backups.
Who is responsible for customer data, me or the hosting company?
You own the data and are responsible for how it is collected and used. We protect the server it is stored on and help you technically when needed.
