--- title: "Ransomware: How to Protect Your Website and Server From It" description: "**In short**Ransomware encrypts your files and databases, then demands money for the decryption key. On websites and servers it usually arrives through a stolen password or a flaw in outdated software. The most important protection is not only stopping the…" url: "https://www.hyyat.com/en/knowledgebase/ransomware-protect-website-server/" updated: "2026-10-22" category: Website Security --- # Ransomware: How to Protect Your Website and Server From It **In short**Ransomware encrypts your files and databases, then demands money for the decryption key. On websites and servers it usually arrives through a stolen password or a flaw in outdated software. The most important protection is not only stopping the attack, but having a recent backup outside the server that the attacker cannot reach. With it, you restore your site without paying. ![Ransomware: files locked with a red padlock and a healthy backup kept outside the server](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-ransomware.webp) Ransomware is associated with company computers and hospitals, but it hits servers and websites too. The usual story: an attacker gets into a server with a weak password, encrypts the website files and databases, and leaves a text file demanding payment in cryptocurrency. If the backups sit on the same server, they are usually encrypted or deleted as well. ## How does it reach a server or website? *1***A weak password**SSH, control panel or remote desktop access with a guessable password. Read [strong passwords](https://www.hyyat.com/en/knowledgebase/strong-password-password-manager/). *2***Outdated software**A known flaw in the operating system, control panel or an application not updated. *3***A backdoor in a site**A malicious file in a hacked site used to run commands on the server. Read [C99 shell](https://www.hyyat.com/en/knowledgebase/hacking-tools-c99-shell/). *4***An infected computer**The administrator’s computer is infected, so saved passwords are stolen. ## The most important defence: the right backups A backup that helps against ransomware has three qualities: 1. **Off the server:** Somewhere that whoever controls the server cannot reach. 2. **Several dates:** Copies from several days, because you may not notice the infection the same day. 3. **Tested:** You have restored from it at least once and know how long it takes. The well-known rule: three copies of your data, on two different types of storage, with one off-site. Read [why backups matter](https://www.hyyat.com/en/knowledgebase/the-importance-of-backing-up-your-hosting-sites/). ## Steps that lower the risk - Keep the operating system, control panels and applications updated. - Use SSH keys and disable password login on servers. Read [VPS server security](https://www.hyyat.com/en/knowledgebase/vps-server-security/). - Enable two-factor authentication on every control panel. - Do not open admin ports to the whole world if you can restrict them to your address. - Scan sites regularly for malicious files. ## If you are hit 1. **Isolate it:** Stop the affected services or isolate the server, so the infection does not reach other copies or servers. 2. **Do not pay:** Paying does not guarantee you get the key, and it invites more attacks. 3. **Find the way in:** Before restoring, or the attacker will come back the same way. 4. **Restore from a clean backup:** Onto a clean server or after reinstalling the system, then change every password. **Do not believe every message:** some scammers send emails claiming they encrypted your site or stole its data when nothing happened. Check your site before replying. Read [the signs your website is hacked](https://www.hyyat.com/en/knowledgebase/signs-your-website-is-hacked/). ## How Hyyat Host protects your data - On shared hosting, **CloudLinux** isolates every account, so someone who hacks another site cannot reach your files. - **Imunify360** and **ImunifyAV** detect the malicious files and backdoors that come before these attacks. - Each plan’s page lists its backup details, and you can always download a full backup from cPanel to your computer. For private servers we handle protection and backups with our [server management service](https://www.hyyat.com/en/server-management/). ## Frequently asked questions Does ransomware hit WordPress sites? Rarely as classic ransomware, but an attacker may encrypt site files after a hack. The protection is the same: updates, strong passwords and off-server backups. Is a backup on the same server enough? No. Whoever controls the server can usually encrypt or delete it. Keep a copy off the server. Can I decrypt without paying? Tools exist for some older strains, but you cannot rely on that. A backup is the guaranteed answer. **Related guides** - [The importance of backing up your hosting sites](https://www.hyyat.com/en/knowledgebase/the-importance-of-backing-up-your-hosting-sites/) - [VPS Server Security: The Essential Steps After You Get Your Server](https://www.hyyat.com/en/knowledgebase/vps-server-security/) - [How to Tell if Your Website Is Hacked: 10 Signs and Quick Checks](https://www.hyyat.com/en/knowledgebase/signs-your-website-is-hacked/) - [Exposed Sensitive Files on Your Site: .env, .git and Backups, and How to Hide Them](https://www.hyyat.com/en/knowledgebase/exposed-sensitive-files-env-git-backups/) [All website security guides →](https://www.hyyat.com/en/kb/website-protection/) **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)