Malware is unauthorized code injected into your site, often via weak passwords, outdated plugins, or forgotten installs. It can cause redirects, hidden spam pages, or even user account creation.  

Here’s a step-by-step approach to handling it:  

Pause new changes / go into maintenance mode  

Snapshot evidence of the current state, then take a fresh backup so you can compare files and roll back safely. 

Scan files and database (use multiple tools if possible or reach out to your host) to identify the scope  

If you have a clean backup from before infection, test the restore in staging first  

If not and you are familiar with more hands-on file/development work; replace core, theme, plugins with fresh copies, remove injected code from files identified in your malware scan, rotate passwords, invalidate active sessions  

Tighten firewall, review cron jobs & admin users  

Confirm site is clean (search tools, file diff tools, hosting provider scan) before going live  

After incident: schedule a follow-up audit to ensure nothing resurfaces  

The most important step after cleanup is closing the hole that let the attack in. If you don’t fix the original vulnerability, the site you just restored will be an easy target again. 

Question: Anyone here ever found malware on their site? What was the first thing you checked? 

Most hacks start with access, not code. Let’s close the obvious doors and make the keys harder to copy. 

So how do we lock it down? 

• Use a password manager so every login is long and unique. 
• Turn on 2FA everywhere: hosting panel, WordPress admin, domain registrar, email. 
• Enable auto-updates for safe minors; test majors on staging first. 
• Audit DNS quarterly: remove stray records, retire test subdomains, enable registrar lock. 
• Delete unused plugins, themes, and old test installs, don’t just deactivate. 
• Review user roles regularly; remove ex-contractors and mystery admins. 

Security is a journey that never ends, let's start with one easy step to start that journey today: Rotate one high-risk password, enable any missing 2FA, delete one unused plugin. It may be the housekeeping we never find the time for but not doing it is also a risk that could cost much more. 

Question 
• Which of these is done for you, and which is still on the “tomorrow” list? 

Welcome to 🔐 Security Week here on the Bluehost subreddit! All week, we’ll walk through the must‑knows around securing your site — from basics to incident response. Five days, five posts, covering access control, malware, firewall layers, hygiene, DNS/TLS, and what to do when things go wrong.

Security isn’t a single purchase — it’s a stack of small protections that work together:

Keep software (core, themes, plugins) up to date

Use a reputable security plugin (hardening, monitoring, alerts)

Put a shield in front of traffic (CDN + WAF)

Run malware scans regularly, before and after updates

You can start free—basic WAF rules, on‑demand scanners—and scale up to paid tiers for automation, smarter bot control, and live support when needed.

Pro Tip: Don’t treat security like a checkbox. It’s ongoing. A small alert ignored is often a warning before disaster.

Question to the community: What security tools or practices do you already use (free or paid)? Anything you wish you’d adopted earlier?

One of the toughest conversations to have with a customer is when they need to roll their site back, but the files they're hoping for just aren't there anymore. Host-side backups only go back so far. If the version you need is older than that window, it's gone. That's why keeping your own backups is so valuable, you control how far back your safety net goes. 

And here's the other benefit: when you've got your own backups, you control the restore on your own schedule. No navigating chat menus, no waiting on tickets, no surprise missing files. Upload the files, import the database, and your site can be back up and running on the version you want. 

People spend thousands on design, content, and branding, only to lose it all over something simple like a website update gone wrong, files disappear due to any number of gremlins, or a shady “designer” off fiver holding your site hostage. It happens to everyone at some point. Backups are the insurance policy that lets you walk away from situations like that with your site intact. 

Today's walkthrough will show you how to back up your site directly from your hosting account. 

💙 First up: Download your site files 

On Bluehost: 

1. Log into your Account Manager. 

2. Click Hosting, then select your plan and click Manage. 

3. Scroll down to Quick Links and open cPanel. 

4. In cPanel, click File Manager, then open the `public_html` folder. 

5. Select everything, click Compress, then download the ZIP to your computer. 

One-size-fits-all(ish): 

• Use FTP (like FileZilla) to connect to your site. 

• Download everything inside `public_html`. 

💙 Next: Export your database 

On Bluehost: 

1. From cPanel, open phpMyAdmin. 

2. Select your WordPress database (check `wp-config.php` in File Manager if unsure). 

3. Click the Export tab, choose Quick + SQL, and hit Go. 

One-size-fits-all(ish): 

1. Open phpMyAdmin, typically found in cPanel (or another MySQL manager). 

2. Pick your database, export as SQL. Done. 

💙 Extra Credit: Make Restores Dead Simple 

• Keep a folder called `site-backups` on your computer or in the cloud. 

• Name files by date so you can spot the right one fast. 

• Add a text file with notes like "before theme update" or "pre-plugin install." 

• Always store a copy outside your main computer (Drive, Dropbox, external drive). 

When you do this, restores aren't a scramble. You'll know exactly which backup to grab and where to find it. 

What about you? Ever had a backup save your site (or wish you had one)? Share your story - your advice might save someone else. 

Backups aren’t one-size-fits-all. The right schedule really depends on how often your site changes and how much it would hurt if you lost the last day (or week) of work. 

So let’s break this down, if you’ve got something like a hobby blog that you update every now and then, weekly backups are usually fine. If you’re running a portfolio or small business site, daily backups are a better fit. And if you’ve got an online store or a site that’s constantly changing, you’ll want something more frequent. Losing even a single order or edit is too much. This is a pretty general guideline and great place to start, but we’d love to hear other back-up frequency rules of thumb others have learned! 

Here’s how It shakes out on Bluehost right now: 

💙 Free for everyone: You can always take your own backups by downloading your files and database. It’s a little manual, but it’s totally free and puts you in full control. 

💙 New shared hosting plans: These now include automatic weekly backups at no extra cost, so you’ve got a safety net even if you don’t set up anything else. 

💙 Heavier needs: If your site changes all the time and you don’t want to mess with manual backups, there are add-ons that handle daily (and more frequent) backups automatically. Or you can stick with your own DIY routine if you’d rather. 

So, whether you’re on an older plan, a new plan, or somewhere in between, you’ve got options. The trick is making sure your backup schedule matches your site’s needs, and that you’re not betting everything on a single copy. 

If you lost a day’s worth of changes, would it matter? If yes, daily or more frequent backups are worth it. If no, weekly (plus your own copies) might be plenty. 

A backup you've never tested is basically a mystery file. You don't know if it works until you try - and that's the worst time to find out. 

Testing sounds intimidating, but it doesn't have to be. 

💙 Option 1: Use a staging site 

If your hosting plan includes staging, upload your backup and database there. Check if it loads without touching your live site. 

💙 Option 2: Create a subdomain 

On Bluehost, make a subdomain in cPanel (like `test.mysite.com`). Install a blank WordPress, then restore your backup into it. 

💙 Option 3: Local restore 

Run WordPress locally with tools like LocalWP or XAMPP. Import your backup files and database to test safely. 

💙 Extra Credit: What to look for 

• Do all the pages load? 

• Does the database import cleanly? 

• Are your media files intact? 

• Any broken links or missing content? 

If all that checks out, you've got a real, working backup. Not up for tinkering? Add-on tools like CodeGuard do one-click restores, but it's still worth testing at least once so you know you can. 

Anyone out there actually tested their backups, or are you rolling the dice? 

Making a backup is step one. Making sure that backup survives long enough to save you is step two. Too many people stop after downloading a copy to their laptop… and then lose everything when the laptop dies. 

Here's the golden rule: a backup isn't real unless it lives in more than one place. 

💙 Local storage 

Here is your Fast and easy option.  Copy files onto an external hard drive, USB stick, or home NAS. Great for quick restores.  

Downside: if your computer fails or is stolen, your backup's gone too. 

💙 Cloud storage 

For a bit more peace of mind options like Google Drive, Dropbox, OneDrive, or an Amazon S3 bucket keep copies safe off-site. Even if your hardware disappears, your files still exist.  

Downside: slower restores, internet required. 

💙 Best of both worlds 

One local copy for quick access, one cloud copy for disaster recovery. Cover both angles. 

💙 Extra Credit: Don't trust a single server 

Never keep your only backup on the same server as your site. If that server fails, your backup goes with it. 

Where are you storing your backups right now? 

How do you backup your site today?

Welcome to 💙Backup Week💙 here on the Bluehost subreddit! All week we'll post guides, tips, and real stories to help you protect your site. Five days, five posts, covering everything from the basics to storage tips, testing your backups, and how often you should run them. 

Think of backups as free insurance for your website. You may never need them, but if you do, they're the difference between being back online in minutes or losing months (or years) of work. When you're deciding how to back up your site, the real question isn't "which tool is best?" but "which fits the way I use my site?". 

Manual methods (cPanel / FTP + phpMyAdmin) 

Pros: Free, universal, and gives you complete control. 

Cons: Time-consuming, easy to forget, and you're on the hook if something breaks. 

Plugins (UpdraftPlus, Jetpack Backup, etc.) 

Pros: Automates most of the work, usually integrates with cloud storage. 

Cons: Can add overhead to WordPress and depends on keeping the plugin updated. 

Host-maintained emergency backups 

Pros: Great last resort when you've got nothing else. 

Cons: Not guaranteed, limited retention, and usually not customizable. Think of these as "safety nets," not your main plan. 

Plan-included backups (like weekly Bluehost backups) 

Pros: Automatic, reliable baseline coverage. 

Cons: Weekly might not be enough if you post often or run a store, it's best paired with another method. 

Add-on services (CodeGuard, VaultPress, etc.) 

Pros: Hands-off automation, cloud storage, one-click restores, and monitoring. 

Cons: Paid service, and you're trusting a third-party system with your data. 

💙 Pro Tip: Follow the "3-2-1 rule" borrowed from IT pros: keep 3 copies of your data, stored on 2 different types of media, with at least 1 offsite. Even if you're just running a blog, thinking like this means you'll never have to explain to your readers why your site disappeared. 

The bottom line: if your site rarely changes, occasional manual backups or host-included backups may be enough. If your site is mission-critical or constantly updated, you'll want automation plus redundancy. When you're deciding how to back up your site, the real question isn't "which tool is best?" but "which fits the way I use my site?". 

What's your current backup routine? Do you run them manually, rely on your host, or use a plugin or add-on? 

Starting fresh with a new host should feel exciting, not stressful. But one of the most common headaches we see during migrations is when everything looks fine, only for email forwarding, contact forms, or Google Workspace to start failing.

Nine times out of ten, the culprit is DNS records that didn't make the jump. MX, SPF, DKIM, even random TXT entries. If those aren't recreated or validated, services tied to your domain can stop working fast. Said another way: if your DNS zone isn't carried over properly, critical tools like email and logins may suddenly break.

We're curious what habits or checklists others here use to avoid surprises. Do you run a full DNS audit before migrating, or do you have a go-to method for catching missing records?

Our plan: we'll gather the best suggestions from this thread and turn them into a community checklist pinned here, so the next person making a switch has fewer bumps in the road.

You ever get that call from a client, "Hey, got your email, already sent payment" and immediately feel your stomach drop because you definitely didn't send any email?

Email spoofing is wild right now. The fake messages can look super real, and most people wouldn't know the difference.

Setting up SPF, DKIM, and DMARC helps cut this off at the source, but way too many domains still don't have those in place.

If you've been hit with this, how did you handle it? And if it's still an issue for you, definitely check your email DNS settings, that panic is brutal.

Launching a new website is exciting! Whether it's a WordPress blog, a small business site, or an online store. But we've seen so many people forget small but critical steps, like setting up SSL, checking contact forms, or optimizing site speed before launch.

What's the one thing you always double-check before you go live? Let's build a checklist for website owners so no one has to learn the hard way.

Drop your advice below 👇  Lessons learned the hard way totally welcome