Security on Krystal Shared Hosting
Been hacked? Follow My website has been hacked!. It covers what to do now, what to tell us and how to restore your account.
Security on shared hosting is shared. We secure the server and keep accounts apart. You secure what runs inside your account: your website, its software, and the passwords and tools used to manage it.
Why this matters more now
AI has changed the economics of attacking websites. We're seeing:
- More flaws to use. Vulnerabilities in plugins, themes and web apps are published faster than sites get patched.
- Attacks at scale. One attacker can try a flaw or a stolen password against thousands of sites for almost nothing, so small sites are now worth targeting.
- Minutes, not days. Automated attacks go from one plugin flaw to stolen secrets and backdoors across the whole account within minutes.
Who is responsible for what
We look after the server. You look after everything inside your account.
Area | Krystal | You |
Hardware, network, operating system | Managed | — |
cPanel, web, PHP and mail servers | Managed | Choose a supported PHP version |
Separating accounts (CageFS) | Managed | — |
Malware scanning (Imunify360) | Managed | Act on what it finds |
Backups (JetBackup) | Take backups, store them off-site | Restore with our guide; keep your own copies too |
Website software (WordPress, plugins, themes) | — | Keep it updated; remove what you don't use |
Passwords and 2FA | Provide 2FA | Use strong, unique passwords and turn 2FA on |
Who has access (developers, tools, SSH keys, API tokens) | — | Decide, review and remove |
Finding how an attacker got in | Help, from our logs | Address the cause, if it was due to software in the account or exposed credentials |
Recovering a compromised account | Restore it if you can't or if you need help | Restore, change credentials, update any vulnerable software |
Flaws in server software | Fix and report them | Tell us if you suspect one |
How we protect the server
These stop a problem in one account spreading. They can't secure what runs inside your account.
Protection | What it does | What it can't do |
Account isolation (CageFS) | Hides other customers' files and most system files | Protect anything inside your account |
Resource limits (CloudLinux) | Stops one account slowing down the rest | Stop an attacker, only limit them |
Malware scanning (Imunify360) | Scans changed files and removes known malware (guide) | Catch new or custom backdoors, or undo other changes |
Proactive Defence (Imunify360) | Watches PHP scripts and can stop malicious ones | Stop someone with access to your account adding backdoors, passwords or API keys |
Backups (JetBackup) | 30 days of off-site restore points (details) | Help if you restore to a point after the attack |
Server updates | Keep the operating system, cPanel, web and mail servers and PHP patched | Update your website software |
If someone can log in to your website as an admin, or exploit a vulnerable plugin, they can do anything your account can. No server-level tool reliably stops that.
What we can and can't help with
We can:
- Help find how an attacker got in, so you know what to secure and whether the server was involved
- Restore your account if you can't with our guide
- Confirm whether a login or change was made by our staff
- Tell you what Imunify360 has detected and cleaned
- Investigate anything suggesting the server or another customer's account was affected
We can't:
- Trace everything an attacker did, or analyse every file they left. The cause of the initial compromise is the single most important piece of information in securing your account. Everything else is effectively a result of that and users should assume the attackers could access everything within the account
- Clean an account file by file, or confirm it's clean. The only way to be 100% certain the account is clean is to restore it from a backup.
- Update or repair your website software
- Search other customers' accounts or share server-wide logs
- Monitor your account beyond our normal system and performance monitoring, or run custom searches across your accounts
- Guarantee what an attacker did or didn't do
Logs
Logs you can see
Log | Where | What it shows |
Website access logs | cPanel > Raw Access (kept 90 days) | Every request: IP, time, URL and response |
Website errors | cPanel > Errors, and | PHP and web server errors |
Email delivery | cPanel > Track Delivery (last 10 days) | Mail sent and received, and whether it was delivered |
Malware detections | cPanel > Imunify360 | Files found to be malicious |
Your website's own logs | For example, a WordPress activity plugin | Admin logins and changes: often the best evidence of how a site was hacked |
Logs we check for you
Log | Kept for |
cPanel and webmail logins | As long as your account has been on its current server |
FTP, SSH, mail server and cron | About 4 weeks |
We use these to confirm a compromise and find how the attacker got in, not to search for IP addresses or trace everything an attacker did. Contact us early, and download your access logs before a restore, which replaces them.
Using AI assistants to investigating a compromise if your account
AI assistants are useful for reading logs and code, but can often dig deeper than necessary into fairly simple issues.
- Start with the basics. A compromised account needs restoring and new credentials. The main goal is to get back to a safe known state by restoring, and protect from further issues by rotating credentials and patching your software
- Watch for wrong assumptions. Files an attacker left in your account don't show they got outside it.
- Don't give an AI tool your passwords or SSH access. Copy out the logs it needs instead.
- Write tickets in your own words, and tell us your goal. Tickets drafted by an assistant drift into side questions that don't change the fix (the XY problem).
Reducing your risk
- Keep WordPress, plugins and themes updated. Or any other software that you may run under the account
- Reduce the attack surface by removing anything no longer in use, for example deprecated websites
- Use strong, unique passwords, and turn on 2FA for website admins, cPanel and the Krystal Client Area.
- Give everyone their own login, and remove access when people leave.
- Keep unrelated websites on separate cPanel accounts, for example with a reseller plan or a VPS.
- Protect your site-management tools and developers' devices.
- Avoid saving passwords in your website. Where you must, use keys limited to what it needs.
- Install an activity log plugin, and keep your own off-site backups.
