Ransomware protection for your website: tips and prevention
Ransomware protection is a topic that is becoming ever more important for website owners. Where ransomware used to target mainly desktop computers and corporate networks, cybercriminals now increasingly aim at websites and web servers. In this extensive guide we discuss everything you need to know about ransomware protection for your website, from preventive measures to recovery strategies after an attack.
What is ransomware and why is ransomware protection needed?
Ransomware is a type of malware that encrypts your files or systems and then demands a ransom in exchange for the decryption key. On websites, ransomware can encrypt your files, make your database inaccessible or block your entire server. Without adequate ransomware protection you can end up in a situation where your website is completely unreachable and you are forced to choose between paying and losing everything.
How does a website get infected with ransomware?
Ransomware can reach your website in several ways. The most common infection methods are:
- Vulnerable plugins or themes - outdated software with known security holes
- Stolen FTP/SSH credentials - through phishing or malware on your own computer
- Brute-force attacks - cracking weak passwords
- Supply chain attacks - infected updates from seemingly trustworthy sources
- Cross-site contamination - infection through other websites on the same server
- Social engineering - deceiving staff with access to the website
Types of ransomware that hit websites
Not all ransomware works the same way. Understanding the different types helps when setting up effective ransomware protection.
| Type | Method | Impact | Recovery possible? |
|---|---|---|---|
| File-encrypting ransomware | Encrypts individual files | Website offline, files unreadable | With a backup: yes |
| Database ransomware | Encrypts or wipes database tables | All dynamic content gone | With a database backup: yes |
| Server-level ransomware | Locks the whole server or VPS | Complete inaccessibility | With a server snapshot: yes |
| Defacement ransomware | Replaces website content with a ransom message | Reputational damage, visitors see the message | With a backup: yes |
| Double extortion | Encrypts AND copies data, threatens publication | Data loss + possible privacy breach | More complex, data already leaked |
Ransomware protection: preventive measures
The best ransomware protection is preventing your website from getting infected in the first place. Here are the most important preventive measures to take:
Keep all software up to date
Most ransomware infections abuse known vulnerabilities in outdated software. Make sure your CMS, all plugins, themes and server software always run the latest version. For WordPress users, our guide on updating WordPress safely is essential.
Implement strong access security
Restrict access to your website and server as much as possible. Use strong, unique passwords, activate two-factor authentication, limit SSH access to specific IP addresses and use SFTP instead of unencrypted FTP. Read more about securing your website for extensive tips.
Install a Web Application Firewall
A WAF filters malicious traffic before it reaches your website. Cloud-based solutions such as Cloudflare offer excellent protection against the most common attack vectors that can facilitate ransomware.
Make regular backups
Backups are your ultimate ransomware protection. If your files get encrypted, a recent backup lets you restore your website without paying a ransom. Crucially, you should store backups off-site, in a location that cannot be reached from your web server. Read our guide on how to back up your website for more information.
The 3-2-1 backup rule
For optimal ransomware protection, follow the 3-2-1 backup rule:
- 3 copies of your data (the original plus two backups)
- 2 different storage media (for example server + cloud)
- 1 copy off-site (a physically separated location)
Ransomware protection at server level
If you use a VPS or dedicated server, there are additional measures you can take at server level for better ransomware protection.
Server hardening
- Disable unused services and ports
- Configure a server firewall (iptables or ufw)
- Restrict root access and use sudo
- Install fail2ban to block brute-force attacks
- Activate SELinux or AppArmor for extra isolation
- Monitor log files for suspicious activity
File system protection
Set the correct file permissions so that web server processes can only write to folders that require it (such as uploads). Use read-only mounts for system files and consider immutable flags for critical configuration files.
Network segmentation
If you host multiple websites on the same server, isolate them from each other. A ransomware infection on one website should not be able to spread to other sites on the same server. Use separate user accounts and restricted file permissions per website.
Ransomware protection specific to WordPress
WordPress is the most attacked CMS and therefore deserves extra attention when it comes to ransomware protection. Here are WordPress-specific measures:
Security plugins
Install a comprehensive security plugin that protects against the attack vectors that facilitate ransomware. Wordfence, Sucuri and iThemes Security are excellent options. Also see our guide on WordPress maintenance for a complete security overview.
Limit file permissions
- Disable the WordPress file editor (DISALLOW_FILE_EDIT)
- Prevent direct PHP execution in the uploads folder
- Protect wp-config.php against unauthorised access
- Block access to wp-includes and other core folders
What to do during a ransomware attack?
Despite all preventive ransomware protection, an attack can still happen. It is crucial to be prepared with a clear action plan.
Step 1: stay calm and document
Do not make hasty decisions. Document what you see: the ransom message, changed files, when you discovered it. This information is valuable for the investigation and any report to the authorities.
Step 2: isolate the system
Disconnect the affected server or website from the network as quickly as possible. This prevents further spread and limits the damage. On shared hosting, contact your hosting provider immediately.
Step 3: do not pay the ransom
Security experts and law enforcement unanimously advise against paying a ransom. There is no guarantee you will get your data back, paying encourages criminals to continue and you can become a target for repeated attacks.
Step 4: identify the ransomware
Try to find out which type of ransomware has hit your system. Tools such as ID Ransomware (id-ransomware.malwarehunterteam.com) can help with identification. For some older ransomware variants, free decryption tools exist.
Step 5: restore from backup
If you have followed the 3-2-1 backup strategy, you can restore your website from a clean backup. Make sure you first patch the vulnerability that caused the infection before you restore the backup, otherwise you risk reinfection.
Step 6: report the incident
Report the ransomware attack to the police and the national cyber security authority. In the case of a data breach involving personal data, you may be required to report it to your data protection authority within 72 hours.
Ransomware protection checklist
Use this checklist to verify that your ransomware protection is in order:
- All software is up to date (CMS, plugins, themes, server)
- Strong unique passwords with two-factor authentication
- Web Application Firewall is active and configured
- Daily automatic backups with off-site storage
- Backup restore has been tested and documented
- File permissions are set correctly
- Unused plugins and themes have been removed
- FTP has been replaced by SFTP or SSH
- Server is hardened (for VPS/dedicated)
- Incident response plan has been drawn up
- Staff are trained to recognise threats
- Regular security scans are carried out
The cost of no ransomware protection
Investing in ransomware protection may seem like an unnecessary expense, but the consequences of an attack are many times more costly. The average cost of a ransomware attack for small and medium businesses lies between 50,000 and 200,000 euros, including downtime, recovery costs, reputational damage and any fines.
Cost analysis: prevention vs. recovery
| Cost item | Prevention (per year) | After an attack (one-off) |
|---|---|---|
| Security software/plugin | €100-300 | N/A |
| Backup solution | €50-200 | €500-5,000 for recovery |
| WAF/Firewall | €100-600 | N/A |
| Downtime (lost revenue) | €0 | €1,000-50,000+ |
| Hiring an expert | €0 | €2,000-10,000 |
| Reputational damage | €0 | Hard to quantify |
| Total | €250-1,100 | €3,500-65,000+ |
The future of ransomware and new threats
Ransomware evolves constantly. Ransomware-as-a-Service (RaaS) makes it ever easier for criminals to carry out attacks, even without technical knowledge. AI-driven ransomware that adapts to security measures is a growing threat. It is therefore essential to continuously evaluate and update your ransomware protection.
Stay informed about the latest developments by following security blogs and consider a professional security audit if your website is business-critical. The investment in good ransomware protection always pays off, because it is not a question of whether you will be attacked, but when. With the right preparation and protection you minimise the impact and can recover quickly.
Frequently asked questions about ransomware protection
Below we answer the most frequently asked questions about ransomware protection for websites.
Can ransomware hit my website if I use shared hosting?
Yes, websites on shared hosting are vulnerable to ransomware. On shared hosting, multiple websites share the same server. If another website on the same server is compromised, the malware can spread through cross-site contamination. Choose a hosting provider that offers good isolation between accounts and consider a VPS for better control over security.
How quickly should I respond to a ransomware attack?
Time is crucial during a ransomware attack. The faster you respond, the more limited the damage. Isolate the affected system immediately and start the incident response plan right away. The first hour after discovery is the most critical. Always keep a prepared action plan ready with the contact details of your hosting provider and any security experts. Regular drills make sure your team can act quickly and effectively.
Ransomware and cloud-based websites
Cloud-based platforms such as WordPress.com and Shopify offer inherently better ransomware protection than self-hosted solutions. The hosting provider manages server security and makes automatic backups. Yet you are not completely immune: if your administrator account is compromised, an attacker can still cause damage. Always use strong passwords and two-factor authentication, regardless of where your website is hosted. For self-hosted websites it is extra important to implement a robust backup strategy, since you are responsible yourself for server security and recovery after an incident.
Ransomware protection: backups as the last line of defence
The most effective ransomware protection is a watertight backup strategy. If all other security measures fail, backups are your last resort to restore data without paying a ransom. But not every backup approach is resistant to ransomware.
The 3-2-1 backup rule
The gold standard for ransomware-resistant backups follows the 3-2-1 rule:
- 3 copies of your data (the original plus two backups)
- 2 different media (for example server and external storage)
- 1 copy off-site (in a physically different location or in the cloud)
Crucially, at least one backup must be unreachable for ransomware. This means: no direct network connection, no mounted drives and no shared credentials. Use immutable storage where backups cannot be deleted or changed for a set period, not even by administrators.
| Backup type | Ransomware-resistant | Recovery time | Cost |
|---|---|---|---|
| Local server backup | No (often encrypted too) | Fast | Low |
| Cloud backup with versioning | Yes (with immutable option) | Average | Average |
| Air-gapped offline backup | Yes | Slow | Average |
| Immutable object storage | Yes | Average | Average to high |
Recognising ransomware: early warning signs
The sooner you detect a ransomware attack, the more limited the damage. Ransomware protection starts with recognising early signs, often days before files are encrypted.
- Unusual network activity: ransomware often first scans the network to map all reachable systems and drives. Use server monitoring tools to detect abnormal traffic.
- Suspicious processes: unknown processes that generate a lot of disk I/O can point to encryption activity.
- Changed file extensions: files that suddenly get an unknown extension (such as .locked or .encrypted) are a clear sign.
- Failed login attempts: an increase in brute-force attacks can be a precursor to a targeted attack.
- Disabled security software: advanced ransomware tries to switch off antivirus and backup services before the encryption begins.
What to do during a ransomware attack on your website
Despite all precautions, a ransomware attack can still happen. A prepared action plan makes the difference between a fast recovery and weeks of downtime. Below you will find the steps to take immediately.
Step 1: isolate immediately. Disconnect the affected server from the network at once. This prevents spread to other systems. On a VPS you can switch off the network interface through the hosting panel.
Step 2: document everything. Take screenshots of the ransom message, note which files are affected and keep all log files. This is essential for any report to the police and for your insurance.
Step 3: do not pay the ransom. Experts and authorities unanimously advise against paying a ransom. There is no guarantee you will get your files back, and payment finances further criminal activity.
Step 4: restore from backup. Use a backup you are certain is not infected. Check the backup date and scan it with an up-to-date virus scanner before you restore.
Step 5: secure and strengthen. Analyse how the ransomware got in and close the security hole. Install a website firewall, switch on two-factor authentication and update all software. Consider switching to a hosting environment with built-in ransomware protection and professional monitoring.
Ransomware protection: staff training and awareness
The human factor is the weakest point in any security chain. More than 90% of all ransomware infections start with a phishing email or social engineering. Effective ransomware protection therefore requires structural training of everyone who has access to your systems, from management to interns.
An effective training programme covers several elements. Regular phishing simulations test whether staff recognise and correctly handle suspicious emails. Short, monthly awareness sessions keep security awareness high without overloading people. Clear reporting procedures make sure suspicious messages are reported quickly to the IT team instead of ignored. Specific training for staff with elevated rights (administrators, finance staff) is essential because these accounts are extra valuable to attackers.
Ransomware protection: network segmentation and Zero Trust
Network segmentation limits the impact of a ransomware attack by splitting your network into isolated zones. If ransomware infects one system, it cannot automatically spread to other segments. This is the difference between losing a single system and losing your entire infrastructure.
The Zero Trust model goes a step further: trust nothing and no one, verify everything. Every access request is checked, regardless of whether it comes from inside or outside the network. This means multi-factor authentication for all access points, microsegmentation of the network where each segment has its own access rules, continuous monitoring of all traffic including internal traffic, and the principle of least privilege where users and systems only get access to what they strictly need. Zero Trust is not a single product but a security philosophy that you implement step by step. Start with the most critical systems and expand gradually. The investment in network segmentation and Zero Trust pays off doubly: less chance of a successful attack and more limited damage if an incident does occur.
Ransomware protection: insurance and legal aspects
Alongside technical measures, it is wise to consider the financial and legal aspects of ransomware protection. Cyber insurance is becoming more popular and covers costs arising from cyberattacks, including ransomware incidents.
Cyber insurance usually covers the costs of forensic investigation to determine the cause and scope of the attack, the loss of income during the downtime of your website or systems, legal costs in the event of a data breach including notification of those affected in line with the GDPR, costs for PR management and reputation recovery after a public incident, and technical recovery costs for cleaning up and restoring affected systems.
Insurance companies are setting ever stricter requirements for the security of businesses before they issue a cyber policy. Basic security measures such as multi-factor authentication, regular backups and up-to-date software are now standard requirements. Businesses that do not have these basics in order get no coverage or pay significantly higher premiums. This is an extra motivation to take your ransomware protection seriously: it lowers not only your risk but also your insurance costs.
Ransomware trends and outlook for website owners
The ransomware landscape changes constantly and ransomware protection must evolve with it. Recent trends show a shift towards double extortion, where attackers not only encrypt data but also threaten to make stolen data public if no payment is made. Ransomware-as-a-Service (RaaS) makes it possible for criminals without technical expertise to carry out attacks with ready-made toolkits. Supply chain attacks target software suppliers to gain access through them to hundreds or thousands of customers at once. For website owners this means you must not only secure your own systems, but also look critically at the security of your hosting provider, plugin developers and other parties in your digital supply chain.
Sources and references
- Cloudflare - Learning Center (cloudflare.com/learning)
- Wordfence - WordPress Security Report (wordfence.com)
- Sucuri - Website Security Research (sucuri.net)
- Dutch Data Protection Authority - GDPR information (autoriteitpersoonsgegevens.nl)
