My 19 WP websites were hacked at Just Host...

Always good to back up your sites... But seriously, people hacking other peoples websites and for what???

Hackers need to GET A LIFE!!

People spend countless hours on making their websites then some loser probably with no life, 30 years old, no gf, no friends, still lives at home in his parents basement hacks the site and ruins everything.

Is that supposed to make themselves fell good? (Ya look at me!! I can sit in front of my computer all day and hack peoples sites, instead of going out and socializing with human beings.

This world is filled with idiots who do stupid actions and don't care what the results do to other people.

Just to clarify a little something here.

If hacked servers at Just Host (or any specific host) are really this common an occurence, then it could be due to extreme negligence on their part as far as their security auditing, monitoring and hardening are concerned.

But it could be that they're doing everything "right" (as well as it's possible to), and yet just have just chosen a pretty crappy architecture (their choice of software, and what not); one which is more prone to being hackable, no matter the lengths one goes to to attempt to avoid such catastrophies. Even so, that's part of their decision, if they decide to stick with it - and therefore still a reflection of their own negligence. Albeit something a little further removed.

If that is the case, they should be seriously thinking about overhauling their whole setup.

But, even so, shared hosting is more prone to this type of thing, for obvious reasons.

When you become a customer of a shared host, and have an account on their servers, it's a bit like giving all bank branch employees a key to the vault. It's unlikely any of the staff themselves are going to pull a fast one, but that isn't to say that those who are particularly gullible, easily manipulated or lackluster in their concern for the bank's security cannot inadvertently act as a medium through which some smart robber could gain entry to the vault.

And this is the biggest problem for shared web hosts. Customers who run insecure PHP/CGI/Perl/whatever scripts without caution or a care in the world can be increasing the vulnerability of not only their own accounts and data, but that of other customers' too.

There is very little web hosts can do about this except educate their customers about the importance of keeping things up-to-date, and of being aware. But most web hosts don't like to burden their customers on an ongoing basis with such concerns - instead opting to oversee things as best as they can, and address such blatant issues on a case-by-case basis. And I imagine that most customers prefer the idea of releasing themselves of such obligations - after all, they're paying for a web hosting service, not to do the work of web hosts. (Except that it isn't, or shouldn't just be, the work of web hosts).

If you buy a car, you're expected to be able to drive it properly and safely, not only for your own safety, but also for that of other road users. And if you crash and potentially hurt or kill someone due to poor driving skills or negligence, you can't just release yourself of any and all responsibility for that. Measures (such as the requirement of a drivers licence, and "highway codes") enforced by authorities can only go so far as to protect people and maintain order, for as long and as effectively as the road user himself abides by them.

Unfortunately, many of the "ultra-secure" hosting architectures aren't those released and distributed under the GNU licence, or by the open-source community. They're privately and commercially "formulated", and any hosts using them will reflect that in their prices. They will not be anything close to approaching cheap or budget, and they probably won't be making claims of "unlimited / unmetered / unrestricted" anything.

So if you chose a cheap host, and you're extremely negligent - and are expecting other customers to be so - you're probably going to have to expect or at least accept that hacking occurs from time-to-time.

And just as it may not be your fault when probems like this occur, and you're not responsible for the shortcomings of that host's other customers, you do have control over the type of hosting you choose, and the amount you're prepared to pay for a service.

There is some (well - a large) degree of truth in the saying "you get what you pay for".

You should always keep backups of your data/sites anyway, but it's even more important when you're effectively operating in a shared environment, where shared responsibility and accountability, shared trust and - more importantly - shared consequences are an intrinsic feature or requirement of that platform.

Funny seeing this now. Last month I had one site of mine on my Justhost reseller account get hacked. Then later that week had another.

It was maddening trying to talk to their support to get it fixed. Their backup was like 3-4 days old.

Oh well. Looks like time to find something different.

Is that tutorial still relevant now? I see it's from 2007.