The short answer
On shared hosting the host looks after the server; you look after your website. The jobs that stay with you are updates, strong unique passwords, your own backups, removing what you do not use, and watching for signs of trouble. Goji does not take backups of your site for you, so a backup routine is your first task.
What is the host’s job, and what is yours?
On shared hosting the provider runs the server, its operating system and the control-panel software. You are responsible for everything inside your account: your CMS, themes, plugins, scripts, passwords and data. Most hacked small websites are compromised through an outdated plugin or a reused password, not through the server.
1. Take backups, and keep them somewhere else
Goji does not take backups of your website for you. The control panel gives you the tools to download your own.
A usable backup has three properties: it is recent, it contains both files and database, and it is stored away from the hosting account (your computer, or a separate cloud drive). Test a restore once, because an untested backup is a hope, not a backup.
2. Keep software updated
- Update WordPress (or your CMS), themes and plugins promptly; most attacks use flaws that already have a fix.
- Run a supported PHP version; see choosing a PHP version.
- Delete plugins and themes you do not use. Deactivated is not the same as removed.
- Avoid “nulled” (pirated) plugins and themes: they are a common way malware is delivered.
3. Guard the logins
- Use a long, unique password for the hosting account, each mailbox, the database and the CMS admin. A password manager makes this practical.
- Do not use “admin” as the CMS username, and enable two-factor sign-in wherever it is offered.
- The hosting account is created automatically when payment clears, usually within a few minutes. The control-panel password is shown once through a link valid for 72 hours. Store it in your password manager straight away.
- Limit who has access, and remove people who no longer need it.
4. Use https everywhere
A free Let's Encrypt SSL certificate is issued and renewed automatically for each domain on the account. Then make the site use it.
5. Reduce what an attacker can reach
- Remove old test sites, unused subdomains and abandoned scripts; forgotten code is a favourite way in.
- Do not leave backup archives or database dumps inside the web folder, where anyone can download them.
- Keep file permissions at the host’s defaults unless a plugin documents a reason to change them.
6. Notice trouble early
Watch for unexpected admin users, pages you did not write, a sudden traffic or email-sending spike, or a browser warning on your own site. If you suspect a compromise, change every password, restore from a clean backup and update everything before bringing the site back.
What this guide does not promise
No hosting is immune. No uptime guarantee is published. Good habits reduce risk; they do not remove it.
Common questions
How often should I back up my website?
As often as you can afford to lose work. A blog that posts weekly might back up weekly; a shop taking orders daily needs a daily database backup.
Is a security plugin enough?
It helps, but it does not replace updates, good passwords and backups. Treat it as one layer.