Site Hardening · Part 1
Hardening starts above the server
Every hardening checklist starts in the same place: the server. File permissions, plugins, passwords, firewalls.
That order is backwards. Above your server sits a short chain of things that outrank it — the domain name, the account that registered it, the DNS that points it somewhere, and the email address that can reset all of them. Whoever controls that chain can take your site back from you after a perfect cleanup. Nothing on the server can stop them, because none of it lives there.
This series works from the outside in. So it starts with what you own, before anything you install.
The chain of control
Four links, and each one can override everything below it.
The registrar account. Where the domain is registered. Control this and you can move the domain, change its DNS, or let it expire.
DNS. Where the domain points. Control this and you can send your visitors — and your email — anywhere, without touching your server at all.
The recovery email. The address every one of those accounts sends its password resets to. Control this and you control every account that trusts it.
The hosting account. Only then the server — the part every checklist talks about.
Walk the chain from the top. At every link, ask two questions: who can log in here, and where does its password reset go? If you can’t answer both from memory, that is the first finding.
The address you can lose
The weakest link is almost never the registrar. It is the email address underneath it.
Many small-business domains were registered years ago with whatever free address the owner had at the time. That address is still the contact. It still receives the renewal notices, the transfer confirmations and the password resets — and it is held by a provider that owes you nothing.
During the recovery behind these articles, the owner lost access to exactly that kind of address. In the middle of a live compromise, that looked like the next move in the attack. It wasn’t. When he finally got it back, the cause turned out to be an error at the email provider — nothing to do with the intruders.
That is the point. At the time there was no way to tell a provider’s mistake from a takeover, and no one to ask. A free provider has no reason to keep your address alive and no one you can call when it doesn’t. Whether you lose it to an attacker or to a glitch, the accounts that trust it are exposed all the same.
The fix is not complicated. Every domain’s contact and recovery address moved to one address the owner pays for and controls. It took an afternoon. It closes a door no server setting can reach.
Contacts that drifted
When he audited those contacts, one domain turned up something worse than an old address: two addresses, one letter apart. The registrant contact read one spelling; the privacy-forwarding address read another.
That may be a typo from years ago. It may not. Either way it is a live question, because a lookalike address on a registrar record is exactly what a password reset would be sent to — and a one-letter difference is exactly what nobody notices.
So don’t check one domain and assume the rest match. Open every domain’s contact record and read it letter by letter. Registrant, admin, technical, and any privacy or forwarding address. Contacts drift over years of renewals, transfers and account changes, and nobody reviews them until something goes wrong.
Too many domains, too many accounts
Owners who build websites for long enough collect domains. This one held twenty-five, spread across two registrar accounts, plus the logins for DNS, hosting, Search Console and video channels scattered across several email identities — some deliberately, some by inheritance.
Every separate account is a separate door, and a door you’ve forgotten is a door you’re not watching. Before you harden anything, write the inventory down:
- every domain, and which registrar account holds it
- which DNS provider answers for it
- which hosting account serves it, if any
- which email address can reset each of those accounts
- which of those accounts have two-factor turned on — and where the second factor goes
It’s dull work. It’s also the only way to find the domain nobody has logged into for three years, which is the domain an intruder would choose.
Prove ownership in a way a file can’t break
Search Console lets you prove you own a site by uploading a small file to it, or by adding a record to the domain’s DNS. Most people use the file. It’s easier.
It is also the fragile one. In this case, the verification file was lost when the site was rebuilt after the cleanup, and the property quietly went unverified. It had to be put back months later.
There is a security difference too. Anyone who can write files to your server can place a verification file. Only someone who controls your DNS can add a DNS record. The intruders in this case had file access for seventeen months. They never had the registrar or DNS.
So verify every domain with a DNS record, and keep the file as a second method if you like. Google keeps a property verified while any one method holds — so a rebuild that eats the file no longer costs you anything.
Then check who else is on the property. What Search Console knows after a hack covers the account setting that can let an intruder keep reading your data long after the server is clean.
What this costs, and what it buys
None of this needs a developer, a plugin or a server login. It needs an afternoon, a list, and the patience to read contact records letter by letter.
What it buys is the thing a server cleanup can’t: certainty that the site is still yours. Every later article in this series assumes that’s true. This is where you make sure it is.
Ownership problems rarely show up until someone else uses them. A review of who can actually reach your site finds the forgotten account before it becomes the entry point.
Start a Recovery ReviewPaid assessment · scope agreed up front
Back: How to Harden a WordPress Site After a Hack
Next: Who Else Still Has the Keys? Auditing Every Login to Your Website
Hub: Site Hardening Blog Series
ProVAE builds and recovers websites in Douglas, Georgia, serving South Georgia.