• Use strong, unique passwords for the client portal, hosting panel, email, FTP, database, and WordPress.
• Do not share administrator accounts between multiple people.
• Remove unused FTP, email, and WordPress users.
• Keep WordPress plugins and themes updated.
• Contact support quickly if you see unknown files, redirects, or users.

Security cleanup is easier when reported early.