DreamHost Breach: 5 Steps Every Website Owner Takes

What Is the Step by Step Plan to Secure My Site This Week?

Work through the steps below in order. A typical small business can finish them in about an hour, and they apply whether or not you use DreamHost.

If you do not know who your FTP users are, that is your first finding. Many websites carry old logins for a former developer, a past agency or a plugin that needed a connection years ago. Each one is a door. Our website maintenance plans include login audits, backups, updates and malware checks so those doors do not pile up.

What Should I Check on My Website Right Now?

Start with change history. In your hosting panel, sort files by last modified date and look for anything changed since August that you or your developer did not touch. Pay special attention to the wp-content/uploads folder, any file with a random looking name, and the index and configuration files in your site root. If you run WordPress, open Users and confirm every administrator is someone you recognize.

Next, test the front of the site the way a customer would. Submit your contact form and confirm the message reaches the right inbox. Load the site on your phone from a mobile data connection and watch for redirects or pop ups. A hacked site often looks normal to the owner and wrong only to visitors from search or ads. A technical SEO review also catches hidden spam pages and injected links that hurt your rankings before you ever see them.

Finally, confirm you have a clean backup stored somewhere other than the same hosting account. If your site is ever compromised, a backup from before August lets you restore fast instead of rebuilding from scratch. Our San Antonio web design team builds every site with off server backups and a short list of named logins for exactly this reason.

What Should I Do About My Business Email?

Treat email as part of the DreamHost breach cleanup. Change the password on every mailbox DreamHost reset, and open each one in webmail. Check Settings for forwarding addresses, auto replies and filters that move mail to a hidden folder, because attackers use quiet rules to watch invoices and password resets. DreamHost lists forwarding rules and filters among the things to check.

Then warn your team and your best customers. If a criminal can read your mailbox, they can copy a real invoice and change the bank details. Tell your staff that payment instructions arrive by phone call confirmation only. DreamHost notes that attackers often follow breaches with scam emails that imitate the company involved, and that it will never email you asking for your password. Treat any message asking you to sign in through a link as suspect, and type the control panel address yourself.

Your landing pages and forms matter too. If your forms send leads to a hosted mailbox, a compromised mailbox means a competitor or scammer could see every new inquiry. Moving lead notifications into a CRM or a form service with its own login gives you a second copy and a record. Our landing page design work builds that safety net into every form. Our recent post on Google’s URL rules is another example of a technical detail that quietly affects a website without the owner ever noticing.

Common Mistakes We See After a Hosting Breach

• Changing only the control panel password. The exposed logins were FTP, SFTP and webmail users, which are separate from the main account login.
• Reusing the old password with one digit changed. DreamHost advises unique passwords for every user, and attackers test small variations first.
• Waiting for an email before acting. The affected group changed as DreamHost reviewed its logs, so a missing notice is not a safety guarantee.
• Forgetting saved passwords in apps. Phones and desktop email programs keep trying old logins and can lock you out or mask a problem.
• Skipping mailbox rules. A forwarding rule keeps working after the password changes unless you delete it.
• Leaving former developers on the account. Every unused FTP user is another login that can be stolen.

Frequently Asked Questions

1. Was my DreamHost website hacked in the breach?
   Not necessarily. In the DreamHost breach, the attacker took logins and may have viewed some mailbox contents, but DreamHost has found no evidence of access to control panel logins or billing details, so your site files are at risk only if an exposed FTP/SFTP login was used against them.

2. Which DreamHost passwords should I change?
   Change every FTP, SFTP and email user password on your account, starting with any user who logged into File Manager since about August 2026. Only the account holder can set the new passwords from inside the DreamHost control panel, and a change can take up to 15 minutes to apply.

3. How do I know if hackers changed my website?
   Check your files for recent modifications you did not make, look for unknown administrator users, and compare the site against a clean backup. A San Antonio SEO company can also check Google Search Console for sudden spam pages or security warnings.

4. Should I move to a different web host after a breach?
   Not automatically. The DreamHost breach is a reason to review how the host responded and how your own accounts are set up, and DreamHost says it took File Manager offline, patched the flaw and rebuilt it with extra monitoring, so weigh that against your own risk tolerance.

5. Does this affect customers of other hosting companies?
   The DreamHost breach involves one provider only, but the lesson applies everywhere. Unique passwords, two step login, a short list of named users and off server backups protect a website no matter which host you use.

A DreamHost breach is a reminder that a website is a set of logins as much as a set of pages. Spend an hour this week on the five steps above, and write down who has access to what. FOG Digital Marketing helps San Antonio businesses audit hosting, email and website access so a headline about someone else’s hosting provider stays someone else’s problem.