DDoS protection
Always-on network filtering absorbs volumetric attacks at the edge before they reach your server.
HOSTING SECURITY
Security built into
every layer
From the network edge to the file system, every account is protected by default, monitored around the clock and backed up every day, so you can focus on your site.
- Always-on DDoS protection and web application firewall
- Daily malware scanning with automatic clean-up
- Automatic daily backups, restorable in one click
- 99.9%Uptime guaranteeBacked by service credits
- 24/7MonitoringEngineers on shift around the clock
- 30 daysBackup retentionRestore any day in the last month
- < 15 minThreat responseFrom alert to an engineer acting
Eight layers between attackers and your site
Each one is included on every plan and switched on from day one.
Web application firewall
Blocks SQL injection, cross-site scripting and known exploit patterns in real time, tuned for WordPress and popular apps.
Malware scanning & removal
Files and databases are scanned every day; infections are quarantined and cleaned automatically.
Account isolation
Every account runs in its own container with CageFS, so a compromised neighbour can never reach your files or processes.
Brute-force protection
Repeated failed logins to cPanel, SSH, FTP and WordPress are throttled and blocked automatically.
Patching & hardening
Operating systems, control panels and PHP are patched within hours of a release, with kernel updates applied live and without reboots.
Daily backups
Automatic backups to separate storage, kept for 30 days, restorable by you in one click.
24/7 monitoring
Every server is watched around the clock by engineers who are alerted, and act, the moment something looks wrong.
Beyond the server
Backups you can actually restore
Every account is backed up automatically every day (hourly on VPS Enterprise) to separate storage in a different rack, kept for 30 days. Restore a single file, a database or the whole site yourself from the control panel in one click, with no ticket and no fee.
Physical security at the data centre
Our servers live in ISO 27001-certified facilities with 24/7 guards, biometric access, CCTV, redundant power and cooling, and fire suppression. Only vetted engineers get near the hardware, and every visit is logged.
Privacy and compliance
Data stays in the region you choose, we comply with the NDPR and GDPR, and we never sell or share your information. Our security statement, acceptable use and privacy policies are published in full so you know exactly how your data is handled.
If something ever goes wrong
No system is perfect, so the plan for a bad day matters as much as the defences.
We spot it
Monitoring and scanning raise an alert within minutes of unusual behaviour, and an engineer is on it, day or night.
We contain and clean
The threat is isolated, malicious files are removed and the hole is closed, and you are kept informed the whole time.
We restore and harden
If anything was damaged we restore from a clean backup, then tighten the setup so the same thing cannot happen twice.
Hosting security FAQ
Everything on this page is included on every hosting plan at no extra cost. SiteLock is an optional extra that adds continuous scanning, a trust seal and a dedicated engineer for sites that need more.
Shared, WordPress and reseller accounts are backed up every day; VPS plans daily or hourly depending on the plan. Backups are kept for 30 days on separate storage. In the control panel, open Backups, pick a date and restore a file, a folder, a database or the whole account. It takes a minute and there is no charge.
Attack traffic is absorbed at the network edge before it reaches your server, so your site keeps serving normal visitors. Very large attacks may be routed through additional scrubbing, which can add a few milliseconds of latency but keeps you online.
We patch the server, PHP and the control panel. On WordPress hosting we also apply core and plugin updates automatically, with a backup taken first. On other plans, updates to your own applications are up to you, though our malware scanner still watches for known vulnerabilities and tells you.
No. Every account runs in its own isolated container with its own file system view, process space and resource limits. A compromised account on the same machine cannot see or touch yours.
In the data centre of the region you choose when you order. It is not moved without your consent, and backups stay in the same region.
Open a ticket or start a chat straight away and tell us what you saw. An engineer will scan the account, clean it and, if needed, restore from a clean backup. If you would like the site checked and cleaned immediately by hand, the SiteLock emergency response service is available.
Yes. A free certificate is installed and renewed automatically on every hosting plan, and paid OV and EV certificates are available if your business needs them.
