Security
Secure web hosting, with layers that run for you
Every plan includes Imunify360 malware protection, a ModSecurity web application firewall, DDoS protection, CloudLinux account isolation and free SSL, with weekly remote backups behind them. These layers work without you configuring anything, so a small business gets protection that is usually reserved for larger firms. Your own habits still matter, and this page shows what to do on your side.
The layers
What stands between an attacker and your site
- DDoS protectionAbsorbs floods of junk traffic
- FirewallModSecurity blocks known attack patterns
- Account isolationCloudLinux keeps neighbours apart
- Malware scanningImunify360 finds and cleans threats
- BackupsWeekly remote copies to restore from
No security is absolute. These layers reduce risk a great deal, and they work best with the habits further down this page.
In detail
What each protection does
Imunify360
A security suite that scans uploaded files for malware, watches for suspicious behaviour and helps block attacks on your account.
ModSecurity firewall
Checks requests to your site and blocks those that match known attack patterns, such as injection attempts.
CloudLinux isolation
Gives each account its own limits and walls, so a busy or compromised neighbour cannot take your site down.
DDoS protection
Helps keep your site reachable when someone floods it with traffic.
Free SSL
Encrypts traffic between visitors and your site, and gives the padlock customers look for.
Email spam protection
Filters junk and unsafe messages before they reach your inbox.
The numbers
Security and uptime at a glance
Your part
Habits that keep a website safe
- Update WordPress, themes and plugins as soon as updates arrive
- Delete plugins and themes you do not use, because old code is a common way in
- Use long, unique passwords and a password manager
- Turn on two-factor login for WordPress and your client area
- Limit who has admin access and remove people who leave
- Only install plugins from trusted sources, never nulled copies
- Keep your own backup as well as the remote copies
- Watch for odd behaviour such as unexpected admin users or pop-ups
If something goes wrong
What to do if your site is hacked
Stay calm and act in order. First, change the passwords for your hosting, your admin area, your database and your email. Then contact our live chat, who can help check the account and point you to the right backup.
Restore a clean backup from before the problem, update everything, and look at how the attacker got in, so the same hole is not left open. Tell customers if their data may have been affected, as UK data protection rules can require it.
Weekly remote backups are kept for about a month, which gives you several clean copies to choose from.
The reality
Why small sites get attacked
Attackers rarely pick a target by name. Most attacks are automated scans that test thousands of sites for known weaknesses, such as outdated plugins or weak passwords. A small business site is as likely to be probed as a large one.
The usual aims are to host spam or phishing pages, to send junk email from your domain, or to redirect your visitors elsewhere. None of these require anyone to care about your business, which is why prevention matters more than being unknown.
The good news is that most compromises exploit known problems, so the basics catch most of them: updates, strong passwords, trusted plugins and a security layer on the server.
Warning signs
Signs your site may be compromised
Early detection limits the damage. If you notice any of these, act quickly and contact our live chat.
- Your site redirects visitors to unfamiliar pages
- Search results show strange text or pages that you did not write
- Admin users appear that you did not create
- Your email is flagged as spam when it was not before
- The site suddenly becomes slow or unavailable
- A browser warns visitors that your site is unsafe
Protected from day one
Imunify360, a firewall and free SSL are on every plan, from 84p a month (£10.03 billed yearly).
FAQ
Common questions
Is security extra?
No. Imunify360, the firewall, DDoS protection, account isolation and free SSL are on every plan.
Does Imunify360 remove malware?
It scans for malware and can quarantine or clean threats it finds. If your site is compromised, restoring a clean backup and updating software is still the safest route.
Does security stop everyone?
No security tool is perfect, so keep software updated, use strong passwords and keep your own backups.
Where is my data stored?
On servers in London, so your website files and mailboxes stay in the UK.
Keep reading
Related pages
Host on a platform that defends your site
Layered protection on every plan, with a 15-day money-back guarantee.