How We Keep the Websites We Host Secure

When we host your website, we are looking after something that your business depends on. It is how customers find you, how enquiries reach you and, for many businesses, how the money comes in. So we take its security seriously, and we have deliberately built our hosting around a simple idea: fewer doors, better locks, and people who know what they are looking after.

Here is how we approach security for the websites we host, in plain English.

A managed service, not a self-service platform

Many hosting companies are built for scale. Anyone can sign up, upload files and start using server resources, and the platform relies on customers looking after themselves. That works for some people, but it also means a lot of strangers share the same environment.

Ours is different. We only allow access to our hosting servers for customers we know, either because we have carried out work for them or because we provide ongoing support. We are not running a wide-open, anonymous hosting platform. That keeps things tighter, more controlled and more personal, and it means we know whose website is whose.

Fewer buttons, less to go wrong

Security is not only about software. It is also about reducing unnecessary access. The more tools, panels and permissions you hand out, the more there is to secure, and the more that can be changed by mistake.

Most business owners do not need to edit DNS zones, browse raw server files, change server settings or alter databases. They need their website to work, load quickly, stay secure and be backed up, with someone reliable to call when they need help. So we handle the everyday hosting tasks ourselves, using our own internal tools, rather than giving every customer a large, general-purpose dashboard with far more features than they will ever use.

That does not mean you lose control. It means you gain a more guided service. If you need help with hosting, DNS or email, SSL certificates, backups or changes to your website, you speak to us. We know you, we know your website and we know the hosting environment.

Layers of protection around the server

We do not rely on any single safeguard. Instead, we add several layers around the hosting itself:

• Active security monitoring. We use Monarx security software to help detect and prevent attempted hacks, malware and malicious activity on our servers.
• Cloudflare for DNS. We use Cloudflare DNS, which adds resilience and another layer of protection around your domain name. Where we manage your domain name, your website also benefits from Cloudflare’s firewall protection.
• Prompt updates. We keep server software up to date. When a serious issue affects something as fundamental as PHP, for example, we update our servers to the fixed releases and watch for further updates. You can read how we handled one recent case in our post on the PHP security update.
• Careful WordPress updates. With a support agreement, we assess major WordPress updates, test them for compatibility and apply them when they are appropriate for your site, rather than rushing every new version onto every website. This is part of our WordPress support and maintenance.

Backups that are not on the same server

A backup that sits on the same server as your website is not much help if something serious happens to that server. We take two sets of off-server, off-site backups for disaster recovery, so there is always a route back if the worst happens.

Visibility for you, through Client Connect

You should not have to take our word for it, so Client Connect, our customer portal, gives you a view of how your website is doing. Its Website Security area brings together settings that protect your site, such as forcing visitors onto a secure connection, hiding email addresses from scrapers and stopping other websites embedding your images, and a Review my security button explains your configuration in plain English. Site Health keeps an eye on uptime, SSL and domain expiry, so you can see at a glance whether anything needs attention.

No hosting is completely risk-free

No hosting provider can honestly promise that nothing will ever go wrong, and anyone who says otherwise is overselling. Websites, servers, plugins, themes, DNS and email all need ongoing care. Security is not a one-off job. It is a process of maintenance, monitoring, sensible access control and quick action when something needs attention.

If you ever suspect a problem with your website, our website security and hacked-site repair service can help, and our free WordPress version checker is a quick way to see whether your site is running an out-of-date version.

Questions to ask any hosting provider

Whoever hosts your website, these questions are worth asking:

• Who has access to the server my website sits on?
• Who applies security updates, and how quickly?
• Where are my backups kept, and are they stored somewhere other than the same server?
• What is in place to detect malware or attempted attacks?
• If something goes wrong, who do I call, and will they know my website?

We are happy to answer every one of them. If you would like to talk about your hosting, or move your website to a team that looks after it properly, get in touch and we will talk it through in plain English.