Most sites get compromised through something the owner was supposed to be watching. We would rather that job sat with us, so everything below is switched on for every account from the moment it is created, with nothing for you to configure, renew or remember.
Every site on the platform is scanned every day using a combination of commercial engines and our own tooling, and you can run a scan on demand rather than waiting for the next one.
WordPress sites get an extra check: core files are compared against the official release to catch anything that has been quietly modified. If malware is found, outgoing PHP mail is disabled automatically so your site cannot be used to infect anyone else while you clean up.
Multi-factor authentication is supported on our control panel and on shell access, using time-based one-time codes from any standard authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden or whatever you already use.
A password on its own is one stolen laptop away from being someone else's password. Turning this on is the single most effective thing you can do for your account, and it takes about a minute.
Requests are inspected at the edge of the network, in well under a millisecond, for SQL injection, cross-site scripting, path traversal, trojans and a long list of other attacks.
Rules come from commercial threat feeds and from custom rules written for the platform, so it keeps up without you patching anything.
Over 1 Tbps of anti-DDoS capacity sits in front of the platform, filtering malicious traffic while legitimate visitors carry on unaffected.
Combined with Rack1 Burst adding compute as demand climbs, an attack is far more likely to be something we tell you about afterwards than something you notice.
Login attempts are monitored across WordPress and other common application logins, and automated attempts are challenged before they ever reach your site.
Suspicious addresses and networks are reputation-scored at the network edge, and bad ranges are blocked outright rather than politely rate-limited.
Every service that asks for a password speaks its encrypted variant. Mail runs over IMAP, POP3 and SMTP with TLS; file transfer is SFTP or FTPS; shell access is SSH; and the control panel and webmail are HTTPS only.
We use the secure versions of these protocols rather than offering the plaintext ones alongside them, so your password is never sent across the network in the clear for someone on the same coffee shop network to read.
Operating systems, web servers, PHP releases and database servers are patched on the platform as security fixes land. There is no maintenance window you have to remember and no version you are quietly left behind on.
The one part that stays yours is your own application and its plugins, which is the gap worth watching.
Web servers serve websites, database servers run databases and mail servers handle mail. They are separate stacks, not one machine doing everything.
Logging is centralised away from those servers, so an intruder on one cannot cover their tracks or read your mail from it.
There is no security plugin to install, no agent to run, no add-on to buy and no dashboard to learn. Everything on this page is part of the platform itself, active from the moment your account is created, on every plan we sell.
Everything above runs whether you think about it or not. These are the ones you can reach for when you need them, all from our control panel.
Email is how most trouble arrives, and how a compromised site does most of its damage.
Backups follow the 3-2-1 principle: each server stack keeps its own redundant local copies, and a full set is written to a separate data centre so a disaster in one place does not take your recovery option with it.
We partner with reputable, well-established data centre and network providers, and we only use facilities that meet a serious physical security standard:
The platform and facilities behind your site are audited by third parties rather than self-certified. Staff access follows least-privilege and need-to-know policies, centrally managed.
These accreditations are held by the infrastructure and platform partners we build on. We are naming what is behind your site rather than claiming a certificate of our own.
A security page that only lists wins is a sales page. These are the gaps that stay yours no matter how good the platform is, and knowing about them is most of the battle.
Every protection on this page is included on every plan, from the $2.99 one upwards. Nothing here is an add-on.