Hosting security
Security, in layers.
No single tool keeps a website safe. We stack protections from the network down to the WordPress login, watch them continuously, and keep more than one way back if something goes wrong. Here's what that looks like.
Protection, layer upon layer
The layers
Eight layers between your site and trouble.
From the network edge to your login screen. SSL encryption covers everything in between.
Layer 1
Enterprise infrastructure
A managed WordPress environment on enterprise-grade infrastructure, built for WordPress security, reliability, and performance.
Layer 2
Firewall & DDoS protection
An enterprise web application firewall filters malicious traffic, SQL injection, cross-site scripting, and bad bots before they reach your site, with DDoS protection at the network level.
Layer 3
Malware detection
Ongoing malware scanning and security monitoring to spot and deal with malicious activity.
Layer 4
WordPress hardening
A second firewall and hardening layer inside WordPress, supplementing the protections at the hosting level.
Layer 5
Managed updates
We oversee WordPress, plugin, and theme updates rather than trusting unattended auto-updates, and watch for compatibility problems.
Layer 6
Spam & bot protection
Filters that stop spam, fake registrations, phishing submissions, and other automated abuse of your forms.
Layer 7
Backups & recovery
Daily on-site and off-site backups, plus an additional independent backup and recovery layer.
Layer 8
Monitoring
Uptime and site monitoring, so availability problems are spotted and handled quickly.
Logins & accounts
Locking the front door.
Most attacks go after the login. These protections are part of how we set up and run the sites we look after.
- SSL/HTTPS encryption across the whole site
- Passwords stored with WordPress's one-way hashing, never readable
- Secure sessions and time-limited password-reset links
- Rate limiting on logins and password resets to stop password guessing
- Secure, HttpOnly, SameSite authentication cookies
- Activity logging for important administrative actions
Custom tools
When our tools handle important information.
Portals and systems we build for clients carry their own protections on top of our managed hosting security layers. We consider data privacy, access controls, and responsible information handling from the beginning.
YOUR DATA STAYS YOURS
You retain ownership and control of your information. We're your service provider, not the owner of your data, and use it only to operate and support the services we provide.
ONLY WHAT'S NEEDED
We design our tools to minimize unnecessary data collection. We encourage clients to collect only what their programs need and avoid sensitive personal information wherever possible.
ACCESS BY DESIGN
Users receive access based on their roles and responsibilities. Permissions are enforced within the system, so people can only view or manage the information they're authorized to access.
SEPARATE & SECURE ACCOUNTS
Custom tools can use dedicated accounts that don't grant access to WordPress administration or hosting controls. Secure sign-in, protected passwords, and session safeguards help prevent unauthorized access.
CONTROLLED DATA HANDLING
We build safeguards around how information is viewed, imported, exported, and changed. Sensitive credentials and unnecessary technical details are excluded from routine data exports.
CONTROL OVER YOUR RECORDS
We provide ways to manage access, update information, and remove records when appropriate. Data can be deleted from active systems, while historical backups follow applicable retention schedules.
Extra safeguards
when you need them.
A clinic with patient data, a school district, a nonprofit with a grant questionnaire to answer. When the obligations are heavier, we can add:
Geographic restrictions
Block access from countries or regions where your real visitors are not, reducing exposure to malicious traffic.
Two-factor or passkeys for admins
Require stronger sign-in for everyone who manages your website, in case a password is ever compromised.
Privacy, terms & cookie documents
Help putting clear policies in place through a compliance platform. They don't stop attacks, but they explain how information is handled. Adds an annual cost.
No one can promise a website will never be targeted. Layers make an attack harder, and make it far more likely someone notices quickly.
Questions about keeping your site safe?
Tell us about your website and what worries you. We'll explain what we'd put in place and why.
