Hosting security
Security, in layers.
No single tool keeps a website safe. We stack protections from the network down to the WordPress login, watch them continuously, and keep more than one way back if something goes wrong. Here's what that looks like.
Protection, layer upon layer
The layers
Eight layers between your site and trouble.
From the network edge to your login screen. SSL encryption covers everything in between.
Layer 1
Enterprise infrastructure
A managed WordPress environment on enterprise-grade infrastructure, built for WordPress security, reliability, and performance.
Layer 2
Firewall & DDoS protection
An enterprise web application firewall filters malicious traffic, SQL injection, cross-site scripting, and bad bots before they reach your site, with DDoS protection at the network level.
Layer 3
Malware detection
Continuous malware scanning and security monitoring to spot and deal with malicious activity.
Layer 4
WordPress hardening
A second firewall and hardening layer inside WordPress, supplementing the protections at the hosting level.
Layer 5
Managed updates
We oversee WordPress, plugin, and theme updates rather than trusting unattended auto-updates, and watch for compatibility problems.
Layer 6
Spam & bot protection
Filters that stop spam, fake registrations, phishing submissions, and other automated abuse of your forms.
Layer 7
Backups & recovery
Daily on-site and off-site backups, plus an additional independent backup and recovery layer.
Layer 8
Monitoring
Uptime and site monitoring, so availability problems are spotted and handled quickly.
Logins & accounts
Locking the front door.
Most attacks go after the login. These protections are part of how we set up and run the sites we look after.
- SSL/HTTPS encryption across the whole site
- Passwords stored with WordPress's one-way hashing, never readable
- Secure sessions and time-limited password-reset links
- Rate limiting on logins and password resets to stop password guessing
- Secure, HttpOnly, SameSite authentication cookies
- Activity logging for important administrative actions
Custom tools
When our tools handle people's information.
Portals and systems we build for clients carry their own protections on top of the hosting layers.
Separate accounts
People using a portal or tool we build don't get WordPress accounts, so their login can never reach the admin area.
Access enforced by the system
Administrators can be limited to specific groups or areas, and the system enforces it rather than just hiding things on screen.
Safer sign-in
One-time, expiring login links or codes, with any optional passwords stored using one-way hashing.
Abuse protection
Rate-limited logins, resets, and registrations, plus bot detection that blocks or flags suspicious sign-ups without a CAPTCHA.
Controlled imports & exports
Exports include only what is needed, never passwords, sessions, network addresses, or device details.
Minimal data, easy deletion
We collect only what the program needs, access can be switched off instantly, and records can be fully deleted.
On request
Extra safeguards when you need them.
A clinic with patient data, a school district, a nonprofit with a grant questionnaire to answer. When the obligations are heavier, we can add:
Geographic restrictions
Block access from countries or regions where your real visitors are not, reducing exposure to malicious traffic.
Two-factor or passkeys for admins
Require stronger sign-in for everyone who manages your website, in case a password is ever compromised.
Privacy, terms & cookie documents
Help putting clear policies in place through a compliance platform. They don't stop attacks, but they explain how information is handled. Adds an annual cost.
No one can promise a website will never be targeted. Layers make an attack harder, and make it far more likely someone notices quickly.
Questions about keeping your site safe?
Tell us about your website and what worries you. We'll explain what we'd put in place and why.
