Security and backups
Here is exactly how we protect your site.
Every site we host gets the same firewall, malware scanning, monitoring and backups, whatever plan it's on. This page lists what we do, how often and where your backups are kept.
Bars drawn to scale on a 12-month track. Same schedule on every plan.
Backups
Your backup schedule, on every plan
Backups are copied off the web server to separate storage. If a server, a data center or a whole region has a problem, your site can be rebuilt elsewhere.
Restores are done by an engineer who checks the result with you. If you need a file or a page from last Tuesday, call or text and ask.
Monitoring
What we watch around the clock
Uptime and availability
- Checks every minute from multiple regions
- Alerts go to an engineer, not a queue
- Response time tracking
- SSL expiry and DNS checks
Threats
- Every site served behind a firewall
- Real-time malware and virus scanning
- SpamBorg anti-spam and security, free for clients
- Brute-force login blocking, and we recommend adding Cloudflare
- File change monitoring
Server health
- CPU, memory and disk usage
- Storage and disk I/O alerts
- Service and process checks
- Backup job completion
Prevention
What we do before there's a problem
Updates and patches
- WordPress core, plugin and theme updates
- Server and operating system patches
- PHP version upgrades, tested first
- Outdated plugins flagged and replaced
Hardening
- File permission hardening
- XML-RPC and REST API restrictions
- Security headers such as HSTS
- Admin access limits on request
Access control
- Two-factor authentication recommended
- Least-privilege accounts
- Logged administrative actions
Incidents
When something goes wrong
We sort every alert by severity and respond to match it.
- Low
Blocked and logged
Failed logins, routine scans and minor alerts are blocked automatically and reviewed for patterns. We tell you if a pattern starts to matter.
- Medium
Investigated by our engineers
Suspicious file changes, vulnerable plugins or targeted attacks get an engineer's attention right away. You get a plain-language explanation and what we changed to prevent a repeat.
- Critical
Contained, then explained
An active breach or an outage is contained first, isolating the site if needed. We call you, work it through to the end and give you a written timeline and root cause.
Compliance
A straight answer on certifications
We don't currently hold SOC 2 or ISO 27001 certification. We follow practices that align with those frameworks and document our procedures. If your business needs formal compliance, tell us your requirements and we'll say plainly whether we can meet them before you sign anything.
Security habits from regulated industries
Our founder has built and run hosting infrastructure since 1994 for more than 100 Fortune 500 companies, banks and mortgage lenders.
Ask us anything about how we protect your site.
If you have specific security or compliance requirements, we'd rather discuss them before you commit than after.