What Actually Protects Your Site.
Not a badge and not a long list of acronyms. A container and a Unix user of your own, your own database, a malware scan every night that a person reads, and last night’s backup held somewhere else entirely.
How WordPress Sites Are Actually Lost
Three things account for nearly all of it, and only one of them is about the server.
Most Break-Ins Are A Plugin
The usual way a WordPress site is lost is an out-of-date plugin, a reused password or a theme nobody has updated in two years. None of that is exotic, and none of it is stopped by a badge on a hosting page.
The Second Problem Is The Neighbours
On a lot of shared hosting every site on the machine runs as the same user, so one compromised site can read and write the files of every other one. The first site infected is rarely the last.
What Saves You Is The Undo
Once something has got in, the question stops being how and becomes how far back you can go. A backup you can restore yourself, tonight, matters more than any amount of prevention.
The Protections You Actually Have
All of it on every plan. Nothing here is an add-on and nothing needs configuring to be switched on.
HTTPS On Every Domain
A certificate is issued and renewed for every domain you connect, including the platform address, with no button to press and nothing to buy.
A Container And A Unix User Per Site
Every website runs in its own container, as its own Unix user, with its own MySQL database. That holds between customers and between your own sites too, so one site of yours being compromised does not give anything access to the next one. File permissions mean something here because the users are real.
Nightly Scans A Person Reads
Every site is scanned for malware every night. Nothing is deleted or quarantined automatically, because an automatic quarantine of a false positive takes a working site offline. Findings are reviewed by staff and you are told what was found.
Backups Somewhere Else
Files and the database every night, kept 30 days, written to Google Cloud Storage rather than to the machine the site runs on. Take one by hand before you touch anything risky. Restoring is one click from the members area and it is yours to do, not a ticket.
Cloudflare In Front
Cloudflare serves static files from the edge and absorbs DDoS traffic before it reaches the origin. That is what it is there for, and the next section says plainly what it is not doing on our current plan.
Password Protection On Any Site
Put a password in front of a whole site, live or not, from the members area. Every site also gets a temporary platform address the moment it exists, so a rebuild can be worked on and checked without being public.
A Cap That Limits The Damage
Outbound bandwidth is capped per site. If a site is compromised and used to serve something it should not, it is throttled rather than left running up a bill all weekend. Per-site storage and bandwidth caps inside your pooled allowance do the same for a runaway of your own making.
Narrow Access, Audited
SFTP with key authentication, WP-CLI and a database manager. No general shell, no root, no cPanel, so the surface anyone can reach is small. Staff access to a customer site is audited, and we would rather it be rare and recorded than convenient.
Updates On Your Terms
Automatic updates are optional, off by default and set per site. Switch them on and a backup is taken before the update runs. Leave them off and nothing moves on your site without you.
The Part Most Hosts Skip
A security page is easy to write while everything is fine. The honest test is what you can do at nine on a Sunday evening with a defaced home page and nobody answering the phone.
Here you open the members area, pick a backup from any of the last 30 nights and restore it yourself, files and database together or either on its own. Put a password in front of the site while you work out what let the problem in. Clone it to staging and try the fix there before it goes anywhere near the live address.
Support is a ticket from the members area and it reaches the people who run the platform. There is no phone line, no claim of cover around the clock and no guaranteed response time, which is precisely why the restore button is yours rather than ours.
How Restoring Works
Start On Build
Every protection on this page is on every plan. USD 20 a month billed yearly, or 24 billed monthly.
Build
$240 a year. That is $48 less than paying monthly.
- One website
- 10 GB storage
- 50 GB bandwidth a month
- A temporary address to test on
The Same Protections On Every Plan
One website, properly hosted. For a business site, a portfolio or a blog that has to load fast and stay up.
- Servers In Singapore
- Free SSL On Every Domain
- Daily Backups, Kept 30 Days
- One-Click Staging
- Cloudflare CDN And DDoS Protection
- Nightly Malware Scans
- SFTP And WP-CLI
- PHP 8.3 And Redis
- Support From Real People
Every plan includes the same platform. The only difference is how many websites and how much room they have.
The help centre goes further on nightly malware scans and password protecting a site.
The Ones Worth Asking
Do You Have A Web Application Firewall?
No. Cloudflare is in front of every site for CDN and DDoS protection, and the zone is on Cloudflare’s free plan, which does not include the managed application rules people mean by WAF. We would rather say that than let the word Cloudflare imply it. Isolation, nightly scanning and one-click restore are the protections you actually have here.
What Happens If My Site Is Infected?
The nightly scan flags it, a person looks at the finding, and you are told what was found and where. Nothing is deleted or quarantined for you. The usual fix is to restore the most recent clean nightly backup and then update or remove whatever let it in. We do not clean an infected site for you.
Can Another Customer Reach My Files Or Database?
Each site has its own container, its own Unix user and its own MySQL database with its own credentials, so there is no shared user and no shared schema to read across. The same separation applies between the sites on your own account.
Where Are The Backups Kept?
In Google Cloud Storage, separate from the machines that run the sites, in the Singapore region like everything else. That is deliberate: a backup sitting on the same disk as the site is not a backup.
Are You PCI Or SOC 2 Certified?
No, and we will not imply otherwise. If your work requires a certified host, we are not it today. If you take card payments, your gateway should be handling the card details rather than your own site, which is where most of that burden belongs anyway.
What If The Machine The Site Runs On Fails?
There is no automatic failover to another machine. Recovery is a rebuild from the nightly backup, which is held separately for exactly that reason. There is no published uptime SLA either. Both are worth knowing before you choose a host, which is why they are on this page rather than in a footnote.
What We Do Not Do
Not Our Job, Or Not Yet
- We do not run a web application firewall. The Cloudflare zone in front of your site is on the free plan: CDN and DDoS protection, not managed application rules.
- We do not clean an infected site for you. We tell you what the scan found and restore is one click away, but the clean-up and whatever let it in are yours.
- We do not fail over to another machine. If a machine is lost, the sites are rebuilt from the nightly backup held in Google Cloud Storage. There is no published uptime SLA.
- We are not PCI or SOC 2 certified, and we do not hold any other audited certification. If a compliance programme requires one, we are the wrong host.
- We do not host mailboxes. There is no email account, no webmail and no mail password to be stolen from us, because there is nothing of the kind here.
- We do not move sites across for you. Migration is yours to do, and the temporary address, the password protection and the nightly backups are there to make doing it safe.
Test The Undo Before You Need It
Create a site, break it on purpose, and restore last night’s backup yourself. That is the only security claim worth checking.
Start On Build