Website Hosting Security: What Your Host Can and Can’t Protect

"What does website hosting security actually protect, and what's still up to me?" It's a smart question, because many hosting plans advertise "security" without saying what it covers. My honest answer is that a good host protects a lot, from the server itself to the software your site runs on, but no host can protect everything. Some of the most common ways sites get broken into have nothing to do with the server at all. The real dividing line is between what happens on the server, which your host controls, and what happens with your passwords, your email, and your own computer. Here's where that line falls.

By Setrik · Web designer and SEO consultant

The host side

What Website Hosting Security Covers

The host's side of the line

Your host runs the server your website lives on, so website hosting security is mostly about that server and the software on it. A good host keeps the server's own software patched, controls who can log in to it, watches for attacks, and encrypts the connection between your site and your visitors. For a WordPress site, many hosts also keep WordPress and its main plugins updated. None of that is visible to you when it's working, which is exactly how it should be.

Silver bank vault door, a picture of the server-side protection that website hosting security provides

How much of this you get depends on the kind of hosting you buy. Cheap plans often handle the server and leave everything about the website itself to you, while managed plans take on far more. My comparison of shared web hosting, managed hosting, and doing it yourself explains the difference. It's worth knowing which one you have, because a "secure hosting" label can mean very different things depending on who's selling it.

The layers

What a Good Host Does to Protect Your Site

Good website hosting security isn't one feature; it's several layers, each covering what another might miss. You don't need to understand how they work, but it helps to know what to look for when you compare plans or ask your current host what you're getting. For WordPress hosting security in particular, these are the layers I'd expect from any host that takes it seriously.

The layers of a well-protected site

A firewall

Blocks unwanted traffic before it reaches your site.

Automatic blocking of repeated failed logins, and two-factor authentication on admin accounts.

HTTPS on every page

An encrypted connection, with certificates that renew automatically.

Automatic security updates

For the server, WordPress, and the main plugins.

Regular checks

WordPress files compared against the official originals, and website security scanning for malware.

Alerts and backups

Warnings about problems or unusual logins, and offsite backups to fall back on.

One honest note about scanning: a malware scan finds problems, it doesn't fix them. When a scan flags something, a person still has to look at it, clean it up, and work out how it got there. That's worth knowing when a plan promises "malware protection," because the useful question is who does the cleanup and whether it costs extra. Cheap plans often stop at the alert, which is a big part of why inexpensive web hosting can cost more in the end.

Three security cameras mounted together on a building, keeping watch like website security scanning

The limits

What Hosting Can't Protect

This is the part of website hosting security that most hosting ads leave out. Many break-ins don't come through the server at all. They come through a person: a guessed password, a tricked employee, or a login stolen from somewhere else. No host can stop someone from logging in with your real password, because to the server, that looks exactly like you. These are the four gaps every owner should know about.

Four things your host can't protect

Weak or reused passwords

If your password leaks from another site, it opens yours too.

Unsafe plugins

An admin who installs an untrusted plugin can let an attacker straight in.

A hacked email account

Whoever controls your email can reset your website password.

Your own computer

Malware on the device you log in from can capture what you type.

Let's say an office manager uses the same password for the website, the bank's newsletter, and a shopping site. When the shopping site is breached, that password ends up on a list, and automated tools try it everywhere. One that catches people out runs through email: an attacker takes over the business email account, clicks "forgot password" on the website, and walks in. CISA, the U.S. cybersecurity agency, recommends strong, unique passwords for exactly this reason.

Here's a simple rule of thumb: your host locks the building, but you still control who gets a key.

Rather talk it through?

Call 940-228-4540 and ask out loud.

Call 940-228-4540

On sites I host

How Security Works on Sites I Host

Every site I host gets the full set of website hosting security layers described above: a firewall, automatic blocking of repeated failed logins, two-factor authentication on admin logins, HTTPS on every page with certificates that renew automatically, and automatic security updates for the server, WordPress, and the main plugins. WordPress itself is locked down beyond its default settings. A daily check compares WordPress and plugin files against the official originals, and a weekly malware scan looks through every site file. I get alerts about problems and unusual logins, and every site has daily offsite backups.

If a site I host is hacked anyway, the cleanup and repair are included in my Hosting & Care plan. I won't promise that a site can never be hacked, because nobody honestly can. What I can promise is that someone is watching, that the most common doors are closed, and that if something does get through, I'll deal with it rather than send you a bill and a list of instructions. That's the difference between a host that sells security and one that takes responsibility for it.

Your part

What You Can Do Today

The gaps your host can't cover are also the easiest ones for you to close, and most take minutes. None of them need technical skill. If you only do two things this week, make them a unique password for the website and two-factor authentication on your business email, since email is the key to everything else. CISA's guide to turning on multifactor authentication walks through it in plain language.

Someone handing another person the keys to a car, like deciding who gets a login under WordPress hosting security

Quick wins for owners

Use a password manager. A unique, long password for every account, without memorizing them.

Turn on two-factor authentication. On your email first, then your website and domain accounts.

Give each person their own login. No shared passwords, and remove access when someone leaves.

Ask before adding plugins. Let whoever looks after the site check first.

Keep your computer updated. Updates and basic antivirus on the devices you log in from.

The honest answer

So, Is Your Website Secure?

If your host covers the layers above and you've closed the gaps on your side, your site is in good shape, though no one can honestly promise it's impossible to break into. Strong website hosting security handles the server, the software, the scanning, and the backups. The rest depends on passwords, email, and the people with access. When both sides are covered, an attack is far less likely to succeed, and far easier to recover from if it does.

If you're not sure what your current host actually covers, I'm happy to help you find out. Tell me who hosts your site and what plan you're on, and I'll give you an honest read on what's protected and what isn't. You can start with a free, no-pressure conversation whenever you're ready.

Tired of wondering if your site is secure?

I host and maintain WordPress sites so you can focus on running your business.

Ask About Hosting

Keep reading

Shared, Managed, and Self-Managed Hosting

What each kind of hosting covers, and what it leaves to you.

Read the article

Do WordPress Websites Need Updates?

Why updates are part of keeping a site safe.