Hosting that defends your site around the clock

The managed web application firewall inspects every incoming request before it reaches your site's code, matching it against a constantly updated set of known attack patterns. It blocks SQL injection attempts that try to read or alter your database, cross-site scripting payloads that hijack visitor sessions, remote file inclusion, directory traversal and command injection. It also filters out abusive bots, credential-stuffing scripts and traffic probing for well-known plugin or theme vulnerabilities. Because the firewall is fully managed, you never write or maintain rules yourself — we tune and update them as new threats appear. Legitimate visitors pass through instantly and notice nothing, while malicious requests are dropped at the edge, sparing your server the load. In practice that means many common attacks are stopped long before they can touch your application, your database or your files.

Every secure plan includes Imunify360, which scans your files continuously in the background and again the moment anything is uploaded or changed. When it identifies malicious code — an injected backdoor, a defaced page, a phishing kit or a spam mailer — it quarantines the affected file automatically so the infection is isolated rather than left to spread across your account. You get a clear alert in your dashboard showing what was found and where, and you can review or restore items if needed. Alongside detection, virtual patching shields outdated plugins and themes from known exploits until you have time to update them, closing the window attackers rely on. Because scanning is proactive and constant rather than a once-a-day sweep, most problems are caught and contained within minutes, keeping your site clean and your visitors safe.

Yes, completely free — not a trial, a first-year promotion or an upsell. Every domain and subdomain hosted on a secure plan receives an SSL certificate that is issued automatically when you go live and renewed automatically before it expires, for as long as your site stays with us. That means the padlock in your visitors' browsers never lapses and you are never chased for a renewal fee. SSL encrypts the connection between your visitors and your server, protecting login details, contact forms, checkout data and anything else people type into your site. It is also a confirmed search-ranking signal and stops browsers from flagging your pages as 'Not secure'. There is nothing to install or configure by hand — the certificate is provisioned and maintained for you, so encryption is simply on from the first day your site is live.

Automated backups run every day and are stored off-server, so a copy of your site sits safely away from the machine it protects. Each backup captures both your files and your databases, which means you can recover a complete, working version of your site rather than piecing it together afterwards. Restoring is self-service: from your dashboard you select a recovery point and roll the whole account, a single site or an individual database back with a few clicks, usually in minutes. That makes daily backups your undo button for almost anything — a botched update, a bad edit, an accidental deletion or, in the worst case, a security incident. Because backups are automatic you never have to remember to run them, and because they are kept off-server they remain available even if something goes wrong with the live environment itself.

No. DDoS mitigation works at the network edge, well in front of your server, and inspects the shape and volume of incoming traffic rather than the contents of each page request. Legitimate visitors are waved straight through and experience no added delay, while a flood of malicious packets designed to overwhelm your site is absorbed and filtered out before it ever reaches your hosting. Because the filtering capacity sits across our wider network, it can soak up volumetric attacks far larger than any single server could withstand. The result is that your site stays online and responsive during an attack that would otherwise knock an unprotected site offline. There is nothing for you to switch on or configure — the protection is always active on every plan, quietly guarding your uptime whether or not anyone is actively targeting you.

Round-the-clock monitoring combines automated systems with real people watching over the platform every hour of every day. The automated side continuously tracks server health, uptime, resource usage, disk and network behaviour, and known intrusion signatures, raising an alert the instant something drifts out of normal range. Our team reviews those alerts and investigates anything suspicious straight away, rather than waiting for a customer to notice and open a ticket. That covers hardware faults, unusual traffic spikes, repeated login failures and signs of compromise, so issues are often addressed before they affect your visitors. Paired with the firewall, malware scanning and daily backups, monitoring is the layer that keeps watch while you sleep or focus elsewhere. If you do spot something yourself, the same 24/7 support team is one message away and ready to help you look into it.