Scan
Daily malware checks, reports and on-demand rescans
Website security
Enterprise-level security, built into your hosting.
Security breaches and malware can put your website, data and reputation at risk. Secure hosting brings together monitoring, traffic filtering, access controls and recovery tools to help protect your online business.
Explore the protections available across your hosting environment, from website requests and email to infrastructure and backups.
These security features are included with hosting, rather than charged as separate security add-ons.
Filter
Web application, login and network protections
Control
Account, file, connection and email safeguards
Recover
Backups, restore points and resilient infrastructure
Website monitoring
Find and respond to malware.
Scheduled checks, clear reports and on-demand scans help you act when something looks wrong.
Automatic malware scanning
Websites are scanned daily for common malware, including web shells and mail or spam daemons. Review detailed scan reports and receive an email alert if malware is found.
Scan again when you need to
After updating software or removing compromised files, start a new scan immediately and check whether your changes resolved the issue.
WordPress checksum reports
Compare WordPress core files with the official WordPress repository to identify unexpected changes. When malware is detected, PHP mail is disabled to help prevent further malicious email being sent.
Website and network defence
Filter suspicious traffic before it reaches your site.
Application, login and network controls work at different layers to help reduce common attack paths.
Web Application Firewall
The WAF inspects HTTP requests for SQL injection, trojans, cross-site scripting, path traversal and other suspicious activity. Filtering takes place at the network edge, before web application scripts run, and its rules are regularly updated. Request checks take less than a millisecond.
Network reputation controls
Suspicious IP addresses and networks can be blocked at the network edge. Traffic from suspicious sources can be routed to separate web servers, keeping it away from standard web servers.
Brute-force and bot protection
Automated login attempts are monitored and challenged with reCAPTCHA or blocked when necessary. The protection handles up to six million blocked requests per day.
DDoS protection
Anti-DDoS protection rated at more than 1 Tbps filters malicious traffic to help keep your website available during an attack.
Account and site access
Put more control around who can get in.
Use account security and website controls to limit access to the people and systems that need it.
Two-factor authentication
Add a time-based code from an authenticator app, such as Google or Microsoft Authenticator, to supported hosting account, control panel and SSH sign-ins. For some payments, additional details may be confirmed by phone using information provided at sign-up.
IP and country blocking
Block individual IP addresses, subnets or visitors from selected countries from accessing your website.
Password-protect websites
Add password protection to a whole website or selected areas without writing code. Generate strong random passwords in the hosting control panel.
File permissions checker
Scan website files for permission errors that could enable unauthorised access. Review recommended changes and apply corrections automatically.
Locked file-transfer access
FTP, SFTP, Remote MySQL and SSH access are locked by default and can be enabled after control panel authentication. Temporary FTP access locks again automatically when its time period ends.
TLS-protected transfers and security headers
FTP and SFTP connections use Transport Layer Security. Manage website security headers through the CDN dashboard and choose which policies to enable.
HTTPS and recovery
Encrypt connections. Keep recovery options close.
Encryption helps protect data in transit, while separated systems and backups support recovery planning.
Free wildcard SSL certificates
SSL certificates encrypt data between your website and its visitors. Wildcard certificates can secure a primary domain and its subdomains when the domain uses supported nameservers.
Isolated backups
A 3-2-1 backup approach keeps web, database, FTP and email services on separate stacks with local redundant backups, alongside off-site backups stored in a different data centre.
Restore points
Create on-demand backups or use scheduled snapshots and restore points from the hosting control panel to help recover website data.
Email security
Filter spam and viruses across email.
Inbound checks and configurable filters help reduce unwanted and harmful messages for mailboxes and forwarders.
Three layers of inbound scanning
Network-level deny lists, including Spamhaus, Invaluement and Barracuda Networks, help reject known spam sources. Virus scanning checks for known malware signatures, and content analysis filters spam-like messages into junk.
Filters you can configure
Create allow and deny rules for senders, domains and top-level domains through the webmail control panel. Allow-listed senders can bypass content filtering.
Clear handling of rejected messages
Messages rejected because of a known virus or network deny listing are returned to the sender, rather than silently discarded.
Outgoing spam monitoring
Outgoing email is monitored under a zero-tolerance spam policy to help prevent compromised accounts from sending bulk spam and damaging your email reputation.
Facilities and platform resilience
Security continues below the application layer.
Physical access controls and resilient infrastructure support the systems that run your websites and email.
Controlled facility access
Data centre safeguards include photo identification and swipe-card entry, CCTV coverage, gated access and secure perimeter fencing. Staff access to internal systems follows identity checks and least-privilege policies.
Autoscaling capacity
Autoscaling helps account for changing resource demand, including the additional load that can come with a traffic surge.
Redundancy and automatic failover
Redundant hardware, software and network components help avoid single points of failure. Automatic failover helps restore services after a component failure.
Isolated server roles and central logs
Web servers, database servers and email servers run as separate roles. Logs are sent to central log servers, helping keep services and records isolated.
Before you choose
Secure hosting questions, answered.
How often are websites scanned for malware?
Websites are scanned daily for common malware. You can also run an on-demand scan after making changes, and email alerts are sent when malware is detected.
Can I run a malware scan after fixing my website?
Yes. Start an on-demand scan after updating software or removing compromised files to check whether your changes resolved the issue.
Are SSL certificates included?
Free SSL certificates are available for hosted websites. Wildcard certificates can secure a primary domain and subdomains when the domain uses supported nameservers.
What protections help block website attacks?
Hosting includes a Web Application Firewall, network-level protections, brute-force login protection and DDoS protection. Available controls vary by service and configuration.
Can I add extra security to account access?
Two-factor authentication is available for supported hosting account, control panel and SSH sign-ins. Website tools also include IP blocking and password protection.
How can I recover website data?
Use scheduled snapshots, restore points or on-demand backups from the hosting control panel. Off-site backup storage supports recovery planning.
Does hosting include email filtering?
Email scanning checks for known spam sources, virus signatures and spam-like content. You can configure allow and deny rules through the webmail control panel.
What does the Web Application Firewall check?
The firewall inspects web requests for suspicious activity such as SQL injection, cross-site scripting, trojans and path traversal. Filtering happens at the network edge, before application scripts run, and rules are regularly updated.
Can I block visitors by IP address or country?
Yes. Hosting controls let you block individual IP addresses, subnets or visitors from selected countries.
Can I lock FTP, SFTP, Remote MySQL and SSH access?
These access methods are locked by default. Enable them after authenticating through the control panel; temporary FTP access can lock again automatically after a set period.
Can I manage my website security headers?
Yes. The CDN dashboard lets you manage HTTP security headers and choose which policies to enable for your website.
What happens when an email is rejected for a known virus?
Messages rejected because of a known virus or a network deny listing are returned to the sender, so the sender knows the message was not delivered.
How are backups stored separately from live hosting?
Web, database, FTP and email services operate on separate stacks with local redundant backups. Off-site backups are stored in a different data centre to support disaster recovery.
What physical security measures are used at data centres?
Data centre controls include photo ID and swipe-card entry, CCTV, gated access and secure perimeter fencing. Access to internal systems follows identity checks and least-privilege policies.