Your site, kept apart
Every site runs in its own containers, and network rules decide who can talk to whom: another customer's site can't reach yours. On the isolated tier the database and Redis are yours alone; on the base tier the database sits on a shared server, with its own user and connection limit for each site. Connections to the database and cache are encrypted, even inside our network.
A firewall in front of WordPress
Wordfence is installed on every site and filters requests before they reach your code. XML-RPC, a common target for password guessing, is switched off.
wp-admin behind single sign-on
To reach wp-admin you first log in with your wordxpress account. A guessed WordPress password is not enough on its own, and if your account is disabled, access to the site goes with it.
Fewer ways in for malicious code
- The WordPress core is read-only: a compromised plugin cannot rewrite it.
- The built-in file editor is off, and PHP cannot run system commands.
- The site can only connect to known services, so injected code cannot easily send data out. You can allow a new service from the dashboard.
- Plugins and themes are checked against known vulnerabilities. When a fixed version exists, it is installed automatically while the site is quiet, with a backup before and a check after.
Backups that are encrypted and kept apart
Every night your files and database are encrypted before they leave your site's environment and kept for seven days. Advanced backup keeps thirty days and stores a copy outside our cluster, so even a problem with the whole platform does not take your copies with it.
Privacy by default
Visit statistics come from our own Matomo, without cookies, and IP addresses are anonymised. The logs in your dashboard mask IP addresses, passwords and session tokens.