There is a constant battle between malicious hackers attempting to compromise websites and the technology that is designed to stop them.
For the websites we host on behalf of our clients, much of the most important protection happens quietly in the background, meaning that they don’t have to worry and can just focus on their core business. Although the technologies we implement, are largely undetected, they play a critical role in keeping the websites secure, stable, and online. They are fundamental to reliable hosting.
This blog outlines the actions that we implement for our WordPress clients when we create their websites, and through our website maintenance packages, to protect every website client that we have.
Below are built-in features for our hosting platform.
Web Application Firewall (WAF)
What is a web application firewall (WAF)? We like to use the analogy of a bouncer at a nightclub. The WAF ensures that the right things are let in, and the wrong things are turned away. It acts like a shield for the website, and anything that might transmit data between the client (such as the browser) to the server (your hosting). The things that transmit data are often called scripts. Criminal hackers attempt to hijack these scripts and insert their own commands. The firewall works by intercepting these attempts. Our hosting does this with “off the shelf” rules but also supplements and enhances these rules with its own, created by its own security experts. It is like the bouncer having access to your birth certificate too.
It is important to note that this filtering takes place at the network edge, before the web application even executes – like the bouncer stopping someone before they even get in the queue.
Specialist autoscaling platform
If there is a surge in website traffic, it can impact security, as surges in traffic can be the result of malicious intent. This can be through Distributed Denial of Service (DDoS) attacks or an attempt to brute-force a password, for example.
Other web hosting providers are confined to the resources of a single server, which will cause the website to slow down, whereas with our hosting, the specialist autoscaling technology will scale as much server resource as needed until the attack has been stopped by other security measures. That resource is not confined to a single server, so the website won’t be slowed down.
StackProtect
You have no doubt encountered “Are you a human?” checkboxes when using websites. Our hosting has a form of this to ensure that both administrators of websites and users are, in fact, human by using StackProtect. It does this through complex behavioural tests rather than having to decipher some grainy images or badly written numbers and letters.
StackProtect works to protect against bots that may be trying to guess the password to your website through high-speed brute force by using JavaScript challenges to filter out bad bots vs real users.
Daily Malware Scans
Our hosting carries out daily malware scans – as well as the option to carry out malware scans manually (such as when we are completing our maintenance package checks).
In the event that there is potential malware, we are notified by email so that we can fix or remove the issue immediately.
Network Defences
Going back to the bouncer analogy (sorry), the network defences are like the bouncer knowing the address of those in the queue and banning those who are from the “wrong side of the tracks”.
Suspicious IP addresses and networks are automatically routed to different web servers to keep traffic away from the standard web servers. If they are not just suspicious, but known to be harmful, our hosting can outright ban the IP address(es) and they will be blocked at the network edge.
These IP addresses are found through publicly available reputation websites – as well as our provider’s own rules too.
In addition to this, our hosting allows our customers to make their own security rules so that individual IP addresses, ranges or countries can also be blocked from accessing their website.
DDoS Protection
We previously mentioned Distributed Denial of Service (DDos) but what are they? They are attacks that are made by individuals – and can take down large corporations by flooding their servers with requests.
We use Enterprise-grade DDoS protection, both in-house and upstream service providers, on our servers. It is the best you can get.
Our hosting providers note that they get daily DDoS attacks on their servers, but our customers don’t ever hear about this because once they are detected, they are blocked.
Free SSL Certificates
SSL certificates are brilliant. They are the little padlock icon by the web address (and are the “s” in https). They encrypt the data flowing between the browser and the server, making it more difficult to intercept your personal data.
Google encourages the use of SSL certificates by boosting the websites that have them, in search results. They are included in the price of web hosting, for free, because they are so vital to your website.
Server Distribution
Our providers do not have everything on one server (which is inefficient and insecure). Instead, the servers have different roles: email servers run email, MySQL servers run MySQL, storage just stores, and web servers run websites.
This means that even in the worst-case scenario, and your website has been compromised, the attacker can’t delete log files to cover their tracks or read your emails. The data is on secure, physically separate machines.
While the servers can talk to each other over a fast network, they aren’t in the same room. The back-ups are kept at locations that are remote from the main servers, at different data centres. All the data centres have redundant emergency power supplies in case of a power outage.
Physically Secure
It's Up To You
Of course, there is never a 100% guarantee that your site will be secure. That is impossible to make. There are still ways to attack a website that can’t be controlled (such as someone knowing your password).
All that we can do is as much as we can (and more than anyone else) when your website is hosted with us. Our providers are continually updating and improving things, and we are fully committed to make all our security measures included for no extra charge.
With us, you have the best possible security, and if you’re careful, your website is as safe as it can be when you’re with us.
For more information, visit our Hosting page. If you would like to move your website to be hosted with us, please get in touch.
