A guard on the door, day and night

Before any request touches your site's code, the managed firewall weighs it against a library of known attack signatures that our team keeps current. That picks up SQL injection aimed at your database, cross-site scripting payloads written to hijack visitor sessions, remote file inclusion, directory traversal and command injection. It also strains out abusive bots, credential-stuffing scripts and traffic hunting for well-known plugin or theme weaknesses. You never write a rule yourself — we tune and update the firewall as new threats appear. Genuine visitors pass through with no delay or friction at all, while harmful requests are dropped at the edge so your server never has to process them. The practical effect is that a large share of common attacks gets nowhere near your application, your database or your files.

Imunify360 is standard on every secure plan. It runs in the background continuously and again the instant a file is uploaded or edited. When it finds something malicious — a planted backdoor, a defaced page, a phishing kit, a script pumping out spam — that file goes straight into quarantine, so the problem stays put instead of spreading through the account. Your dashboard shows exactly what was found and where, and you can inspect or restore anything yourself. Alongside detection, virtual patching covers out-of-date plugins and themes against known exploits until you get round to updating them, which closes the gap attackers usually aim for. Because scanning never pauses — rather than running once a day — most problems are caught and shut down within minutes, which keeps the site clean and your visitors out of trouble.

Yes — no trial window, no first-year-only offer, no upsell waiting at the end. Every domain and subdomain on a secure plan is issued an SSL certificate as it goes live, and that certificate renews itself before it can expire, for as long as you host with us. The padlock your visitors look for never disappears, and no bill or renewal reminder ever arrives for it. What SSL does is encrypt the link between visitor and server, so login details, contact-form submissions, checkout information and anything else typed into the site stays private in transit. It counts toward search rankings too, and it stops browsers pinning a 'Not secure' label on your pages. There's nothing to set up at your end: the certificate is issued and kept current for you, so the site is encrypted from its first day online.

Backups run automatically every day and are held off-server, well away from the machine they exist to protect. Each one takes files and databases together, so what comes back is a whole working copy of the site rather than pieces you have to reassemble. Restoring is entirely yours to do: open the dashboard, choose a recovery point, and roll back the whole account, a single site, or just one database — a few clicks, and it's usually finished within minutes. That makes the daily backup the answer to almost anything that goes wrong: a broken update, a bad edit, something deleted by mistake, or worse. You never have to remember to start one, and because the copies live off-server, they're still waiting for you even if the live environment runs into trouble.

No. Filtering happens out at the network edge, long before traffic reaches your server, and it works by reading the volume and shape of incoming traffic rather than picking apart each page request. Real visitors are waved through with nothing added to their load time, while a barrage of packets sent to overwhelm the site is absorbed and stripped away before it touches your hosting. Because that filtering capacity spans the whole network instead of one machine, it can soak up attacks far larger than a single server could ever handle. What that means for you is a site that keeps trading through an attack that would knock an unprotected one clean offline. Nothing needs enabling or configuring: it's on by default across every plan, quietly guarding your uptime whether or not anyone happens to be aiming at you.

Monitoring mixes automated systems with real people keeping watch over the platform every hour of every day. On the automated side we track server health, uptime, resource usage, disk and network activity, and the known signatures of intrusion, with an alert firing the moment something looks off. Our team then reads those alerts and digs into anything suspicious immediately, rather than waiting for you to notice and open a ticket. That covers hardware faults, odd traffic spikes, repeated failed logins and other signs of trouble, so problems are often dealt with before a visitor sees them. Sitting alongside the firewall, malware scanning and daily backups, this is the layer standing watch while you're asleep or busy elsewhere. And if you spot something first, the same 24/7 support team is one message away and ready to dig in with you.