Hosting with a bodyguard built in, day and night

Before a single request reaches your site's code, the managed firewall checks it against a library of known attack signatures that we keep current. That catches SQL injection attempts aimed at your database, cross-site scripting payloads built to hijack visitor sessions, remote file inclusion, directory traversal and command injection. It also weeds out abusive bots, credential-stuffing scripts and traffic scanning for well-known plugin or theme weaknesses. You don't write a single rule yourself — our team tunes and updates the firewall as new threats surface. Genuine visitors sail through without any delay or friction, while harmful requests get dropped right at the edge, so your server never has to process them. In short, a large share of common attacks never gets anywhere near your application, your database or your files.

Imunify360 comes standard on every secure plan, running in the background around the clock and again the instant a file is uploaded or edited. When it spots something malicious — a planted backdoor, a defaced page, a phishing kit or a script sending spam — it quarantines that file straight away, so the problem stays contained instead of spreading through your account. Your dashboard shows exactly what was found and where, and you can inspect or restore items yourself if needed. On top of detection, virtual patching covers outdated plugins and themes against known exploits until you get around to updating them, closing the gap attackers usually go after. Because the scanning never stops — rather than running once a day — most issues are caught and shut down within minutes, keeping your site clean and your visitors out of harm's way.

Yes — no trial period, no first-year-only deal, no upsell attached. Every domain and subdomain on a secure plan gets an SSL certificate the moment it goes live, and that certificate renews itself automatically before it can expire, for as long as you stay hosted with us. Your visitors' padlock icon never disappears, and you'll never get a bill or reminder for renewing it. What SSL actually does is encrypt the link between your visitors and your server, so login credentials, contact-form submissions, checkout details and anything else typed into your site stay private in transit. It also counts toward search rankings and keeps browsers from slapping a 'Not secure' warning on your pages. There's no setup on your end — the certificate is issued and kept current for you, so your site is encrypted from the very first day it's live.

Backups run automatically every single day and are kept off-server, well away from the machine they're protecting. Each one wraps up both your files and your databases together, so what you restore is a whole, working copy of your site rather than scattered pieces you have to reassemble. Restoring is entirely in your hands: open your dashboard, pick a recovery point, and roll back your whole account, one site, or just a single database — a handful of clicks and it's usually done within minutes. That makes your daily backup the fix for nearly anything that goes sideways: a broken update, a bad edit, something deleted by accident, or worse. You never have to remember to trigger one yourself, and since copies live off-server, they're still there for you even if the live environment runs into trouble.

No. Mitigation happens out at the network edge, well before traffic ever reaches your server, and it works by reading the volume and pattern of incoming traffic rather than examining each page request. Real visitors get waved straight through with zero added delay, while a barrage of malicious packets aimed at overwhelming your site gets absorbed and stripped out before it ever touches your hosting. Because that filtering capacity spans our entire network rather than a single machine, it can soak up attacks far bigger than any one server could handle on its own. The upshot is that your site keeps running smoothly during an attack that would take an unprotected site completely offline. You don't need to enable or configure anything — it's active by default on every plan, quietly protecting your uptime whether or not anyone's currently targeting you.

Monitoring blends automated systems with real people keeping an eye on the platform every hour of every day. On the automated side, we're tracking server health, uptime, resource usage, disk and network activity, and known signs of intrusion, with an alert firing the second anything looks off. Our team then reviews those alerts and digs into anything suspicious right away, instead of waiting for you to notice a problem and file a ticket. That covers hardware failures, odd traffic spikes, repeated failed logins and other signs something's wrong, so issues are frequently handled before your visitors ever notice. Combined with the firewall, malware scanning and daily backups, this is the layer standing watch while you're asleep or busy with other things. And if you do spot something first, the same round-the-clock support team is just a message away to help you dig in.