Web Hosting Security: A Practical Responsibility Checklist
Hosting security starts with knowing who does each job. A host may protect its facilities and server platform while leaving your website accounts, plugins and content to you. Problems appear when both sides assume the other handles an important task.
Use this checklist to discuss responsibilities with a provider and establish an operating routine. It cannot certify a website as secure, and no hosting label removes the need to maintain an application.
Write down the responsibility split
| Area | What to establish |
|---|---|
| Platform | Who patches the operating system, runtime, database and control panel? |
| Application | Who updates the CMS, extensions, themes and custom code? |
| Access | Who approves accounts, reviews privileges and removes old access? |
| Recovery | Who creates backups, tests restores and coordinates an incident? |
| Monitoring | What is monitored, who receives alerts and when will someone respond? |
The AWS shared responsibility model illustrates how duties vary by service. Its exact split should not be assumed to apply to every web host. Obtain the scope for your own product, especially when comparing managed hosting with an unmanaged server.
Protect the accounts that control the website
Use unique passwords and multi-factor authentication where supported. Include the hosting account, domain registrar, primary email and CMS administrators. Access to any one of those can affect the rest.
Give each person an appropriate account rather than sharing the owner’s login. Remove unused access and keep recovery methods available to the authorised owner. Store recovery codes securely outside the account they recover.
Check permissions before changing them. A blanket file-permission command copied from a guide can break a site or expose data. If you are unsure, ask the provider for the correct settings for its environment.
Maintain the application
Install software from trusted sources, remove components you no longer use and plan updates. For important sites, test changes on a protected copy and keep a usable rollback method. Unsupported software needs a replacement plan.
The WordPress hardening guide is a useful reference for WordPress-specific controls. A security plugin can support an operating routine, but it does not repair every vulnerable component or replace updates.
Understand the limits of individual controls
HTTPS protects data in transit between the browser and the endpoint. It does not prove that a plugin is safe or that an administrator account is protected. Keep certificates renewing correctly and investigate browser warnings rather than bypassing them.
A firewall can filter some unwanted requests. Malware scanning can help identify suspicious files. Ask what each service covers, whether removal is included and how findings are reported. Avoid stacking overlapping tools without understanding their configuration.
Make backups recoverable
Document frequency, retention, included data, restore cost and access if the hosting account becomes unavailable. Keep an appropriate separate recovery copy for important data and test restoring to an isolated environment.
For a changing database, decide how much data loss is acceptable. A daily backup might be insufficient for a busy shop. Restore files and data consistently, and plan how to reconcile activity after the backup.
Prepare a short incident plan
Record the host’s support route, authorised contacts and the person who can make recovery decisions. During an incident, preserve useful logs, restrict exposed access through supported controls and ask qualified support to investigate.
Do not assume restoring an old backup removes the original entry point. Resolve the cause, review access and check the recovered site before reopening normal operations. Consider any data-related obligations with appropriate professional advice when relevant.
Review these tasks when people, software or hosting plans change. Our website launch checklist covers the final operating checks, while the hosting data-protection guide helps organise supplier questions about personal data.
