Hosting Security Is Shared: What We Handle, What's On You
Most hacked WordPress sites aren’t broken into through the server. They’re broken into through the front door: a guessed or leaked password, an admin account nobody remembers creating, or a plugin that hasn’t been updated in two years.
That’s not a dig at site owners. It’s how security works on any hosting platform. Some layers belong to the host, and some belong to whoever holds the logins. Knowing where the line sits is most of the battle.
What the hosting provider is responsible for
On a managed platform, the server side is the host’s job:
- The operating system and server software — patched and kept current
- The web application firewall — blocking known attack patterns before they reach your site
- Malware scanning — detecting infected files and cleaning them
- Network-level protection — brute-force throttling, bad-bot filtering
- SSL certificates — issued and renewed automatically
- Isolation — one account’s problem can’t spread to the next
On HOSTEMCLOUD, that’s Imunify360 running on every server, automatic certificates on every domain, and 24/7 monitoring.
What’s on you
The host can’t see your passwords and can’t decide who should be an admin. These are yours:
- Logins — WordPress admin, cPanel, your email, your domain registrar
- Who has access — staff, freelancers, former agencies
- Your site’s software — themes and plugins you chose to install (unless your plan includes managing them)
- What you install — “nulled” premium plugins from unofficial sites are one of the most common sources of malware
None of these takes long. All of them matter more than any server setting.
Four things worth doing today
1. Turn on two-factor authentication (2FA). On your WordPress admin, cPanel, email and domain registrar. A stolen password alone stops being enough. If you only do one thing on this list, do this.
2. Use a password manager and unique passwords. Reused passwords are how one leak elsewhere becomes a break-in here. A password manager makes long, unique passwords effortless.
3. Clean up your users. Go to Users in WordPress. Remove anyone who no longer needs access, and make sure nobody has Administrator who only needs Editor. While you’re there, if an account is literally named admin, replace it — it’s the first username every bot tries.
4. Delete plugins and themes you don’t use. Deactivated isn’t enough. A deactivated plugin’s files are still on the server and can still be exploited. If you’re not using it, delete it.
When it overlaps
Some things sit in the middle. Backups are run by the host, but you should know how to ask for a restore before you need one. Updates to WordPress core and plugins can be automated, but someone should check the site afterwards (more on that in updating WordPress without breaking your site). If you’re not sure who covers something, ask. It’s a much better conversation to have before an incident.
If something does go wrong
Every UNITY plan includes hack recovery: if your site is compromised, we clean it up. But recovery fixes the damage; it doesn’t fix the open door. After any incident, the four steps above are still the first thing to do — otherwise the same password lets the same attacker straight back in. Here are the early signs a site has been compromised.
Frequently asked questions
Isn’t security the hosting provider’s job?
Partly. The host secures the server. Nobody but you can secure your passwords and decide who has access.
Which 2FA method should I use?
An authenticator app is the best balance of security and convenience. SMS is better than nothing but weaker.
Do I need a security plugin if my host has a firewall?
Usually not for scanning or firewalling, since that runs at the server level. A small plugin to add 2FA to the WordPress login is still worth it.
Want hosting where the server side is handled for you? Get started with UNITY.