# Security, logs and isolation on Linux hosting > See what protects your HyperDC Linux hosting: an isolated account, Web Shield and the firewall, malware scans, and your site's statistics, logs and activity. Difficulty: Beginner Your Linux hosting account shares a server with other customers, but nothing else on that server can see or slow down your sites. This guide explains what keeps your account apart and protected, and where your service page shows what happens on your sites. ## What keeps your account apart - **Its own system user.** Your files belong to your account's own user on the server. Other accounts cannot list, read or change them. - **Its own PHP processes.** Your sites run PHP in processes of your own, never shared with another customer. - **Its own limits.** Your account has its own processor, memory and disk speed limits. One site's load, attack or error never affects another; **Resource Usage** on your service page shows your use against them. - **Databases on the server only.** MariaDB and PostgreSQL accept connections only from the server itself, each database with its own login. - **Files over HTTPS only.** Files go through **File Manager** and **Disk Access**, both over HTTPS. ## How the server stays fast and up to date Your sites run on NVMe storage, and we run and maintain the server for you. Security updates are applied automatically, so there is nothing for you to install. Every site answers over modern encrypted connections; see [free SSL on Linux hosting](/guides/linux-hosting-ssl). ## How attacks are held back - **The firewall** holds back unwanted traffic before it reaches your sites and keeps them answering during an attack. - **Web Shield** checks incoming requests and blocks common web attacks before they reach your site, such as database attacks (SQL injection), script injection and attempts to read server files. - **Attack Protection** runs by itself. During an attack, protection is tightened by itself and goes back to normal by itself when it is calm. - **Behind Cloudflare**, the protection reads the visitor's real address from Cloudflare, so it limits the attacker and not Cloudflare. See [put Cloudflare in front of your website](/guides/cloudflare-proxy-setup). ## Set the protection of a site Open **Security** and choose the site at the top. Every setting in this tab is per site. **Attack Protection** shows whether the site is under attack. Its cards show: - **Blocked in the last 24 hours**: the refused requests and how many addresses they came from. - **Limit per address**: how many requests one address may send a second, and how many at once. - **Behind Cloudflare**: whether the site is behind Cloudflare. If you connect Cloudflare in the **DNS** tab, Cloudflare's Under Attack mode is switched on by itself during an attack. For that, the Cloudflare token also needs the **Zone Settings Edit** permission; see [DNS and Cloudflare on Linux hosting](/guides/linux-hosting-cloudflare-dns). Under **Web Shield**: - **Protection level**: **Standard** is the default. **Strict** blocks more, and may also block unusual but legitimate requests. **Off** stops filtering attacks on the site, so you are asked to confirm it. - **Rate limit (requests per second per address)**: `0` uses the server default. - **WordPress protection: login page and XML-RPC**: guards the WordPress login page and XML-RPC against password guessing. - **Do not run scripts in upload folders**: scripts in upload folders, such as `wp-content/uploads`, are not run, so a script someone slips in there cannot do harm. Select **Save Protection**. **Address rules** allow or deny one address or a range. Select **Add Rule**, enter the **Address or range**, such as `203.0.113.0/24`, and choose **Allow** or **Deny**. Select **Save Rules**. **Attack events** lists the refused requests with the **Time**, the **Address**, **What happened**, the **Request** and the **Result**, such as **Blocked**, **Slowed down** or **Address banned for a while**. **Newer** and **Older** page through the list. ## Scan your files for malware 1. In **Security**, select **Start Scan** under **Malware scan**. 2. Wait until the scan finishes. Your hosting account's files are checked, so it can take a while. 3. Read the list. **Nothing found** means the scan found no threat. Each finding shows the **Time**, the **File** in your account, the **Threat** and the **Action**, what was done with the file. If something is found, see [clean a hacked website](/guides/clean-hacked-website). ## See your traffic Open **Statistics** on your service page to see your site's traffic by day. ## Read your logs 1. Open **Logs** and choose the **Website**. 2. Select **Access** and how many lines you want: 100, 200, 500 or 1000. 3. Select **Refresh** to see the latest requests. The newest lines are at the bottom. This is the place to check whether a request reached your site and what status it got. **Errors** shows the requests that ended with an error, and **PHP** the PHP error log of the site: PHP errors are never shown to visitors, they go there. ## See what changed **Activity** lists what was done on your hosting account: the **Time**, the **Action** with what it was done to, the **User** and the **Address** it came from. Check it when something changed that you did not expect. ## What you can do - Keep your applications, themes and plugins updated, and remove the ones you do not use. - Use a long, unique password for your client area and for every disk account. - Give someone a **Disk Access** account limited to the folder they work on, instead of your main password; see [upload files on Linux hosting](/guides/linux-hosting-disk-access). - Keep **Force HTTPS** on, and turn on **HSTS** once every page works over HTTPS. ## Next steps - Start here: [first steps on Linux hosting](/guides/linux-hosting-first-steps). - A site that was broken into: [clean a hacked website](/guides/clean-hacked-website). ## Frequently asked questions ### Can another customer's site slow mine down? No. Every account has its own processor, memory and disk limits, so one site's load, attack or error never affects another. ### Do I have to install server updates? No. We keep the server up to date and apply security updates automatically. Keeping your own applications, themes and plugins updated stays with you. ### Do I have to turn Web Shield on? No. It protects your sites at its default level, and attack protection runs by itself; there is nothing to set. ### How do I check my files for malware? Open Security and select Start Scan under Malware scan. Each finding is listed with the file, the threat and what was done with it. ### Does the attack protection work with Cloudflare? Yes. It reads the visitor's real address behind Cloudflare's proxy, so it limits the attacker and not Cloudflare. ### A normal page of mine is refused. What now? Send us the time and the address of the request in a ticket, and we look at it with you. --- Source: \ Updated: 2026-11-07