Security, logs and isolation on Linux hosting

Your Linux hosting account shares a server with other customers, but nothing else on that server can see or slow down your sites. This guide explains what keeps your account apart and protected, and where your service page shows what happens on your sites.

What keeps your account apart

• Its own system user. Your files belong to your account's own user on the server. Other accounts cannot list, read or change them.
• Its own PHP processes. Your sites run PHP in processes of your own, never shared with another customer.
• Its own limits. Your account has its own processor, memory and disk speed limits. One site's load, attack or error never affects another; Resource Usage on your service page shows your use against them.
• Databases on the server only. MariaDB and PostgreSQL accept connections only from the server itself, each database with its own login.
• Files over HTTPS only. Files go through File Manager and Disk Access, both over HTTPS.

How the server stays fast and up to date

Your sites run on NVMe storage, and we run and maintain the server for you. Security updates are applied automatically, so there is nothing for you to install.

Every site answers over modern encrypted connections; see free SSL on Linux hosting.

How attacks are held back

• The firewall holds back unwanted traffic before it reaches your sites and keeps them answering during an attack.
• Web Shield checks incoming requests and blocks common web attacks before they reach your site, such as database attacks (SQL injection), script injection and attempts to read server files.
• Attack Protection runs by itself. During an attack, protection is tightened by itself and goes back to normal by itself when it is calm.
• Behind Cloudflare, the protection reads the visitor's real address from Cloudflare, so it limits the attacker and not Cloudflare. See put Cloudflare in front of your website.

Set the protection of a site

Open Security and choose the site at the top. Every setting in this tab is per site.

Attack Protection shows whether the site is under attack. Its cards show:

• Blocked in the last 24 hours: the refused requests and how many addresses they came from.
• Limit per address: how many requests one address may send a second, and how many at once.
• Behind Cloudflare: whether the site is behind Cloudflare. If you connect Cloudflare in the DNS tab, Cloudflare's Under Attack mode is switched on by itself during an attack. For that, the Cloudflare token also needs the Zone Settings Edit permission; see DNS and Cloudflare on Linux hosting.

Under Web Shield:

• Protection level: Standard is the default. Strict blocks more, and may also block unusual but legitimate requests. Off stops filtering attacks on the site, so you are asked to confirm it.
• Rate limit (requests per second per address): 0 uses the server default.
• WordPress protection: login page and XML-RPC: guards the WordPress login page and XML-RPC against password guessing.
• Do not run scripts in upload folders: scripts in upload folders, such as wp-content/uploads, are not run, so a script someone slips in there cannot do harm.

Select Save Protection.

Address rules allow or deny one address or a range. Select Add Rule, enter the Address or range, such as 203.0.113.0/24, and choose Allow or Deny. Select Save Rules.

Attack events lists the refused requests with the Time, the Address, What happened, the Request and the Result, such as Blocked, Slowed down or Address banned for a while. Newer and Older page through the list.

Scan your files for malware

1. In Security, select Start Scan under Malware scan.
2. Wait until the scan finishes. Your hosting account's files are checked, so it can take a while.
3. Read the list. Nothing found means the scan found no threat. Each finding shows the Time, the File in your account, the Threat and the Action, what was done with the file.

If something is found, see clean a hacked website.

See your traffic

Open Statistics on your service page to see your site's traffic by day.

Read your logs

1. Open Logs and choose the Website.
2. Select Access and how many lines you want: 100, 200, 500 or 1000.
3. Select Refresh to see the latest requests.

The newest lines are at the bottom. This is the place to check whether a request reached your site and what status it got. Errors shows the requests that ended with an error, and PHP the PHP error log of the site: PHP errors are never shown to visitors, they go there.

See what changed

Activity lists what was done on your hosting account: the Time, the Action with what it was done to, the User and the Address it came from. Check it when something changed that you did not expect.

What you can do

• Keep your applications, themes and plugins updated, and remove the ones you do not use.
• Use a long, unique password for your client area and for every disk account.
• Give someone a Disk Access account limited to the folder they work on, instead of your main password; see upload files on Linux hosting.
• Keep Force HTTPS on, and turn on HSTS once every page works over HTTPS.

Next steps

• Start here: first steps on Linux hosting.
• A site that was broken into: clean a hacked website.