Our Web Hosting environment combines hosting-level protections with account tools that help you manage your own website's security. Depending on the enabled features, these can include SSL, a web application firewall, IP controls, protected directories, spam controls and access management. Malware-related tools and additional protections should be checked for the particular service. Security also depends on the application code, extensions, passwords and access you maintain inside the account.
IN THIS ARTICLE
01 Maintain application and account security
For routine prevention, keep supported software updated, remove unused applications and logins, use strong unique credentials and maintain usable backups. Give collaborators only the access they need. Protect administrative areas and avoid exposing configuration files or backup archives through public website folders. HTTPS is essential for protecting connections, but it does not by itself stop vulnerable application code from being exploited.
02 Investigate a suspected compromise and close the entry point
- If you suspect a compromise, note the affected domain, visible symptoms and when the problem began.
- Contact us through your client account and preserve relevant logs and evidence before deleting files.
A targeted investigation should identify what changed, how the attacker gained access and whether other sites or credentials within the account are affected. Where appropriate, isolate the affected application, restore a verified clean copy, patch the entry point and rotate exposed credentials.
Simply removing one suspicious file or restoring an old backup may leave the cause unresolved. Check administrator accounts, scheduled tasks and application updates as part of recovery. If a firewall appears to block a legitimate request, provide the exact request and timing so that the rule can be investigated. Avoid disabling protection across the whole site as a permanent shortcut. We can assist with investigation and supported corrective actions, but no hosting feature can guarantee that a website will never be compromised or that every incident can be repaired without further work.
What should I preserve before removing suspected malware?
Keep the incident timeline, affected URLs, relevant access and error logs, and the security tool's findings. Agree with our team whether an isolated copy of affected files is needed for investigation. Keep an incident copy labelled and separate from the known-good recovery backup so it is not accidentally used to restore the website.
- Record the visible symptom, affected domain and time, and stop unrelated changes while the scope is being assessed.
- Review application users, recent modifications, scheduled tasks and the relevant security finding with our team.
- After cleanup or restoration, close the entry point, rotate exposed credentials and test the application again.
A clean-looking homepage is not sufficient evidence that the account is safe. Another compromised website, an unexpected administrator or a vulnerable extension can reintroduce the problem. Treat a security tool result as one part of the investigation and keep the known-good backup separate from a captured incident copy.