What to look for in secure hosting

Your hosting is the ground your membership site stands on. It stores your member database, serves your lessons and runs your login page. If the server underneath is poorly maintained, shared carelessly with other customers or impossible to restore after a failure, nothing you do inside your site can fully make up for it.

The difficulty is that hosting security is hard to judge from a sales page. Every host says it is secure. The way to tell them apart is to ask specific questions and notice how clearly they answer. Below are those questions, the kind of answers to hope for and the warning signs that should send you elsewhere.

First, understand what you are buying

Hosting comes in several broad forms, and each divides the security work differently between you and the provider:

• Shared hosting: your site sits on a server with many other customers’ sites. It is inexpensive, but the separation between accounts matters a great deal.
• Managed hosting: the host looks after server software, updates, backups and often security monitoring, usually for a particular kind of website.
• Virtual or dedicated servers: you get your own server environment and, usually, far more responsibility for keeping it secure.
• Fully hosted membership software: the platform provider runs the hosting as part of the service, so your choice is about the provider rather than the server.

Whichever you are considering, the key question is who is responsible for what, the same thinking behind keeping your platform and add-ons up to date. If you are choosing a fully hosted platform, many of the questions below belong alongside the questions to ask before you choose a membership platform.

Questions about the server and the network

1. Who applies security updates to the operating system and server software, and how quickly? Hope for a clear answer and a commitment to apply urgent patches promptly.
2. How are customers kept separate on shared servers? A good host can explain how one compromised site is prevented from reaching others.
3. Is there a firewall and malware scanning, and what happens when something is found? Ask whether they tell you, clean it up or simply suspend your site.
4. How do you handle floods of traffic designed to knock sites offline? These are called denial-of-service attacks. Many hosts include some protection; ask what it covers.
5. Are secure connection certificates included and renewed automatically? Every page of a membership site should load over HTTPS, and a certificate that expires unnoticed breaks logins and checkout.

Questions about your account and access

1. Does the control panel support two-factor authentication? This should be a firm yes.
2. Can I add team members with their own logins and limited permissions? You do not want to share one master password with your developer.
3. Can I see access and change records? Knowing who logged in and what changed is invaluable during an investigation, as described in activity logs: knowing who changed what.
4. How does your support team verify it is really me? A host that will reset your password for anyone who phones with your name is a risk to you.
5. Are older, insecure ways of connecting, such as unencrypted file transfer, switched off?

Questions about backups, incidents and leaving

1. What is backed up, how often, for how long, and are copies stored away from the main server?
2. How do I restore, and how long does it usually take? Ask whether you can restore yourself or must request it.
3. If you have a security incident affecting my data, how and when will you tell me?
4. Where are the servers and backups physically located? This can matter for data protection rules, which vary by country, so check with a qualified professional if you are unsure what applies to you.
5. What is your uptime commitment? Some hosts offer a service level agreement, a written promise about availability with credits if they miss it. Read what counts as downtime.
6. If I leave, how do I get a complete copy of my site and data?

Red flags worth walking away from

• Vague answers such as “we use military-grade security” with no specifics.
• No two-factor authentication on the control panel.
• Support that emails you your password or can read it back to you.
• Backups stored only on the same server as your site, or available only for an extra fee after something goes wrong.
• No clear process for telling customers about incidents.
• Very old server software versions visible in your account.
• Prices that look far too low for the level of service promised.

A worked example: scoring two hosts

Mireille runs a hypothetical continuing education membership for veterinary nurses and is outgrowing her budget hosting. She shortlists two hosts and sends each the same short email:

Hello, I run a membership site with a few thousand paying members, logins and a member database. Before I sign up, could you tell me: who applies server security updates and how quickly; whether your control panel supports two-factor authentication and separate team logins; what you back up, how often and where; how I would restore; how you would notify me of an incident affecting my data; and how I would take a full copy of my site if I left? Thank you.

She scores each answer from zero to two: zero for no answer or a vague one, one for a partial answer, two for a clear, specific commitment. The first host replies the same day with specifics on every point and links to its documentation. The second sends a paragraph of marketing language that never mentions backups or incident notification. Its lower price no longer looks like a saving, and the choice makes itself.

Your next steps

1. Confirm what kind of hosting you have now and who is responsible for each part of its security.
2. Send your current host the questions above and see how they answer.
3. Switch on two-factor authentication and separate team logins in your hosting account.
4. Check that your certificate renews automatically and every page loads securely.
5. If you are choosing a new host, send each candidate the same email and score the replies.