Secure WordPress hosting with clear operating controls
Secure WordPress hosting from NowHosted combines an isolated container per site, a WAF, malware scanning, automatic SSL, and backups with restore. Agency and Scale add team roles, while Scale includes SAML SSO and an audit log. Buyers can request a DPA by email and review how we detect, contain, communicate, and report incidents.
Security overview
studio.example.com- Container isolation
- Isolated
- Per site
- WAF blocked requests
- 128
- Today
- Malware scan
- Clear
- Daily scan
- SSL expiry
- 87 days
- Automatic renewal
- Backups
- Complete
- Daily · off-site
- Account roles
- Assigned
- Scale
01
Give each site its own boundary
Each site runs in an isolated container. This gives the hosted site its own operating boundary within the managed service. A WAF and malware scan add protection around the application, while automatic SSL protects connections to the site. These controls work together as part of everyday hosting operation.
Your application still needs appropriate permissions and responsible code choices. Keep an owner for themes, plugins, and custom code, and review who can change them. Our managed hosting page explains the service boundary so that hosting controls and application responsibilities remain clear to both teams.
- Isolated container per site.
- WAF and malware scanning.
- Automatic SSL for encrypted connections.
- Managed hosting maintenance and recovery tools.
Security review starts with understanding what a control does and who operates it. Use this page to assess the hosting layer alongside the controls your own team applies to its application, content, and accounts. No single hosting feature replaces that wider review.
Site boundary
- 01
HTTPS
Encrypted connection
- 02
WAF
Request filtering
- 03
Isolated container
studio.example.com
- 04
Malware scan
Daily
02
Keep recovery separate from the running site
Daily off-site backups provide recovery points outside the live site. One-click restore gives your team a direct recovery action when a change needs reversing. Review which point you intend to restore and what has happened since then, especially for a site that receives orders, account changes, or form submissions.
| Plan | Daily backup retention | Additional recovery feature |
|---|---|---|
| Business | Daily backup retention14 days | Additional recovery featureOne-click restore |
| Agency | Daily backup retention30 days | Additional recovery featureOne-click restore |
| Scale | Daily backup retention90 days | Additional recovery featureHourly backups for WooCommerce |
You can export a full backup at any time. Our WordPress hosting platform page describes backups alongside staging and deployment tools. Recovery planning should include the people who understand the current business data, so a restore decision accounts for both the technical change and the work completed since the backup.
03
Match access to the work people do
Agency and Scale include owner, developer, billing, and client roles. Assign roles according to the work a person needs to carry out. Review access when responsibilities change, including when a developer finishes a project or a client relationship changes. Clear roles make account access easier to understand during routine work and an incident review.
Scale adds SAML SSO and an audit log. SSO connects hosting account access with your organization's sign-in process. The audit log supports review of account activity. These are hosting account controls, distinct from permissions that you set inside WordPress or another hosted application.
For agencies managing client access, our agency hosting page explains the client portal and team tools. Keep ownership clear across the hosting account and the application so there is a known decision maker when access needs to change.
Account access
ScaleOwner
Role assigned
Developer
Role assigned
Billing
Role assigned
Client
Role assigned
Audit log
- Owner
- Role assigned
- Developer
- SSO sign-in
- Billing
- Account review
04
Get the documents your review needs
A DPA is signed on request. Email [email protected] to request it for your review. Use the same address for questions about the hosting controls described here. Email is the contact route for these requests, so there is no separate contact form to complete.
Scale includes a security questionnaire pack for buyers who need a structured hosting review. Use it alongside your application requirements and internal policies. If a question concerns a particular hosting control, identify that control and the account requirements in your email so the discussion stays tied to the service you need.
Server regions are North America, Europe, and Asia-Pacific, with the region chosen per site. Consider region selection together with your own data handling obligations. The cloud hosting page explains this choice as part of the managed platform, and the plan comparison shows which account controls each subscription includes.
05
Detect, contain, notify, and report
Our incident process follows detection, containment, email notification, and reporting. Uptime monitoring checks sites every minute, and malware scanning forms part of the hosting controls. Detection starts the response process; the next action is to contain the incident affecting the hosted service.
We notify you by email and provide a report. Keep the account email current and make sure the people responsible for the site know how to review incident communications. Your team supplies application context and makes decisions about its own users, content, and connected business systems.
-
Detect the incident affecting the hosted service.
-
Contain its effect within the hosting environment.
-
Notify you by email.
-
Provide a report on the incident.
A useful response depends on clear ownership as well as technical controls. Identify the people who can review site behavior, approve application changes, and assess the effect on business data. Those responsibilities belong in your internal process alongside the hosting incident process described here.
Select the plan that fits your review
Business includes container isolation, WAF, malware scanning, SSL, and daily backups. Agency adds team roles and longer backup retention. Scale adds SAML SSO, an audit log, the security questionnaire pack, and dedicated resources. Compare these controls against what your organization needs to operate the site and review its hosting.
Every plan includes uptime monitoring every minute. Scale adds a named on-call contact and 24/7 priority support with a 15-minute first response. All plans include free migration with zero downtime, using a staging copy and your review before the live DNS cutover.
Read the website migration process to see how access and review work during a move. If you want a first look at your current public site, the one-time hosting audit reads it without changes or a card and reports findings that include TLS certificate expiry and security headers.
FAQ
-
Yes. Business, Agency, and Scale include an isolated container per site, a WAF, malware scanning, automatic SSL, and daily backups with one-click restore.
-
Agency and Scale include owner, developer, billing, and client roles. SAML SSO and the audit log are included on Scale.
-
Email [email protected] to request a signed DPA. The security questionnaire pack is included on Scale and supports your review of hosting controls.
-
We detect and contain the incident, notify you by email, and provide a report. Keep your account email current so the people responsible for the site can review those communications.