Security articles

Security 510 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and...
Security 537 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is...
Security 887 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http://...
Security 490 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously...
Security 393 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through...
Security 440 How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically - see what an SSL certificate is. This page is only...
Security 362 Why your IP gets blocked by the firewall (and how to avoid it) The server firewall counts failed attempts and, after a few, cuts off that address. It is not punishment or...
Security 295 How to find your public IP address (and why we ask for it) When support asks for "your IP", we mean the address your connection presents to the internet. That is what the...
Security 295 Your server IP on a blocklist: how to tell and how to get off A blocklist - the older name is blacklist - is a public register of IP addresses caught sending spam. Mail servers...
Security 289 Personal data protection: what applies to your website If your site has a contact form, a newsletter, a client area or a shop, you are processing personal data. This...
Security 294 I bought an SSL certificate and it has not activated: domain validation You bought an SSL certificate, you paid, and the padlock still has not appeared. It is the most frequent question we...
Security 290 How to tell whether an e-mail really came from us A fake message pretending to be your hosting provider is the most common attack against accounts like yours - and...
Security 256 Selling online: PCI, card data and what shared hosting is not Anyone setting up a shop eventually arrives at this question, often because a bank or a corporate customer asked it...
Security 320 What we do about security, DDoS included, and what stays yours This question deserves names and specifics, not marketing. Below is what runs on our servers, what it actually...
Security 302 The cookie notice and consent: what your site collects without you knowing That bar appearing on nearly every site asking you to accept cookies is neither decoration nor a European fashion....
Security 240 Reporting abuse: how to do it and what happens next If you have found something illegal or abusive on a site, an e-mail or a file that we host, there is a form built...
Security 299 No padlock on your site: the causes, in order The browser shows a warning, or the padlock is simply not there. There are five causes, and they are worth checking...
Security 305 Locked out: password, two-step authentication and the recovery e-mail «I lost my password» is really three different questions, and the first thing to do is work out which one is yours....
Security 270 Moving your site to https with Really Simple SSL Read this before installing anything: the certificate is already ours and already there. Domains hosted with us get...
Security 262 Removing the red Google warning from your site It is the red screen covering the whole site, with a line like «the site ahead contains malware» or «deceptive site...
Security 285 Blocking an IP address from visiting your site First, make sure this is the right article. This one is about you barring a visitor from your site. If your problem...
Security 270 CAA records: who may issue certificates for your domain By default, any certificate authority in the world may issue a certificate for your domain, as long as it can prove...
Security 181 Authenticator app, SMS or security key: which two-step verification to use The short answer: make an authenticator app on your phone your default. It is far safer than SMS, does not depend on...
Security 173 A strong password and a password manager: how to stop reusing the same one The short answer: a strong password is long, unique and has nothing to do with you. Nobody memorises dozens of them,...
Security 186 How to recognise a phishing e-mail or message, and what to do if you clicked The short answer: phishing is a message pretending to come from someone you trust (Interweb, your bank, a supplier,...
Security 164 Ransomware explained: how it reaches a website or a computer and how to be ready The short answer: ransomware is malicious software that encrypts your files and demands a ransom to give them back....
Security 179 After a hack, which backup do you restore? Choosing a clean copy The short answer: restore the last copy from before the infection, not the most recent one. If you restore...
Security 247 An abandoned plugin or an old PHP version: how to spot the risks on your site The short answer: most hacked sites were not caught by a clever attack, but by an old part with a known flaw: a...
Security 176 File permissions explained: what 755, 644 and 777 mean The short answer: on an ordinary hosting account, folders should be 755 and files 644. Files holding secrets, such...
Security 188 ModSecurity and web application firewalls: what they do, and what to do when one blocks you The short answer: a web application firewall (WAF) reads every request reaching your site and refuses the ones...
Security 182 DDoS attack or just a traffic spike: how to tell, and what to do The short answer: a DDoS (distributed denial of service) attack is a flood of fake requests, from many addresses at...
Security 190 HSTS explained: forcing https for good, and the trap of switching it on too early The short answer: HSTS is an instruction your site gives the browser: “from now on, talk to me only over https, for...
Security 226 Security headers explained: what they do and how to add them in .htaccess The short answer: security headers are small instructions your site sends the browser with every page (“do not let...
Security 194 The scan says clean but the site still redirects: where an infection hides The short answer: a scan only sees what it knows how to recognise. A modern infection hides outside the files you...
Security 172 SSH on your hosting account: keys instead of passwords, and staying safe The short answer: SSH gives you a command line on your account, and it is as powerful as it is dangerous if the...
Security 189 DV, OV and EV certificates: which kind of SSL certificate you really need The short answer: for almost every site, a DV (domain validation) certificate is enough, and it is the free one that...
Security 213 The free SSL certificate did not renew: why AutoSSL fails and what to check The short answer: the free certificate that comes with the account (AutoSSL, from Let’s Encrypt) is issued and...
Security 196 Someone is sending e-mail in the name of your domain: what SPF, DKIM and DMARC do about it The short answer: sending an e-mail that looks as if it comes from someone@asuaempresa.co.mz is trivial: the sender...
Security 187 A website form that is safe and spam-free: honeypot, captcha and validation The short answer: a form is a door that anyone, and any robot, can try. To keep it spam-free, add a trap field (a...
Security 215 Your e-mail account has been hacked: what to do in the first hour The short answer: change the password from a clean device, end the open sessions, look for and delete the forwards...
Security 174 Wildcard SSL: one certificate for every subdomain, and when you do not need it The short answer: a wildcard certificate (with an asterisk) covers every subdomain one level down, such as...
Security 226 Scanning your site for malware in cPanel: what Imunify finds and what to do with the result The short answer: cPanel has a tool called Imunify360, in the Security group, that scans your account’s files for...
Security 168 SQL injection and XSS in plain words: what to ask your developer The short answer: SQL injection and XSS are two of the oldest attacks on websites, and they still work because they...
Security 257 A security.txt file: telling researchers how to report a problem The short answer: security.txt is a small text file, in an agreed place on your site, that tells whoever discovers a...
Security 198 Checking your site’s HTTPS setup: certificate, chain, expiry and protocols The short answer: the browser’s padlock does not tell the whole story. A site can show the padlock on your computer...
Security 255 Files that must never be public: .git folders, .env, backups and database dumps The short answer: everything in the site folder can be requested by anyone who guesses the file name. Git folders,...
Security 161 Content Security Policy: a first policy, tried out in report-only mode The short answer: Content Security Policy (CSP) is a header that tells the browser where the site may load scripts,...
Security 171 Forgotten subdomains and DNS records that point nowhere: how they get hijacked The short answer: when you stop using a service but forget the DNS record that pointed to it (a CNAME to a shop, a...
Security 171 An abuse notice about your server: what it means, the deadline and what we need from you The short answer: our network provider watches the traffic. When it sees an attack coming from one of our servers,...
Security 171 Writing the reply to an abuse notice: cause, what you removed and how it will not happen again The short answer: the report we ask for after an abuse notice has three parts: the cause and how it got in, what you...
Security 195 Why your server was switched off or locked after an abuse notice, and how to bring it back The short answer: after an abuse notice, you first investigate with the server still on; if by the deadline the...
Security 157 Is my VPS compromised? Checking processes, cron jobs, users, SSH keys and temporary folders The short answer: this article is for VPS and dedicated server customers with root access. After an abuse notice, or...
Security 153 Your VPS is scanning other networks: finding and stopping the process behind a netscan notice The short answer: a netscan notice means your server opened, within minutes, connections to many addresses in a...
Security 155 Redis open to the internet: close it with bind, protected mode, a password and the firewall For VPS and dedicated server customers with root access. The short answer: Redis is built to talk only to trusted...
Security 170 An open DNS resolver on your VPS: why it is used in attacks and how to turn off recursion For VPS and dedicated server customers with root access. The short answer: an open DNS resolver answers questions...
Security 178 CLDAP, Portmapper and other open UDP services: reflection attacks and how to close them For VPS and dedicated server customers with root access. The short answer: some services that speak UDP answer a...
Security 168 MySQL, MariaDB or PostgreSQL open to the internet: closing the port without breaking apps For VPS and dedicated server customers with root access. The short answer: a database that answers the internet...
Security 204 A security report about a vulnerable n8n or web app: update first, then reduce exposure For VPS and dedicated server customers with root access. The short answer: the report says an application on your...
Security 168 Phishing pages found on your site or server: remove them, find the way in and avoid a block The short answer: a phishing page pretends to be a bank, a delivery company or a well-known service to steal...
Security 187 Your server IP on a spam blacklist: finding the source and getting off Spamhaus or SpamCop This article is for customers with a VPS or a dedicated server, with root access. If you have a hosting plan, start...
Security 196 Botnet or command-and-control activity from your server: cutting it off and cleaning up This article is for customers with a VPS or a dedicated server, with root access. The short answer: a botnet is a...
Security 146 A DDoS attack coming from your server: finding the outgoing flood and stopping it This article is for customers with a VPS or a dedicated server, with root access. The short answer: the notice says...
Security 146 A fraud complaint about a site on your account: what happens next and what to send us The short answer: a fraud complaint says a site on your account deceives people: a fake cryptocurrency investment...
Security 201 Critical PHP vulnerabilities of October 2026 (CVE-2026-109618 and CVE-2026-109619): what we did and what you should do The short answer: on 21/10/2026 two critical vulnerabilities were published in PHP, the language WordPress and most...