At DanumHost we want to make sure your hosting and account data is as secure as possible. This is why we make sure that the following is under "lock and key";
Access Restriction
We limit our access to our servers but also making sure you also get the access required to have a website where you can access, create and edit your website with very little restrictions as safely and securely as possible. Only our Server Admin have full access to our servers who make sure everything is running as smoothly as possible.
SSH (Secure Socket Shell and its equivalent) is only accessible by our server admin unless you have a VPS or Dedicated server then you would have full access to this. As an added precaution we use RSA keys just as an added layer of protection.
We never use the ROOT password on any of our servers or services as this helps improve the security as this is a common username Linux uses as a full access username and hackers are known to try.
Network Monitoring
We monitor our network constantly to make sure there are no intrusions or unauthorised activity. This helps us keep on top of things just in case on the rare occasion it does happen then we can act on it and keep your account safe before unauthorised access is gained to your account.
We also check on our users WordPress websites and highlight vulnerable points like out of date plugins, themes and core files and make them aware of the issues. We also give them a more detailed report of where they can go a step further to improve their own security of their site to make sure the WordPress back doors are covered too.
SSL and Firewall
SSL (Secure Sockets Layer) encryption ensures that sensitive data flowing through a website is kept secure and private which is why we provide a free SSL certificate to get you started. From adding your domain name or sub-domain name our servers will detect it and install your certificate within 15 minutes of it being added automatically and then renewed as and when its needed all included in the price of your hosting.
Even though it secures then communication between your websites and your many users it does not secure your site or our servers against a cyber attack although it does slow the attacker down as they have the extra layer of protection to get through.
A WAF (Web Application Firewall) is required to monitor web HTTP traffic flowing through web applications. Unlike a regular Firewall, a Web Application Firewall provides more specific security because it understands the specific requirements of a web application. With some configuration, it can prevent SQL (database) injections, cross-site scripting, vulnerability probing and many more techniques used to gain access.
DDoS Prevention
A DDoS (Distributed Denial of Service) attack is a simple yet effective cyber attack that can plague popular websites. They do this by flooding the servers with dummy traffic hoping to make the server unresponsive which then prevent real traffic like yourself from accessing the website. We do this by limiting how many connections can access a users account/domain at any point from a single IP address per connection type. At this point it then rejects additional connections until one of the older connection has not been used for 10 seconds. This is something else we monitor daily to see how many times a connection is blocked and for what reason.
A DDoS is very hard to handle once its already being done on a web server. We always have a plan in place and take precautions daily to make sure as are ready just in case any of our security measures are breached although we make sure if it is its well deserved as we like to put up a fight when attacking our severs and your websites as we see our servers and your content as our children so we will make sure our defences are as strong as they ever can be and always looking for ways to make them stronger.
Malware Detection and Removal
We scan all of our servers daily for malware and virus's. Should any be found on our servers we will notify our clients of the location and the type of infection to which we will give them 48 hours to remove. We do provide managed hosting where we would notify the account holder of the infection and also remove this for them as part of the managed hosting package.
If you have an infection with a WordPress installation within your account then we will also make sure all of the WordPress software is up-to-date to help prevent of the infection occurring in the first place.
We also allow all hosting customers to run the scan from within their account whenever they feel they need too by searching VIRUS in cPanel.
Passwords and User Access
To help with the access and security we will never allow a customer to choose their cPanel password or will be sent out by us although we will send out the information again they received in their welcome email which will contain this information. We will never change the cPanel password unless our customer asks us to and then it will never be to an exact match to the customer request and well be a mix of characters including numbers.
To our website the user will be able to choose their own password although there will be rules the password has to abide to.
In the even of a suspected attack all passwords should be changed.
Username should not be common like [email protected] and be more unique like your personal email address for example [email protected] or [email protected].
We never store any payment information on your account other than if an invoice is paid or not, invoice information and your default payment type like PayPal.
WordPress and Managed Hosting Plans
As part of our checks we make sure that all of our members WordPress websites are working to their best ability. By doing this we will notify them of any potential updates to plugins, themes and core files. We will also let them know about any unused plugins and themes which even though are not active can also be used to hack into their website as they are still there and not normally up-to-date.
We recommend only using plugins for your WordPress website that is actually being used as this then reduces the chances of an attacker breaching your own website security and stealing data from there.
Backups
We recommend making regular backups for your websites to make sure you have a working copy at hand just in case the worst happens. Although we take daily backups of all account data having your own backup makes it much more quickly for you to restore your website should it need doing as a high priority. We recommend encrypting backups just to add another layer or protection and piece of mind. on your first backup you do that has encryption we do recommend testing it to make sure the encryption worked as intended.
Always make sure you have a clean installation backed up just so you know you have a clean install for when ever its required and to prevent restore times should everything be lost.
We will never charge clients for a full account restore although depending on account size this can take between 5 minutes and several hours to restore depending on the data to be transferred from our off site backup servers.
We store all of our backups off site to add another layer of protection and to make sure they are just as secure as our other servers. Should any one of our servers get attacked in any way we can assure all of our customers that only that server will be affected and cured as soon as it possibly can be with the infection/attack removed without affecting other services or servers.
Saturday, January 23, 2021
