If you’re trying to find a hosting company, there’s no shortage of choices. The most obvious factors to consider are speed, reliability, and price. Another factor that shouldn’t be overlooked, however, is security.
Almost all hosts provide basic security features. But the availability of more advanced features varies widely. And this is a problem because if your website is ever hacked, it’s those advanced features that might decide whether your website remains online or not.
Why Is Security Important in Hosting?
If a website is online, it’s a potential target for hackers. The most talked about hacks are those that affect the big names. However, smaller websites are just as likely to encounter problems.
If you want to protect your website, there’s a lot of things that you can do yourself. But there are also actions that need to happen at the server level. This is the job of your hosting company. If they’re not doing their part, your attempts to protect your website will largely be irrelevant.
What Security Features Should Your Hosting Company Have?
If you want to choose a web host that takes security seriously, here are the features that you should look for.
1. DDOS Protection
A DDOS attack is when a large amount of traffic is sent to a website with the purpose of taking it offline. Without protection, a DDOS attack can take a website offline within seconds.
The best way to protect against a DDOS attack is to use a Content Delivery Network (CDN). This protects against DDOS attacks by providing additional server resources as they are needed. Many also include a firewall which can reject traffic that’s considered malicious.
It’s worth noting that it is possible to purchase a CDN seperately but many hosting companies include it in the price.
2. RAID
Redundant Array Inexpensive Drives (RAID) is a data storage technique that saves data across multiple hard drives.
RAID can be used to boost website performance, but if anything ever happens to your website, its primary benefit is that it allows data to be restored.
If the server hosting your website goes down, your data will remain intact because there’s already another copy of it on another drive.
3. Network Monitoring
Network monitoring is the process of watching a network and solving problems as they happen. Small problems are to be expected on a regular basis. And if a hosting company doesn’t have somebody in this role, it’s possible that one of them will get bigger and eventually take down your website.
For example, if there’s an intruder on your server, it’s often the responsibility of the person monitoring the network to kick them off. Avoid any host that doesn’t hire dedicated staff for this purpose.
4. Adequate Isolation on Shared Hosting
Shared hosting is when multiple websites share the same server. Shared hosting is popular because it’s cheaper and depending on the size of your website, it may offer identical performance.
Shared hosting isn’t automatically a security risk but it does introduce a potential problem that needs to be mitigated.
If the websites on a shared server aren’t adequately isolated, it’s possible that a security issue on one website can spread to all the others. On a particularly poor configuration, it’s even possible for the owner of one website to gain access to everybody else’s files.
Naturally, this is something that hackers are aware of. Some hackers will even sign up to a hosting company specifically to take advantage of it.
If you opt for shared hosting, it’s therefore important to check what isolation techniques are employed. At the very least, each site should have its own directory and its own FTP account.
5. Manual Reboots on Dedicated Hosting
Sometimes the easiest way to fix a computer is to turn it off and on again. Sometimes the same logic applies to servers. If you opt for a dedicated server or VPS, it should be possible for you to do this yourself. This is known as a manual reboot.
If something goes wrong with your server and this functionality isn’t available, you’ll have no choice but to contact support and wait for them to do it. Obviously, this can be problematic if your site is down while you wait.
6. Secure File Transfers
FTP is a protocol for transferring files between computers. For example, it could be used to transfer files between a computer and the server that a website is hosted on. FTP used to be widely used but it has since been replaced by SFTP.
SFTP is basically the same thing but before any files are transferred, they are encrypted. This prevents packet sniffing attacks which could otherwise be used to read the files while they are in transit.
Most hosts now offer SFTP but there are exceptions. If a host doesn’t offer SFTP, it doesn’t just leave your files open to packet sniffing; it means that basic security best practices are being ignored.
7. Back Ups
Most hosting companies provide some kind of back up service. The exact functionality offered, however, varies widely. For example, one company might offer daily back ups while another only offers monthly.
Here are a few factors to consider:
- How often do automated back ups occur?
- How many back ups are stored?
- Can you back up your site yourself manually?
- Are there any limits?
8. Malware Removal
Servers are just as susceptible to malware as personal computers. A hosting company should therefore be proactive in preventing it.
Regular scans should be performed on all server files. Clients should be given access to the results of these scans. And assistance should be offered whenever malware is suspected.
Avoid Any Web Host Without These Features
When choosing a web host, security is not something that should be overlooked. It doesn’t matter how fast a hosting service is if it allows your website to be hacked.
It’s also important to note that there isn’t always a correlation between price and security. There’s no shortage of expensive hosts that fail to offer all of the security features listed above.
If you want your website to be both fast and protected, it’s therefore important to read the fine print and to find out exactly what security features are, and aren’t, offered before you sign up.