Website security

Security on shared hosting is a partnership. FiniteHost protects the server, keeps every account sealed off from the others, and slows down attackers. You keep your own code, plugins and passwords in good shape. This guide explains both halves in plain words.

Before you start#

• You have a website on FiniteHost. Most of the checklist applies to WordPress, but the habits apply to any site.

What FiniteHost does for you#

Every account is sealed off#

• Your own Linux user. Your PHP and Python code runs as your account only, so it cannot read another customer's files, and theirs cannot read yours.
• Your own PHP pool. Your site has its own PHP processes. PHP can open files only inside your own storage.
• Your own resource limits. CPU, memory, process count and disk are fixed per plan by the Linux kernel, so a busy or attacked neighbour cannot take your share.
• Risky PHP functions are off. exec, shell_exec, system, passthru, proc_open, popen and pcntl_exec are disabled, and allow_url_include is off. Much malware relies on these.
• Outgoing mail from code goes through FiniteHost only. Scripts can send only by signing in to mail.finitehost.com with a mailbox password, within that mailbox's daily limit. Port 25 and other SMTP servers are blocked, which stops a hacked site being used to send spam. See Send email from your website or app.

Visitors are rate-limited#

Each visitor's network address gets fair limits. Above them, the server answers 429 Too Many Requests instead of doing the work:

The login limit makes password guessing painfully slow. Normal visitors never get near these numbers. Because your site's www address is served through the Bunny CDN, the server reads each visitor's real address from the CDN, so limits and your access log apply to people, not to the CDN.

Repeat offenders are banned#

FiniteHost runs fail2ban, which blocks an address at the firewall when it keeps misbehaving:

If you lock yourself out by mistyping a password, wait for the ban to end. FiniteHost's own servers are never banned.

Connections are encrypted#

• Free HTTPS for every site, renewed automatically (see HTTPS certificates). Once a site has its certificate, plain http:// visits are redirected to https://, and browsers are told to use HTTPS for a year (HSTS).
• Hidden files stay hidden. Any file or folder whose name starts with a dot, such as .env or .git, is never served.
• SFTP only, never plain FTP, so passwords never cross the internet unencrypted.

Keeping WordPress safe#

Most hacked sites are hacked through an outdated plugin or a weak admin password. Work through this list once, then keep the habits.

1. Update everything. Turn on automatic updates for WordPress core, plugins and themes in Dashboard → Updates, and check weekly.
2. Use a strong, unique admin password from a password manager, and never the user name admin.
3. Delete plugins and themes you do not use. A deactivated plugin can still be attacked; keep only one spare default theme.
4. Never install "nulled" (pirated) plugins or themes. They very often carry hidden malware.
5. Give each person their own account with the least role they need: Editor or Author for writers, Administrator only for those who manage the site.
6. Turn on two-factor login for administrators with a reputable security plugin, if you like. FiniteHost's login rate limit already slows guessing.
7. Keep wp-config.php private. It holds your database password. Never share it or post it in a support forum, and do not loosen its permissions.
8. Delete database tools after use. If you uploaded Adminer for an import, remove it (see Import and export a database).
9. Watch for unexpected changes: new admin users, files you did not upload, or pages linking to sites you do not know.
10. Keep your own backup before big changes (see Backups and restore).

If your site is hacked#

Act calmly and in this order:

1. Change every password: make a New SFTP password, a New password for the database (then update wp-config.php), and reset every WordPress administrator's password.
2. Check your SSH keys on Files (SFTP). If you see a key you do not recognise, email support to remove it.
3. Email support@finitehost.com with your subscription ID and what you noticed. We can restore a clean copy from a night before the attack.
4. Restore or clean the site. Restoring from a backup is usually the fastest clean fix; then update everything at once so the same hole cannot be used again.
5. Check your mail and accounts. If the attacker could have read emails, change your mailbox passwords too.

To report spam, phishing or an attack coming from a site hosted on FiniteHost, email abuse@finitehost.com.

Troubleshooting#

• My visitors see "429 Too Many Requests": something is sending a lot of requests from one address, often a plugin polling the server or a broken loop in JavaScript. Check your access pattern before asking for changes.
• I cannot log in to WordPress, the page says 429: you hit the 6-per-minute login limit. Wait a minute and sign in once, carefully.
• An SMTP plugin cannot connect to a mail server: code on FiniteHost cannot reach ports 25, 465 or 587 anywhere, including your own mailbox's server. Use an email-sending service that offers an HTTPS API, with a WordPress plugin built for it.

What's next#

• Account security.
• Backups and restore.
• HTTPS certificates.