Acceptable Use Policy

Section 4 of the terms of service settles what you may run here in a paragraph. This page is that paragraph at full length. Where the two disagree the terms win: nothing below widens what the contract already allows.

It reaches every plan, anyone you resell to, and anyone you hand a control-panel or FTP login. An account answers for the traffic it originates whether or not the person who caused it was you.

1. Material that may not be hosted

Some of this is criminal. The rest of it gets an entire IP range blocked, which harms every other site sharing it. Both cost you the account:

• child sexual abuse material, in any form and in any quantity;
• material inciting terrorism or violence against a person or a group;
• anything published in breach of another party's copyright, trade mark or database right — the copyright and takedown policy sets out how a rights holder raises that;
• phishing pages, counterfeit login screens, and anything else built to harvest credentials;
• malware, exploit kits, credential-stuffing lists and stolen payment data;
• command-and-control endpoints for botnets, and proxies knowingly operated for abuse;
• unlicensed pharmacy, weapons or gambling operations aimed at places where they are unlawful.

Adult material that is lawful where it is produced and where it is read is not on that list. It does have to be age-gated, and it must not be the reason our address space lands on a blocklist.

2. Fair use of a shared plan

Shared and reseller plans put many sites on one machine, so no single account can be allowed to take the whole of it. In practice: no sustained saturation of processor, memory, disk throughput or process count, and no treating the plan as though it were a server bought outright.

Work that belongs on a VPS or a dedicated machine instead — video transcoding, long-running crawlers, cryptocurrency mining, public file drops, backup mirrors for systems hosted elsewhere, and any database grinding through continuous bulk jobs. When a workload is the reason neighbouring sites slow down it has to move, and you will hear that from us before anything is switched off.

Storage described as unlimited is unlimited for the content of websites on the account. It is not a general-purpose drive.

3. Mail

Every rule about sending lives in the anti-spam policy, because unsolicited mail is the quickest route to a delisted IP range and the subject earns a page of its own. The short form: write to people who asked, honour an unsubscribe the moment it arrives, and never relay for a third party you cannot vouch for.

4. The security that sits with you

We patch the platform. You patch what you installed on top of it. An out-of-date plugin is the most common way an account here is taken over, and the mail or defacement that follows is attributed to you.

• keep applications, themes and plugins current;
• leave no installers, database dumps or .env files sitting in a web root;
• use credentials that are not reused elsewhere, and revoke logins when people leave;
• tell us quickly if you think an account has been compromised.

Probing, scanning or load-testing infrastructure you do not control — ours included — needs written permission first. Testing your own site is fine, but tell us before you run anything that resembles an attack, so the automated defences do not answer on our behalf.

5. What happens when this policy is broken

The response is meant to be proportionate, and it usually opens with a message rather than a switch being thrown:

• We ask. Most breaches are a hacked plugin or a misjudged workload, and a note settles them.
• We isolate. Where something is actively harming others — an outbound spam run, a live phishing page, a process consuming a whole node — that item or account is suspended while we talk.
• We terminate. Kept for the material in section 1, for repeat breaches, and for accounts that go unreachable while causing damage.

Unlawful material is removed without notice and, where the law requires it, reported. Nothing here obliges us to wait when waiting would make us party to the harm.

6. Disagreeing with a decision

Suspensions are made by people, and people get it wrong. Reply to the suspension notice, or take it through the complaints procedure. A suspension made in error is lifted and the lost time credited.

7. Reporting a breach

To report something hosted here, use abuse reports. What you send is put to the account holder in substance, but not with your contact details attached unless you ask for that or the law requires it.

8. Who this is with

Hosting & Domains is a trading name of UK Health Care Support Ltd, a company registered in England and Wales under Company No. 15042717. Registered office: Office 4648, 58 Peregrine Road, Ilford, England, IG6 3SZ. Questions about this policy go to info@hosting-n-domains.com.