Security
The line between our job and yours
What every plan guards by default, how payment data stays out of our hands, where your files physically sit, how to disclose a flaw — plus an honest split of the risks we carry and the ones you do.
On Every Plan
No security extras to buy — it is all inside
Every control listed here comes with every plan, down to the cheapest. Nothing below costs a penny extra.
HTTPS settled before you arrive
Every name is issued a free SSL certificate automatically, and it reissues itself ahead of expiry. No setup, no diary reminder, no charge.
Hostile traffic cut off early
DDoS mitigation at the network layer, with a web application firewall behind it, removes malicious requests before your account sees them — so a flood aimed at you never takes the site off the air.
Malware found without your looking
Imunify360 runs quietly in the background, flagging known malware and suspicious file changes, so a poisoned plugin is caught rather than left festering.
Restores you run yourself
An automatic daily copy on every plan — more often on the higher tiers — restorable straight from the control panel with no ticket needed.
Accounts sealed from each other
On the shared platform every account runs in isolation, so a breached site elsewhere on the machine never becomes your emergency.
Your card never reaches us
Stripe collects and stores all payment details. We keep only a token and the final four digits — there is no card number on our side for anybody to steal.
Complete List
Running from day one
- Self-reissuing free SSL for each name
- Network-level DDoS mitigation
- A web application firewall out front
- Malware detection through Imunify360
- An automatic copy taken daily
- Self-service restores from the panel
- Isolation between shared hosting accounts
- Two-factor authentication on your login
- Defences against brute-force logins
- Current PHP releases, security patches applied
Disclosure
Found a weakness? Report it.
We would far rather the first report of a flaw came from you than from a headline.
Send info@hosting-n-domains.com detail enough for the finding to be reproduced. Receipt gets confirmed and you are kept informed while the fix goes out.
Allow a fair window to close the issue before you publish, and keep your testing clear of other customers — no denial-of-service runs, and no reaching for data belonging to somebody else. No paid bounty runs here, so nothing guarantees a reward, but credit is yours should you want it.
Phishing, spam or malware on a site hosted here belongs at report abuse rather than here. For data protection questions, see our privacy policy.
Common Questions
Security, answered plainly
How safe are my card details here?
Card details travel straight to Stripe — among the largest payment processors in the world — and stay on Stripe's infrastructure, not ours. What arrives on our side is a payment token and the last four digits. Never the full number, never the security code. That design matters practically as much as technically. If somebody broke into these machines tomorrow, there would be no card numbers there to take.
What is your position on PCI compliance?
PCI splits into shared responsibilities, so the straight answer depends which piece you mean. Card handling happens entirely on Stripe's side and never crosses our servers, which places those obligations with Stripe — who hold PCI DSS Level 1 certification. The same reasoning applies to your own store: send payments through a gateway like Stripe or PayPal that handles cards on its own machines and you land in the lightest PCI band, usually a short self-assessment questionnaire. Ours is the encrypted, isolated, watched platform sitting under your site. Yours is patched software and admin passwords worth the name.
Are you certified to ISO 27001, SOC 2 or anything similar?
We do not, and we would rather state it than dance around it. Hosting & Domains is small and young, and we have not been through ISO 27001 or SOC 2 — both are serious undertakings, and claiming them without holding them would be far worse than admitting we lack them. What is on offer instead: a legal identity you can verify, a named upstream platform, the specific controls set out on this page, and a disclosure route that actually functions. Where certification is a firm requirement, you will be told plainly that this is the wrong provider rather than have your time wasted.
Where is my data stored, and who can reach it?
The files and the databases sit in a London facility. Reaching them is limited to staff who need it to run the platform or to answer the tickets you raise. Nothing about a customer is ever sold, and your content is used for no purpose beyond running the service. The legal detail — lawful basis for processing, retention periods and the sub-processors involved — sits in our privacy notice.
How do I report a vulnerability?
Send the specifics to info@hosting-n-domains.com and the report gets acknowledged. We ask for a reasonable window to investigate and ship a fix before anything goes public, and for testing that never degrades service for other customers or reaches data that is not yours — so no denial-of-service attempts and no probing of other accounts. There is no paid bounty here and no reward can be promised, though credit is yours for the asking, and you will hear how the fix progresses.
Which parts of this are mine to handle?
The platform is ours to defend: server, network, firewall, malware scanning, copies and encryption. Whatever you deploy on it is yours. That comes down to patched WordPress, plugins and themes, strong unique passwords with two-factor on, deleting plugins you have stopped using, and a second thought before installing anybody's code. Practically every compromised site that reaches us got in through an outdated plugin or a reused password, not through the server.
Suppose my site is compromised anyway — then what?
Raise a ticket and we are on it. The usual sequence: establish how they got in, restore from a clean copy taken before the infection, then close the hole so the same trick fails next time. It is exactly why an automatic daily copy outweighs any single preventative layer — recovery is the part that genuinely rescues you. And where the cause turns out to be an abandoned plugin or a weak password, you will hear it plainly — otherwise you are back inside a month.
Protection that comes as standard.
Every plan — even the $2.42 one — carries SSL, DDoS filtering, malware scanning and a daily copy.
See Hosting Plans