The web hosting security checklist: what to verify before you hand over your site

Before you buy hosting, check the security that actually prevents and recovers from incidents — not the badges. This is the checklist we use to audit any host: free SSL, malware scanning and removal, restorable backups, DDoS and firewall, account isolation, patching and access controls, plus the half of the list that's on you.

Use this checklist to judge any host's security in about ten minutes, before you pay. Each item is a question with a clear right answer, so you can score a host quickly and spot the gaps the marketing page glosses over. If you'd rather see the checklist already applied, our most secure web hosting ranking scores seven security-forward hosts against exactly these criteria.

1. Is SSL free and automatic?

The right answer is yes, free, and installed automatically. Every reputable host includes a free auto-renewing certificate from Let's Encrypt or ZeroSSL. If SSL is a paid add-on, or the host implies a normal site "needs" a paid certificate, that's a red flag — the free certificate encrypts traffic exactly as strongly. Confirm it renews automatically, because an expired certificate breaks the site. More on when paid certificates actually matter is in free SSL explained.

2. Is malware scanning AND removal included?

Look for both scanning and cleanup, because they're often sold separately. Many hosts advertise "malware scanning" but treat cleaning an infected site as a paid service; the strongest hosts run a suite like Imunify360 that scans and automatically removes threats. Ask two specific questions: does the plan detect malware, and does it actually remove it, or just alert you? The honest guide to whether you need this from your host at all is do you need malware protection from your host.

3. Are there daily backups you can actually restore?

Check three things: frequency, retention and whether restores are free. Daily is the minimum; a single "weekly" backup can mean losing six days of orders. Retention tells you how far back you can go if an infection sat undetected — 30 days beats 7. And confirm restores are free and self-service, because some hosts charge per restore. Whatever the answer, plan to keep your own independent copy too; the reasons are in hosting backups explained.

4. Is there DDoS mitigation and a web application firewall?

Expect at least basic network-level DDoS mitigation and, ideally, a web application firewall that filters malicious requests. Ask what layer the protection covers: many hosts stop common volumetric floods but do little at the application layer, where most damaging attacks now happen. Whatever the host provides, you can add Cloudflare's free plan in front for unmetered DDoS mitigation and a basic WAF — we recommend it because it costs nothing and earns us nothing. What each layer covers is in DDoS protection in hosting.

5. How strong is the account isolation?

On shared hosting, isolation is what stops a neighbour's hacked site from reaching yours. The right answers are CloudLinux (which caps and isolates each account) or container-based isolation. Ask directly: are accounts isolated from one another, and by what technology? A host that can't answer is one to avoid. If you want the strongest isolation, a VPS or a managed cloud server puts you on your own environment — the trade-offs are in shared hosting security risks and isolation.

6. Does the host patch fast, and offer 2FA?

Two access and maintenance basics round out the host's half. First, patching: on managed and shared plans the host should keep the server OS and stack updated promptly, and some, like A2 Hosting, apply kernel patches without a reboot to close the gap faster. On an unmanaged VPS, patching becomes your job — factor that in. Second, two-factor authentication: your hosting control panel is a master key, so the host must support 2FA on your account, and you must turn it on. If a host doesn't offer 2FA in 2026, that alone is disqualifying.

7. What's still your job after you buy?

The last items on the checklist are the ones no host can tick for you: keep your CMS, plugins and themes updated, use a password manager and unique passwords, turn on 2FA everywhere, remove unused accounts and plugins, limit user permissions, and keep your own off-host backup. This is your half of the shared-responsibility model, and it's where most real breaches are actually prevented or lost. Work through the hosting hardening checklist once your host is chosen and your site is live.

Checklist questions, answered

What's the single most important security feature to check?

Restorable backups. Prevention features reduce the chance of an incident, but a good daily backup you can restore quickly is what turns a breach or a mistake into an inconvenience instead of a disaster. Check that backups are daily, retained for at least a couple of weeks, and free to restore — then keep your own independent copy as well, because the host's backup can be lost in the same incident it's meant to protect you from.

Is a host advertising 'secure hosting' enough to trust it?

No. 'Secure hosting' is a marketing phrase, not a standard. Judge the host on the specific controls in this checklist — free SSL, malware scanning and removal, restorable daily backups, DDoS and a firewall, account isolation, prompt patching and 2FA — and read what's actually included on the plan you'll buy, since 'included' often means the basic tier and cleanup or monitoring is a paid add-on.

Should I choose shared, VPS or managed hosting for security?

It depends on how much of the work you want to own. Good shared hosting with CloudLinux isolation, scanning and backups is secure enough for most small sites. A managed cloud host or managed VPS gives stronger isolation and moves more patching and monitoring to the provider, which is worth it for busy or business-critical sites. An unmanaged VPS gives the most control but makes patching and hardening entirely your responsibility.