Platform Notes
Hosting with imunify360 — Defence in layers, and what each layer costs you in milliseconds
A security plugin runs inside the application it is defending, which means the request has already reached PHP, the database and your code before anything looks at it.
The short answer
Choose hosting where the protection sits below your site rather than inside it. Nitro at $7.08 a month runs Imunify360 in front of every site on the account, and Business hosting — Overdrive at $19.99 and Redline at $39.99 — carries it too; Sprint and Turbo run ImunifyAV+ malware sweeping on every site.
The reason to care is architectural. Edge filtering absorbs volumetric floods before they reach the machine. A server-resident web application firewall inspects the request before PHP is invoked. A malware scanner works on the filesystem regardless of what the application thinks. A plugin sees none of that, because by the time it runs, everything upstream has already happened.
Below: which layer catches which class of attack, what the inspection genuinely costs in request time, which tier gets which product, and how to confirm the whole thing is actually running.
By the HostingFast team · Reviewed 24 August 2026
NVMe
Storage, every tier
Free
Domain, first year
99.9%
Uptime, monitored
Flat
Renewal pricing
Security features are the easiest thing in this market to imply and the hardest to verify from outside. 'Advanced protection' on a comparison table tells you nothing about where the protection sits or what it is licensed to do.
So this page is about mechanism and position. Where in the request path does each control live, what can it see from there, and what does it cost the visitor who is not attacking you.
The request path, and what each control can see
First the network edge, where DDoS filtering absorbs volumetric traffic. This layer sees packets and volume, not intent — it stops a flood, not a targeted injection.
Then the server-resident firewall. It inspects the HTTP request before the application is invoked, which is why it can drop an obvious injection or a brute-force login attempt without your PHP, your database or your plugin ever waking up.
Then the filesystem scanner, which works on files rather than requests. It sees a shell dropped through an upload form even if that upload never looked suspicious in transit, and remediation matters as much as detection: cleaning an infected file beats emailing you about it.
Last, the application plugin, which can see things nobody below it can — which logged-in user changed what, and application-level policy such as login hardening. That is a genuine contribution; it is just not the perimeter.
What it costs in request time
Inspection is not free, but it is charged where you can most afford it. A cached page served by LiteSpeed never reaches PHP at all, so for the large majority of logged-out traffic the application layers are simply not in the path.
The requests that do pay are the uncacheable ones — login, checkout, admin — and those are already dominated by database work rather than by a rule match. If you want a number rather than an assurance, time an uncached page with five `curl -s -o /dev/null -w '%{time_starttransfer}'` runs and compare it against the same page on a plan without the server layer.
The comparison that actually matters is against the alternative. A security plugin running inside WordPress adds PHP execution and database queries to every uncached request — measurably more than a rule evaluated before PHP starts.
Which tier runs which product
Sprint at $2.42 and Turbo at $4.66 include ImunifyAV+, sweeping every site for malware. Nitro at $7.08 steps up to Imunify360 in front of every site, and also takes backups every 6 hours rather than daily.
Business hosting carries Imunify360 as well: Overdrive at $19.99 with 500 GB and 3.5 cores, Redline at $39.99 with 1 TB and 500 addon domains. Both add priority support around the clock.
Across every tier, edge DDoS filtering and free SSL are standard, and the certificate reissues itself before expiry so an expired certificate never becomes your outage.
Proving it is on, and the day something gets through
Ask, specifically, whether the product is licensed and running rather than whether the host has 'security features'. The two answers sound similar and mean entirely different things.
Then check what you can from outside: `curl -sI https://yourdomain.example` shows the response headers, a deliberately malformed request to a known-sensitive path shows whether anything is filtering, and the panel shows the scanner's own reporting for your account.
For the day something does get past — because eventually something does — the sequence is: restore from a clean backup rather than cleaning in place, rotate every credential the site touched, switch the PHP branch to a supported one if it was not, and only then look for the entry point. Daily backups with self-service restores are what make step one a decision rather than a crisis.
Why we describe position rather than adjectives
Anyone can print 'enterprise-grade protection'. Very few will tell you where in the request path the control sits, which is the only detail that predicts what it can and cannot stop.
We recommend our own plans here and say so. The layer model above is vendor-neutral: use it to interrogate whoever else is on your shortlist.
- Filtering before PHP is invoked, not inside it
- Cached pages never reach the application layers at all
- Named products per tier, not 'security features'
- Restore-first incident sequence, with daily backups behind it
Why HostingFast
Standard on every plan
Protection below the application
A server-resident firewall inspects the request before PHP starts, so an obvious injection never touches your code or your database.
Named on every tier
ImunifyAV+ on Sprint and Turbo; Imunify360 on Nitro and on Business hosting. A product name, not a checkbox labelled security.
Remediation, not just alerts
A scanner that cleans an infected file is worth considerably more at 2am than one that emails you about it.
Edge filtering in front of all of it
Volumetric traffic is absorbed out at the network edge, so a flood is infrastructure's problem rather than your site's.
Backups every 6 hours on Nitro
A tighter recovery point on the tier that also carries Imunify360, restorable from the panel without a ticket.
Certificates that cannot lapse
Free SSL on every plan, reissued automatically before expiry, so an expired certificate never becomes your incident.
Quick Start
From order to online
- 1
Ask which product, not whether there is security
A licensed, named product running on the server is a different claim from 'security features included'. Get the name.
- 2
Work out what each layer can see
Edge sees volume. Server firewall sees the request. Scanner sees files. Plugin sees users. Match the layer to the threat.
- 3
Measure an uncached page
Five curl timing runs on a login or checkout page. That is where inspection is charged; cached pages never reach it.
- 4
Write the incident sequence down now
Restore from clean backup, rotate credentials, move to a supported PHP branch, then hunt the entry point. In that order.
Built In
Loaded onto every plan
- Daily backups with self-service restores from the panel
- Imunify360 on Nitro and on Business hosting tiers
- ImunifyAV+ malware sweeping on Sprint and Turbo
- Network-edge scrubbing running ahead of the shared platform
- Free SSL on every plan, reissued before it can expire
- Staging copies for testing an update before it reaches production
- Full SSH with Git and Composer for post-incident inspection
- Year one of the domain free when you order annually
- In-place upgrades between tiers, with no migration to arrange
- Zero setup charges — there is no joining fee
- Webmail plus IMAP, POP and SMTP for any mail client
Frequently Asked
What people ask us most often
Which of my plans gets Imunify360 rather than ImunifyAV+?
Nitro at $7.08 a month runs Imunify360 in front of every site, and so does Business hosting — Overdrive at $19.99 and Redline at $39.99. Sprint at $2.42 and Turbo at $4.66 carry ImunifyAV+, which sweeps every site for malware. Edge DDoS filtering and free SSL are standard across all of them.
Does server-level filtering slow the site down?
Barely, and it is charged where it hurts least. Cached pages are served by LiteSpeed without ever reaching PHP, so the application layers are not in their path at all. Uncacheable requests such as login and checkout do pay for inspection, but far less than a security plugin running inside WordPress on the same request.
What can an application plugin see that the server layer cannot?
User-level context. Which logged-in account changed which setting, an audit trail of administrative actions, and application policy such as login hardening or two-factor. That is a real contribution — it is simply not perimeter defence, because by the time a plugin executes the request has already reached your code.
Something got through anyway. What is the right order of operations?
Restore from a known-clean backup rather than cleaning in place; rotate every credential the site touched; move the site to a supported PHP branch if it was not on one; then find the entry point. Daily backups with panel restores — every 6 hours on Nitro — are what make the first step quick.
Keep reading
Hosting With WordPress Toolkit
One-click hardening across a fleet, which is the application-level half of the layer model on this page.
Managed vs Unmanaged VPS
On an unmanaged box every layer described here becomes yours to install, tune and patch.
TLS (Transport Layer Security) (Glossary)
What the transport layer does and does not protect, and why a certificate is not a security control on its own.
Secure Hosting
The full stack of platform defences, with the product running at each position named rather than implied.
WordPress Hosting
Managed WordPress with one-click vulnerability hardening, Toolkit Deluxe and ImunifyAV+ on every tier.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Put the guard below the door.
Nitro at $7.08 a month with Imunify360 in front of every site, backups every 6 hours and NVMe behind LiteSpeed.
View Secure Hosting plans