Hardening Buying Guide
Security you can test beats security you can read about
Ask how long a restore takes and how accounts are isolated. Both answers are numbers, and both are testable before you buy.
The short answer
Buy the layers you cannot install yourself. Insist on isolation, server-level defence and real backups underneath whatever you put on top; security is layered, and the bottom layers are the ones a provider owes you — the top ones are yours and no plan substitutes for them.
This page names how shared hosting is actually compromised, the three things worth measuring rather than reading, the plugin habit that consumes CPU without adding containment, and the tier we would run a valuable site on.
By the HostingFast team · Reviewed 15 August 2026
24/7
Engineers on duty
1-click
Application installs
Free
SSL certificates
Daily
Backups, all plans
Written for owners who want the platform doing real work before any security plugin is installed, and who would rather test a restore than read a trust badge.
Cross-account infection defined the era when shared hosting deserved its poor reputation. Containment technology such as CageFS closed that route, which means the architecture a provider selected years ago is a security decision every customer inherits today.
How a shared account is actually compromised
Almost never through the hypervisor and almost always through the application. An unmaintained plugin, a reused password, an upload directory that executes PHP — the entry point is above the platform, in the part you control.
What the platform decides is what happens next. With containment, the compromise stays inside one account: the attacker cannot read a neighbour's configuration file, cannot traverse to another home directory, cannot pivot. Without it, one weak site on the machine is everyone's problem.
The second platform decision is detection speed. A defaced homepage is noticed in minutes; a mail-sending script hidden in a cache directory is noticed when the IP is blocklisted, which can be weeks.
So the questions worth asking are containment and detection, in that order, and both have concrete answers.
Three things to measure rather than read
Restore time. Trigger a real restore of a real site during the refund window and time it end to end, including the moment you spend finding the right backup. That figure is your genuine worst-case recovery, and it is almost always longer than anyone assumes.
Isolation. Ask which containment technology is running and then check what a shell on your account can actually see. A CloudLinux-class setup gives each account its own view of the filesystem, and you can confirm that in about a minute rather than take it on trust.
Patch cadence. Ask how quickly the platform beneath your account receives kernel and panel updates, and whether it needs a reboot window. A provider with a confident answer has a process; a vague one has a habit.
The habit that costs CPU and adds nothing
Judging a provider by the plugins it recommends is the standard error. Isolation and patch discipline determine which threats those plugins never have to confront in the first place, and a scanner running inside your own account is the layer with the least authority and the highest cost.
The specific version of this is stacking three security plugins on a shared account. They each scan the same filesystem on a schedule, they each hold their own database tables, and the visible result is a slower admin panel and an unchanged threat model.
Keep one, let the server-level layer do the containment and remediation, and spend the recovered attention on updates and credentials — which are the two things that actually decide whether an incident starts.
Our pick, and what remains yours
Nitro is where this page lands: backups every 6 hours rather than daily, Imunify360 in front, 200 GB of NVMe, 2 cores and 4 GB of RAM, and priority support at any hour. The shorter backup interval is the part that matters here — it is the difference between losing a morning's work and losing a day's.
What stays yours: applying updates promptly, unique credentials, least-privilege user accounts, and removing plugins nobody maintains any more. The platform contains an incident; your habits decide whether one starts.
Verify the rest commercially — renewal against order rate, a hard question to support at an awkward hour, refund terms read for carve-outs, and the company registration looked up on the public record.
Our commercial interest, stated in the body copy
We are a host writing about hosting and we would rather say it here than imply neutrality. That is what allows this page to tell you which layer is genuinely ours and which one is genuinely yours.
Already hosted somewhere slower? We migrate the whole site free, usually within 24 hours, and it keeps serving visitors the entire time.
- A restore you time yourself, not a promise
- Containment you can confirm from a shell
- No year-two step change
- Refund terms you can read beforehand
Why HostingFast
Standard on every plan
Backups every 6 hours
On the Nitro tier the recovery point is a quarter of a day, which is the number that decides how much work an incident costs you.
Containment as standard
Account isolation means one compromised site on the machine stays one compromised site rather than becoming everyone's incident.
Imunify360 in front
Server-level detection and remediation, running below your application where it has the authority to act.
Restores you run yourself
From the panel, at three in the morning, with no ticket queue between you and the version that worked.
Nitro, in one line
200 GB of NVMe, 2 cores, 4 GB of RAM and priority support at any hour, at a rate that does not change at renewal.
A clear division of duty
We will tell you which layers are ours and which are yours, because a vague answer to that is itself an answer.
Quick Start
From order to online
- 1
Time a real restore
Not a described one. Restore a real site during the refund window and record how long it took from decision to working page — that is your true recovery figure.
- 2
Confirm the isolation model
Ask which containment technology runs, then check what a shell on your account can actually see. One minute, and it settles the question that matters most.
- 3
Ask about patch cadence
How fast kernel and panel updates land, and whether they need a reboot window. A confident answer indicates a process; a vague one indicates a habit.
- 4
Audit your own layer
Update everything, rotate credentials, remove abandoned plugins, and cut every user back to the access they actually need. That is where incidents start.
Built In
Loaded onto every plan
- Account isolation with CloudLinux-class containment as the baseline
- Imunify360 running at server level with remediation, not just alerts
- Backups every 6 hours on the top shared tier
- Restores you run yourself from the panel, at any hour
- DDoS filtering absorbed out at the network edge
- Free SSL that renews itself well ahead of expiry
- Per-site PHP version switching, so nothing is stranded on an old release
- NVMe SSD on every tier, not only the expensive ones
- Renewal charged at the rate you ordered at
- 99.9% uptime as the target, monitored around the clock
Frequently Asked
What people ask us most often
What is my real recovery time, and how do I find out?
Time a restore rather than reading a policy. Pick a real site during the refund window, restore it, and measure from the moment you decide to the moment the page works — including finding the right backup. Most people discover their genuine figure is several times the one they assumed, and that number is the whole point of having backups.
How can I check account isolation is actually on?
Open a shell and look at what you can see. On a properly contained platform your account gets its own view of the filesystem: no other home directories, a trimmed process list, no visibility of neighbours' configuration. It takes a minute and it is far more informative than any page describing the technology.
How many security plugins should a site run?
One, at most. Each additional scanner walks the same filesystem, keeps its own tables and slows the admin panel, while adding nothing to containment — which happens below your account and is not something a plugin can provide. Keep one for application-layer visibility and let the server-level layer do the work it is positioned to do.
What actually happens after a compromise is detected?
Server-level remediation quarantines or cleans the affected files, and you still have to close the entry point — the outdated plugin, the leaked credential, the writable upload directory — or the same route is used again within days. Ask any provider who performs which half of that; a vague answer tells you the cleanup will be yours.
Keep reading
Hosting With a Money-Back Guarantee
The exit route mapped before you commit, including the exclusions most pages skip.
Hosting for High-Traffic Blogs
Publishing at volume, with the surge behaviour measured rather than assumed.
Shared Hosting (Glossary)
What the shared model actually shares, and which parts of it are isolated.
Secure Hosting
Imunify360, isolated accounts and hardened defaults for security-first builds.
CMS Hosting
Fast, hardened hosting for WordPress, Joomla, Drupal and every major CMS.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Test the recovery, not the badge.
Isolation, Imunify360 and six-hourly backups on the top shared tier — with a restore you can time yourself.
View Secure Hosting plans