Acceptable Use Policy

Who it binds

Anyone holding a login. So that covers you, the developer you handed FTP to, the agency looking after your site, and every one of your customers if you resell. Traffic leaving an account is answered for by whoever holds that account, whatever hands were on the keyboard.

Clause 4 of the terms is the binding version, and it remains so. Everything below explains that document; nothing below extends its reach.

1. The hard no

The list is short, and none of it is open to debate. Put any of the following on our servers and the account closes that same day:

• images that show the sexual abuse of children;
• material that promotes terrorism, or calls for violence against anyone;
• the machinery of fraud: fake sign-in pages, cloned bank sites, scam storefronts;
• viruses, ransomware droppers, exploit kits, or dumps of stolen cards and credentials;
• botnet controllers, plus any relay you know to be carrying abuse;
• work put up without the licence it required, once a rights holder has demonstrated that to us;
• drugs, weapons or betting sold into territories where you hold no licence to sell them.

Adult content that is legal may stay. Put an age gate on it, keep it out of our outbound mail, and we have no further interest.

2. What a shared machine will actually give you

On a shared plan, speed is something everybody draws from. Each plan receives a generous slice, and none receives the entire box, since the moment a single account swallows the machine every other site on it drops to a crawl.

Some workloads we will ask you to shift onto a VPS or a dedicated server. Encoding audio or video. Crawling the web. Mining coins. Running a public download mirror. Backing up machines that sit somewhere else entirely. Databases grinding through bulk jobs at all hours. None of it is banned; it is simply the wrong product for the job, and a message will reach you well before anything gets stopped.

Where the storage is described as unlimited, that means unlimited for the websites running on the plan. It is not there to hold archives that belong to no site at all.

3. Patching is yours

The operating system, the web server and the control panel stay current because we patch them. Whatever you installed above that layer is yours to look after. A plugin sitting three versions behind is how almost every compromised account here was compromised.

• keep the CMS, themes and extensions updated;
• sweep installers, SQL dumps and config files out of any public folder;
• hand each person a login of their own, then remove it on the day they leave;
• open a ticket as soon as something looks wrong, instead of waiting until you are certain.

Scanning or stress-testing something you do not own requires our written agreement beforehand. Even on your own site, tell us before you begin. Otherwise our automated defences will handle it precisely the way they handle a genuine attack.

4. Sending

Mail carries its own document, since a mistake there harms every customer sharing an address range, rather than only the person who pressed send. Read the anti-spam policy before you push any message out to more than a handful of recipients.

5. How we react

How far we go depends on how much harm is being done, and the opening move is almost always a conversation:

• A message. This is where most cases land, since most cases begin with a hacked plugin or a job that outgrew its plan.
• Something gets switched off. Where the damage is live and spreading, with mail pouring out, a phishing page harvesting logins, or a single process starving a node, the offending item is stopped while we discuss it.
• The account closes. Reserved for section 1, for a pattern of repeated breaches, and for anybody who falls silent while their site does damage.

Criminal material is removed at once and reported wherever the law requires it to be reported. In that situation no warning is owed to anyone, and none will be given.

6. If we made a mistake

Tell us. Answer the notice we sent you directly, or else open the complaints procedure. Should a suspension prove to have been our error, the service is restored at once and the days you lost are credited, with no need to ask a second time.

7. Reporting a site to us

Use report abuse. The substance of any report goes to the account it concerns, while your contact details stay out of it, unless you ask for them to be included or a court orders us to hand them over.

8. The company

HostingFast is a trading name of Vitalcare at Home Ltd, a company registered in England and Wales under Company No. 15098204. Registered office: Office 4648, 221–323 High Road, Chadwell Heath, Romford, England, RM6 6AX. Put any question about this policy to us at info@hostingfastnet.com.