Security As Standard
Guards already up before your first login
Every plan lands with a managed WAF, Imunify360 malware scanning, DDoS filtering, free SSL, daily backups and 24/7 monitoring already live. Nothing to bolt on, nothing extra to buy.
Free
An SSL certificate on every domain
Daily
Automatic backup runs
24/7
The platform watched, nonstop
Layer 7
DDoS and firewall coverage
Layered Defence
Six defences sitting between a threat and your site
Protection most hosts sell as paid extras. Here the whole stack is built into the plan price from the start.
Managed web firewall (WAF)
Before your code ever sees a request, it is measured against a catalogue of attack signatures that never goes stale. SQL injection, cross-site scripting and the rest of the usual exploits get stopped at the gate.
Imunify360 malware detection
Files sit under constant watch, and anything infected goes into quarantine the second it appears. Plugins gone stale collect a virtual patch that shields them until you get round to updating.
DDoS absorbed at the edge
Flood traffic and hostile packets are spotted and binned at the network perimeter, a long way upstream of your server. Real visitors come through without noticing a thing.
Self-renewing free SSL
Every domain on the account gets a certificate that renews itself, which keeps traffic encrypted and leaves the padlock lit for good.
A backup taken daily
Each day, files and databases are copied away from the server, which leaves a clean restore point you can roll back to inside minutes.
Monitored every hour of the year
Automation and actual engineers both track server health, uptime and intrusion attempts without a break: nights, weekends, holidays too.
The WAF
Hostile requests stopped before entry
Inspection happens before your application runs a single line of code. Malicious payloads and probing bots bounce off the perimeter, while genuine visitors carry on at full speed. No plugin for you to install, and no rules for you to maintain.
- SQL injection and XSS blocked outright
- Recognised bots and exploits filtered
- Abusive traffic slowed automatically
- Rules tuned and updated for you
Malware Scanning
Imunify360 stops infections spreading
Nothing in your file tree escapes Imunify360. Malicious code gets isolated and reported the second it shows up, which boxes the trouble in before it can spread anywhere. Virtual patching, meanwhile, covers outdated software until you update on a schedule that suits you.
- Continuous scanning, plus on every upload
- Quarantine happens without your input
- Outdated plugins get virtual patches
- Clear alerts posted to your dashboard
The Handoff
The way six layers cover for each other
No single control stops everything. Each layer covers the gaps in the last one, so getting through means beating all six in a row.
- 1
Traffic hits the DDoS filter first
Volume floods and obvious rubbish get soaked up and thrown away at the network edge, long before your server is involved. Uptime holds.
- 2
The WAF screens the remainder
Anything that gets past the edge runs into the managed firewall, which turns away injection payloads, cross-site scripting and the other application-level exploits.
- 3
Isolation contains whatever lands
Each site lives in a sealed environment of its own. An incident on a neighbouring account, sharing that same server, finds nowhere to cross.
- 4
Imunify360 checks each file on arrival
Anything written to disk is scanned there and then. Infections go into quarantine on sight, and software left out of date collects a virtual patch.
- 5
SSL encrypts the whole exchange
Each exchange between a visitor and the site is encrypted from one end to the other, so nothing crossing the wire can be read or tampered with.
- 6
Backups stand as the final net
If something does break through regardless, the daily off-server copies restore the whole site to a clean point in minutes.
Plans
The same security stack on every plan
All three sizes carry the identical protection. Start where your site is today and step up as it grows.
Sprint
One website, live in minutes, at our lowest entry price
$2.42/mo
$29.04 today · billed annually
the price never jumps at renewal
- SSD storage
- 10 GB
- Websites
- 1
- Bandwidth
- 500 GB
- CPU / RAM
- 1 core / 2 GB
- Databases
- 25 MySQL
- Your first year's domain registration is on us
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — tell it what you want, go live
- WordPress Toolkit on board, plus a fresh backup daily
- Full SSH access with Git and Composer on tap
- Softaculous installs 240+ apps in one click
- ImunifyAV+ sweeps every site for malware
- NVMe SSD storage behind a LiteSpeed cache
- Mailboxes on your own domain, included
- MailChannels gets your outbound mail delivered
- The latest cPanel, with humans on support 24/7
- Your account goes live minutes after checkout
Orders complete over at Hosting Cheap, which handles billing for everything we sell.
Turbo
Twenty-five sites running flat out on a single account
$4.66/mo
$55.92 today · billed annually
the price never jumps at renewal
- SSD storage
- 20 GB
- Websites
- 25
- Bandwidth
- 1 TB
- CPU / RAM
- 1 core / 2 GB
- Databases
- 50 MySQL
- Your first year's domain registration is on us
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — tell it what you want, go live
- WordPress Toolkit on board, plus a fresh backup daily
- Full SSH access with Git and Composer on tap
- Softaculous installs 240+ apps in one click
- ImunifyAV+ sweeps every site for malware
- NVMe SSD storage behind a LiteSpeed cache
- Mailboxes on your own domain, included
- MailChannels gets your outbound mail delivered
- The latest cPanel, with humans on support 24/7
- Your account goes live minutes after checkout
Orders complete over at Hosting Cheap, which handles billing for everything we sell.
Nitro
200 GB of NVMe and the muscle to drive every byte of it
$7.08/mo
$84.96 today · billed annually
the price never jumps at renewal
- SSD storage
- 200 GB
- Websites
- 100
- Bandwidth
- 2 TB
- CPU / RAM
- 2 cores / 4 GB
- Databases
- 100 MySQL
- Your first year's domain registration is on us
- WordPress Toolkit Deluxe included at no added cost
- Backups land every 6 hours, with Imunify360 in front
- PHP X-Ray on CloudLinux Pro pinpoints slow code fast
- Ship code in Node.js, Python or Ruby — all pre-wired
- Priority support at any hour, day or night
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — describe it and publish
- NVMe SSD storage behind a LiteSpeed cache
- SSH, Git and Composer at the command line
- Softaculous installs 240+ apps in one click
- Your account goes live minutes after checkout
Orders complete over at Hosting Cheap, which handles billing for everything we sell.
More Safeguards
Three quieter protections on duty
Login hammering shut down
A run of failed logins brings throttling and an IP ban, which shuts down bots grinding at your admin or mail credentials.
Virtual patches land first
The moment a vulnerability becomes public, a firewall-level patch shuts it, often before the vendor has shipped an official fix at all.
Hard walls between accounts
Your account runs sealed away from all the others sharing that server, which leaves a compromise next door with no route to your site.
Recovery & Uptime
A new copy each day, with eyes on it always
Even good defences deserve something behind them. Automated daily backups can put the whole site back inside minutes, uptime and intrusion monitoring runs without a pause, and there are real people ready to step in when needed.
- Off-server backups every day
- Full-site restore with one click
- Monitoring with no off-hours
- Free SSL renewing on its own
How It Works
Protected in three quick moves
- 1
Pick your plan
The WAF, malware scanning, DDoS filtering and daily backups are already running on every tier. Nothing bolts on afterwards at all.
- 2
Move your site in
Aim the domain at us, or hand the move to our team and pay nothing for it. SSL gets issued by itself the moment the site goes live.
- 3
Let it run itself
Check the clean scan results and uptime in your dashboard as often as you fancy. Monitoring and backups grind on underneath whether you look or not.
All Standard
All of it ships with every single plan
- A managed WAF shielding every site
- Malware scanning via Imunify360
- Automatic quarantine of infected files
- Network-level DDoS filtering
- Free SSL that renews unaided
- Daily backups stored off-server
- One-click restores
- Defences against brute-force logins
- Full isolation between hosting accounts
- 24/7 monitoring and support
FAQ
Secure hosting, asked and answered
Which attacks can the firewall actually block?
Each request gets weighed against a signature library of known attacks, one our team keeps current, before a single line of your site's code runs it. That catches SQL injection aimed at your database, cross-site scripting payloads written to hijack visitor sessions, remote file inclusion, directory traversal and command injection. The same screening strains out abusive bots, credential-stuffing tools and probes sniffing around for familiar plugin or theme flaws. You are never asked to write a rule. Tuning and updating the firewall as new threats appear is our work, not yours. Genuine visitors pass through with no added friction at all, while hostile requests are discarded at the edge before your server burns a single cycle on them. In practice that means most everyday attacks never come near your application, your database or your files.
How does Imunify360 spot malware, and what happens next?
Imunify360 comes with every secure plan. It scans away in the background without stopping, then scans again the instant a file is uploaded or edited. When something malicious does surface, whether that is a hidden backdoor, a defaced page, a phishing kit or a script pumping out spam, the file drops straight into quarantine so the infection stays contained rather than creeping across the account. Your dashboard lists exactly what got caught and where it was sitting, and you can inspect or restore any of it yourself. Detection is only half of it. Virtual patching shields out-of-date plugins and themes from known exploits until you find time to update them, sealing the very gap attackers reach for first. Because the scanning is constant rather than a once-a-day sweep, most incidents are caught and shut down inside minutes, which keeps the site clean and your visitors out of harm's way.
Does the free SSL certificate have a catch to it?
None at all. No trial window, no first-year-only price, no upsell lying in wait at renewal. Every domain and subdomain on a secure plan picks up its certificate as it goes live, and that certificate re-issues itself ahead of expiry for as long as you host with us. The padlock your visitors look for never disappears, and no invoice for it ever lands. What SSL does is encrypt the path between browser and server, which keeps login details, contact-form entries, checkout information and anything else typed into the site private while it is in transit. It also feeds search rankings, and it stops browsers stamping a 'Not secure' warning across your pages. Your own workload here is zero: issuance and renewal both happen on their own, so the site is encrypted from its first day online.
How often do backups run, and can I restore one on my own?
One backup runs every day without being asked, and it is stored off-server, deliberately well away from the machine it exists to protect. Files and databases are captured in the same pass, so a restore hands you back one complete working site rather than fragments you then have to reassemble. Restoring is entirely yours to do: open the dashboard, choose a recovery point, and roll back the whole account, a single site, or one database. A few clicks, and it is normally finished inside minutes. That daily copy answers nearly everything that goes wrong, from an update that broke the theme to an edit that should never have shipped, an accidental deletion, or something considerably nastier. You never have to remember to start one. And because the copies sit away from the server, they survive even when the live environment itself falls over.
Will the DDoS filtering slow my site down?
No, it will not. The filtering sits at the network edge, a long way upstream of your server, and it works by reading the shape and volume of incoming traffic rather than pulling apart every individual page request. An ordinary visitor passes straight through with zero milliseconds added to the journey. A barrage of packets assembled to overwhelm the site, by contrast, gets soaked up and stripped away before it ever touches your hosting. Capacity for that filtering belongs to the network as a whole rather than to one machine, which is why it can shrug off attacks many times larger than any single server could hope to survive. What that buys you is a site still serving through an assault that would flatten an unprotected host. There is nothing to switch on and nothing to configure. It runs by default on every plan, guarding your uptime whether or not anyone is currently aiming at you.
So what is the 24/7 monitoring actually keeping watch over?
Two things, working together: automated tooling and human engineers, watching the platform through every hour of every day. The automation follows server health, uptime, resource consumption, disk and network behaviour, and the known signatures of intrusion, throwing an alert the instant anything drifts out of its normal pattern. Engineers read those alerts and go after whatever looks suspicious right away, rather than waiting for you to notice a problem and file a ticket. What it covers runs from hardware faults to unusual traffic surges, long runs of failed logins and other early warning signs, which is why plenty of issues are sorted before a visitor ever meets one. Set alongside the firewall, the malware scanning and the daily backups, this is the layer keeping watch while you are asleep or busy with something else. Spot something first? The same 24/7 support team is one message away and happy to dig in beside you.
More hosting to explore
Web Hosting
Our core cPanel platform, sitting on exactly the same quick NVMe stack.
SSL Certificates
Free certificates that renew themselves, encrypting every visit to the site.
WordPress Hosting
Managed WordPress carrying the very same WAF and scanning stack inside it.
Business Hosting
More capacity for growing sites that refuse to trade away security.
Put a permanent guard on your site.
A managed WAF, malware scanning, DDoS filtering, free SSL, daily backups and nonstop monitoring — every bit of it in the price.
Browse Secure PlansSites get attacked by scripts far more often than by people, and scripts lose to patching, filtering and backups — all of which should already be running before the question occurs to you. It rides on NVMe arrays with LiteSpeed leading, in data centres with conditioned power and more than one route out to the internet.
A strong match for owners who take security as seriously as speed. Certificates cost nothing, the migration costs nothing, backups run on their own, and support replies fast no matter the hour.
Security running before you ask
DDoS filtering operates at the network edge, so junk traffic never touches your account. Accounts are walled off from each other, PHP executes per user, and kernel, panel and PHP patches roll across the fleet the moment releases land. Free SSL wraps everything moving between visitor and server.
None of it hinges on the tier you pick. NVMe storage, LiteSpeed with HTTP/2 and the 99.9% uptime SLA hold steady from the smallest plan to the biggest.
Everything the hardening includes
Comparing HostingFast is easy because nothing is concealed. The listed price already carries the certificate, the migration, the backups and the support — the parts other hosts tack on later. Every hosting plan includes a 30-day money-back guarantee, so a test run risks nothing but an afternoon.
Security is not a ladder you pay to climb. Filtering, isolation, patching, certificates and daily backups come on every plan — including the one at $2.42 a month.
The defences between the internet and your site
Sites run in our London datacentre behind edge filtering, on NVMe storage with a backup captured daily. Restores run self-service from the panel, so a bad plugin or a bad day costs minutes, not a rebuild.
Backups fire daily and restores are self-service from the panel: no ticket, no queue, no waiting on office hours we do not keep anyway.
- Every account shielded by edge DDoS filtering
- Per-user PHP inside isolated accounts
- a 99.9% uptime SLA backed by service credits
- Daily backups you restore yourself, in one click
Good to Know
More that's built in
Restores without a ticket
A backup matters only when you can use it. Roll one back straight from the panel — no support queue involved.
A panel that gets out of your way
One screen holds files, databases, mail, DNS and installers, always on a current release.
Scale up without relocating
Step up whenever the site demands it; files, settings and address never move an inch.
Free to leave any time
Your data leaves in the same standard formats it arrived in, and we will lend a hand with the move if it comes to that.
Speed set up for you
Every site lands on NVMe with server-side caching already live — no tuning left for you to do.
Certificates in the price
Every domain ships with self-renewing SSL, so encryption stays out of the upsell column.
Getting Going
Three short steps to get running
- 1
Select a tier
Choose any plan — every tier carries identical protection.
- 2
Hook up the domain
Aim the domain here; SSL installs and renews on its own.
- 3
Open for traffic
Migrate free, then leave the patching, filtering and backups to run.
In Every Plan
Comes with the plan, no surcharge
- 30 days to change your mind on any hosting plan
- Fleet-wide patching by our engineers
- Daily backups you restore yourself
- Upgrade tiers without your files going anywhere
- UK-registered company, pricing in US dollars
- Shaped around owners who take security as seriously as speed
- Every hosted domain gets SSL free
- Our engineers run your migration at no cost
Still Curious
Questions that keep coming up
Suppose my site gets hacked regardless — then what?
Contact the desk and we get to work. A daily backup stands ready to restore, logs pinpoint when the change happened, and engineers help trace the plugin or password that opened the door. Nobody suspends you and disappears, and the restore adds nothing to your bill.
Do I wait around after ordering?
Within minutes of checkout. Migrating from another host adds a day at most and is free — files, databases, mail and DNS all handled by our engineers.
Do certificates cost anything?
Free, installed and renewing on its own. You would only buy a certificate for a wildcard or a validated seal that procurement demands.
What if secure web hosting is not right for me?
The plan carries a 30-day money-back guarantee. Say the word within the month and the refund goes through — no exit interview, no hand-off to a retention team paid to argue with you.
Keep reading
SSL Certificates
Self-renewing SSL, free or paid as you need.
Mail Filtering
Spam intercepted before it can reach the inbox.
Web Hosting
NVMe cPanel hosting from $2.42/mo with SSL and migration in.
Handpicked from the Resource Library
Securing Your Hosting Account
The account-level lockdown most site owners skip.
Scanning a Site for Malware
Catching an infection before Google's blocklist catches you.
WAFs, Defined
The web application firewall, stripped of its mystery.