Security As Standard
Defences running before you even log in
Every plan lands with a managed WAF, Imunify360 malware scanning, DDoS filtering, free SSL, daily backups and 24/7 monitoring already live. Nothing to bolt on, nothing extra to buy.
Free
SSL for each domain you host
Daily
Automatic backup runs
24/7
The platform watched, nonstop
Layer 7
DDoS and firewall coverage
Layered Defence
Six defences standing between threats and your site
Protection most hosts sell as paid extras. Here the whole stack is built into the plan price from the start.
Managed web firewall (WAF)
Every request is checked against an always-current catalogue of attack signatures before your code sees it, stopping SQL injection, cross-site scripting and the other familiar exploits at the gate.
Imunify360 malware detection
Files are watched without pause, and anything infected is quarantined the moment it surfaces. Stale plugins pick up a virtual patch that covers them until you update.
DDoS absorbed at the edge
Flood traffic and hostile packets are identified and dropped on the network perimeter, well upstream of your server. Genuine visitors sail through none the wiser.
Self-renewing free SSL
Each domain on the account receives a certificate that stays current automatically, keeping traffic encrypted and the padlock permanently lit.
A backup taken daily
Files and databases are copied off the server every day, leaving a clean restore point you can roll back to within minutes.
Monitored every hour of the year
Automation plus real engineers track server health, uptime and intrusion attempts continuously — nights, weekends and holidays included.
The WAF
Hostile requests stopped before entry
Every request is inspected before your application runs a line of code. Malicious payloads and probing bots get bounced at the perimeter while real visitors pass at full speed — no plugin to add, no rules for you to maintain.
- SQL injection and XSS blocked outright
- Recognised bots and exploits filtered
- Abusive traffic slowed automatically
- Rules tuned and updated for you
Malware Scanning
Imunify360 stops infections spreading
Imunify360 never stops reading your files. Malicious code is isolated and reported the instant it appears, boxing the problem in before it can creep outward — while virtual patching shields outdated software until you update on your own schedule.
- Continuous scanning, plus on every upload
- Quarantine happens without your input
- Outdated plugins get virtual patches
- Clear alerts posted to your dashboard
The Handoff
How the six layers back each other up
No single control stops everything. Each layer covers the gaps in the last one, so getting through means beating all six in a row.
- 1
Traffic hits the DDoS filter first
Volume floods and obvious junk are absorbed and discarded at the network edge before your server is ever involved, so uptime holds.
- 2
The WAF screens the remainder
Whatever survives the edge meets the managed firewall, which rejects injection payloads, cross-site scripting and the rest of the application-level exploits.
- 3
Isolation contains whatever lands
Your site runs inside its own sealed environment, so an incident on a neighbouring account on the same server has no route across.
- 4
Imunify360 checks each file on arrival
Everything written to disk is scanned immediately — infections are quarantined on sight, and out-of-date software receives a virtual patch.
- 5
SSL encrypts the whole exchange
Every conversation between visitor and site travels encrypted end to end, so nothing in transit can be read or altered along the way.
- 6
Backups stand as the final net
Should something break through anyway, daily off-server copies put the entire site back to a clean point within minutes.
Plans
One security stack across every plan
All three sizes carry the identical protection. Start where your site is today and step up as it grows.
Sprint
One website, live in minutes, at our lowest entry price
$2.42/mo
$29.04 today · billed annually
the price never jumps at renewal
- SSD storage
- 10 GB
- Websites
- 1
- Bandwidth
- 500 GB
- CPU / RAM
- 1 core / 2 GB
- Databases
- 25 MySQL
- Your first year's domain registration is on us
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — tell it what you want, go live
- WordPress Toolkit on board, plus a fresh backup daily
- Full SSH access with Git and Composer on tap
- Softaculous installs 240+ apps in one click
- ImunifyAV+ sweeps every site for malware
- NVMe SSD storage behind a LiteSpeed cache
- Mailboxes on your own domain, included
- MailChannels gets your outbound mail delivered
- The latest cPanel, with humans on support 24/7
- Your account goes live minutes after checkout
Checkout happens on Hosting Cheap, the billing platform that powers our orders.
Turbo
Twenty-five sites running flat out on a single account
$4.66/mo
$55.92 today · billed annually
the price never jumps at renewal
- SSD storage
- 20 GB
- Websites
- 25
- Bandwidth
- 1 TB
- CPU / RAM
- 1 core / 2 GB
- Databases
- 50 MySQL
- Your first year's domain registration is on us
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — tell it what you want, go live
- WordPress Toolkit on board, plus a fresh backup daily
- Full SSH access with Git and Composer on tap
- Softaculous installs 240+ apps in one click
- ImunifyAV+ sweeps every site for malware
- NVMe SSD storage behind a LiteSpeed cache
- Mailboxes on your own domain, included
- MailChannels gets your outbound mail delivered
- The latest cPanel, with humans on support 24/7
- Your account goes live minutes after checkout
Checkout happens on Hosting Cheap, the billing platform that powers our orders.
Nitro
200 GB of NVMe and the muscle to drive every byte of it
$7.08/mo
$84.96 today · billed annually
the price never jumps at renewal
- SSD storage
- 200 GB
- Websites
- 100
- Bandwidth
- 2 TB
- CPU / RAM
- 2 cores / 4 GB
- Databases
- 100 MySQL
- Your first year's domain registration is on us
- WordPress Toolkit Deluxe included at no added cost
- Backups land every 6 hours, with Imunify360 in front
- PHP X-Ray on CloudLinux Pro pinpoints slow code fast
- Ship code in Node.js, Python or Ruby — all pre-wired
- Priority support at any hour, day or night
- Free SSL that renews itself before it can lapse
- Free migration — we bring your site over from your old host
- AI site builder built in — describe it and publish
- NVMe SSD storage behind a LiteSpeed cache
- SSH, Git and Composer at the command line
- Softaculous installs 240+ apps in one click
- Your account goes live minutes after checkout
Checkout happens on Hosting Cheap, the billing platform that powers our orders.
More Safeguards
Three quieter protections on duty
Login hammering shut down
Strings of failed logins trigger throttling and IP bans, cutting off bots grinding away at your admin or mail credentials.
Virtual patches land first
When a vulnerability goes public, a firewall-level patch closes it fast — often ahead of the vendor shipping an official fix.
Hard walls between accounts
Your account runs sealed off from every other one on the server, so a compromise next door has no path to your site.
Recovery & Uptime
A fresh copy daily, and eyes on it always
Strong defences still deserve a fallback. Automated daily backups can return the entire site within minutes, while uptime and intrusion monitoring runs without pause — and real people stand ready to step in.
- Off-server backups every day
- Full-site restore with one click
- Monitoring with no off-hours
- Free SSL renewing on its own
How It Works
Protected in three quick moves
- 1
Pick your plan
Every tier arrives with the WAF, malware scanning, DDoS filtering and daily backups already live. Nothing extra to attach.
- 2
Move your site in
Point the domain at us, or let our team migrate you at no charge. SSL is issued automatically the instant the site goes live.
- 3
Let it run itself
Glance at clean scan results and uptime in your dashboard whenever you like — monitoring and backups keep working underneath either way.
All Standard
Each item here comes with every plan
- A managed WAF shielding every site
- Malware scanning via Imunify360
- Automatic quarantine of infected files
- Network-level DDoS filtering
- Free SSL that renews unaided
- Daily backups stored off-server
- One-click restores
- Defences against brute-force logins
- Full isolation between hosting accounts
- 24/7 monitoring and support
FAQ
Secure hosting, asked and answered
Which attacks can the firewall actually block?
Every request is weighed against a signature library of known attacks — one our team keeps current — before your site's code ever runs it. That intercepts SQL injection aimed at your database, cross-site scripting payloads built to hijack visitor sessions, remote file inclusion, directory traversal and command injection. The same screening strains out abusive bots, credential-stuffing tools and probes hunting familiar plugin or theme flaws. None of it asks for rules from you — tuning and updating the firewall is our job as new threats emerge. Legitimate visitors pass through without any added friction, while hostile requests are discarded at the edge before your server spends a cycle on them. The practical upshot: the bulk of everyday attacks never gets within reach of your application, your database or your files.
How does Imunify360 find and deal with malware?
Imunify360 ships with every secure plan. It scans continuously in the background and again the instant any file is uploaded or changed. When something malicious turns up — a hidden backdoor, a defaced page, a phishing kit, a script pumping out spam — the file goes straight into quarantine, keeping the infection contained instead of creeping through the account. The dashboard lists exactly what was caught and where, and you can inspect or restore anything yourself. Detection is only half the story: virtual patching shields out-of-date plugins and themes from known exploits until you find time to update, sealing the gap attackers most often aim for. And because scanning runs constantly rather than once a day, most incidents are caught and shut down within minutes — keeping the site clean and your visitors out of harm's way.
Is there any catch to the free SSL certificate?
None — no trial period, no first-year-only pricing, no upsell waiting at renewal. Every domain and subdomain on a secure plan receives its certificate as it goes live, and that certificate re-issues itself before expiry for as long as you host here. The padlock visitors look for never vanishes, and no invoice for it ever appears. SSL's job is to encrypt the path between browser and server, so login details, contact-form entries, checkout information and anything else typed into the site stays private in transit. It also feeds into search rankings and stops browsers stamping a 'Not secure' warning across your pages. Your side of the work is nil: issuance and renewal both happen automatically, meaning the site is encrypted from its first day online.
When do backups happen, and can I restore them on my own?
A backup runs automatically every day and is stored off-server, deliberately distant from the machine it exists to protect. Files and databases are captured together, so a restore brings back one complete working site rather than fragments needing reassembly. Restoring sits entirely in your hands: open the dashboard, pick a recovery point, and roll back the full account, one site, or a single database — a few clicks, usually finished inside minutes. That daily copy answers nearly everything that can go wrong: an update that broke the theme, an edit that shouldn't have shipped, an accidental deletion, or something nastier. You never have to remember to start one, and since the copies live away from the server, they survive even when the live environment itself hits trouble.
Will the DDoS filtering slow my site down?
It won't. Filtering runs at the network edge, well upstream of your server, and works by reading the shape and volume of incoming traffic rather than dissecting individual page requests. Ordinary visitors pass straight through with zero milliseconds added, while a barrage of packets built to overwhelm the site is absorbed and stripped away before it ever reaches your hosting. The filtering capacity belongs to the network as a whole rather than one machine, so it can shrug off attacks many times larger than a single server could ever survive. The result for you is a site that keeps serving through an assault that would flatten an unprotected host. There is nothing to enable and nothing to configure — it runs by default on every plan, guarding your uptime whether or not anyone happens to be aiming at you.
What does the 24/7 monitoring actually keep an eye on?
It pairs automated tooling with human engineers watching the platform through every hour of every day. The automation tracks server health, uptime, resource consumption, disk and network behaviour, and the known signatures of intrusion, raising an alert the instant something drifts out of pattern. Our engineers read those alerts and chase anything suspicious straight away — not after you notice a problem and file a ticket. Coverage spans hardware faults, unusual traffic surges, strings of failed logins and other early warning signs, which means many issues get resolved before a visitor ever meets them. Together with the firewall, malware scanning and daily backups, this is the layer standing watch while you're asleep or busy elsewhere. And if you catch something first, the same 24/7 support team is one message away and ready to dig in beside you.
More hosting to explore
Web Hosting
The main cPanel platform, running on the identical fast NVMe stack.
SSL Certificates
Self-renewing free certificates encrypting every visit to your site.
WordPress Hosting
Managed WordPress with this same WAF and scanning stack built in.
Business Hosting
Extra capacity for expanding sites that won't compromise on security.
Give your site a standing guard.
A managed WAF, malware scanning, DDoS filtering, free SSL, daily backups and nonstop monitoring — every bit of it in the price.
Browse Secure PlansSites get attacked by scripts far more often than by people, and scripts lose to patching, filtering and backups — all of which should already be running before the question occurs to you. It rides on NVMe arrays with LiteSpeed leading, in data centres with conditioned power and more than one route out to the internet.
A strong match for owners who take security as seriously as speed. Certificates cost nothing, the migration costs nothing, backups run on their own, and support replies fast no matter the hour.
Security running before you ask
DDoS filtering operates at the network edge, so junk traffic never touches your account. Accounts are walled off from each other, PHP executes per user, and kernel, panel and PHP patches roll across the fleet the moment releases land. Free SSL wraps everything moving between visitor and server.
None of it hinges on the tier you pick. NVMe storage, LiteSpeed with HTTP/2 and the 99.9% uptime SLA hold steady from the smallest plan to the biggest.
Everything the hardening includes
Comparing HostingFast is easy because nothing is concealed. The listed price already carries the certificate, the migration, the backups and the support — the parts other hosts tack on later. Every hosting plan includes a 30-day money-back guarantee, so a test run risks nothing but an afternoon.
Security is not a ladder you pay to climb. Filtering, isolation, patching, certificates and daily backups come on every plan — including the one at $2.42 a month.
The defences between the internet and your site
Sites run in our London datacentre behind edge filtering, on NVMe storage with a backup captured daily. Restores run self-service from the panel, so a bad plugin or a bad day costs minutes, not a rebuild.
Backups fire daily and restores are self-service from the panel: no ticket, no queue, no waiting on office hours we do not keep anyway.
- Every account shielded by edge DDoS filtering
- Per-user PHP inside isolated accounts
- a 99.9% uptime SLA backed by service credits
- Daily backups you restore yourself, in one click
Good to Know
More that's built in
Restores without a ticket
A backup matters only when you can use it. Roll one back straight from the panel — no support queue involved.
A panel that gets out of your way
One screen holds files, databases, mail, DNS and installers, always on a current release.
Scale up without relocating
Step up whenever the site demands it; files, settings and address never move an inch.
Free to leave any time
Your data leaves in the same standard formats it arrived in, and we will lend a hand with the move if it comes to that.
Speed set up for you
Every site lands on NVMe with server-side caching already live — no tuning left for you to do.
Certificates in the price
Every domain ships with self-renewing SSL, so encryption stays out of the upsell column.
Getting Going
Set up in three quick steps
- 1
Select a tier
Choose any plan — every tier carries identical protection.
- 2
Hook up the domain
Aim the domain here; SSL installs and renews on its own.
- 3
Open for traffic
Migrate free, then leave the patching, filtering and backups to run.
In Every Plan
Bundled in at no extra cost
- 30 days to change your mind on any hosting plan
- Fleet-wide patching by our engineers
- Daily backups you restore yourself
- Upgrade tiers without your files going anywhere
- UK-registered company, pricing in US dollars
- Shaped around owners who take security as seriously as speed
- Every hosted domain gets SSL free
- Our engineers run your migration at no cost
Still Curious
Questions that keep coming up
Suppose my site gets hacked regardless — then what?
Contact the desk and we get to work. A daily backup stands ready to restore, logs pinpoint when the change happened, and engineers help trace the plugin or password that opened the door. Nobody suspends you and disappears, and the restore adds nothing to your bill.
Do I wait around after ordering?
Within minutes of checkout. Migrating from another host adds a day at most and is free — files, databases, mail and DNS all handled by our engineers.
Do certificates cost anything?
Free, installed and renewing on its own. You would only buy a certificate for a wildcard or a validated seal that procurement demands.
What if secure web hosting is not right for me?
The plan carries a 30-day money-back guarantee. Say the word within the month and the refund goes through — no exit interview, no hand-off to a retention team paid to argue with you.
Keep reading
SSL Certificates
Self-renewing SSL, free or paid as you need.
Mail Filtering
Spam intercepted before it can reach the inbox.
Web Hosting
NVMe cPanel hosting from $2.42/mo with SSL and migration in.
Handpicked from the Resource Library
Securing Your Hosting Account
The account-level lockdown most site owners skip.
Scanning a Site for Malware
Catching an infection before Google's blocklist catches you.
WAFs, Defined
The web application firewall, stripped of its mystery.