Security
Where our job ends and yours starts
Every plan's built-in protections, how payment data stays out of our hands, where your files physically sit, how to disclose a flaw — plus an honest split of the risks we carry and the ones you do.
On Every Plan
No security extras to buy. It is all in.
Each control listed here ships with every plan, right down to the cheapest. Nothing below costs a cent extra.
HTTPS sorted before you arrive
A free SSL certificate lands on each domain without being asked for, and it renews itself before expiry arrives. Nothing to set up, nothing to diarise, nothing to pay.
Hostile traffic cut off early
DDoS mitigation at the network level, plus a web application firewall, strip malicious requests out before they get near your account. A flood pointed at you does not put the site on the floor.
Malware found without you looking
Imunify360 works away in the background, raising a flag on known malware and odd file changes. A poisoned plugin gets caught early instead of sitting there festering.
Restores you run yourself
Daily backups run on their own across every plan, and more often than daily on the higher tiers. Restoring happens straight from the control panel, with no ticket to raise.
Accounts sealed from each other
Every account on the shared platform runs isolated from the rest, which means a site breached elsewhere on that server never turns into your emergency.
Your card never reaches us
Payment details are collected and stored by Stripe. All we hold is a token plus the final four digits. There is no card number sitting on our side for anybody to steal.
Complete List
Running from day one
- Self-renewing free SSL for each domain
- Network-level DDoS mitigation
- A web application firewall out front
- Malware detection by Imunify360
- Automatic backups running daily
- Self-service restores from the panel
- Isolation between shared hosting accounts
- Two-factor authentication on your login
- Defences against brute-force logins
- Current PHP releases, security patches applied
Disclosure
Spotted a weakness? Report it.
We'd much rather the first report of a flaw came from you than from a headline.
Send info@hostingfastnet.com enough detail that we can reproduce what you found. Receipt gets confirmed, and we will keep you updated while the fix is rolled out.
Leave us a reasonable window to close the issue before you publish, and keep your testing well clear of other customers: no denial-of-service runs, and no reaching after data that belongs to somebody else. There is no paid bounty here, so a reward is not something we can promise, though credit is yours for the asking.
Spotted phishing, spam or malware on a site we host? Send it to report abuse instead of here. Questions about data protection belong in our privacy policy.
Common Questions
Security, answered plainly
How safe are my card details here?
Card details go directly to Stripe, one of the largest payment processors going, and they stay on Stripe infrastructure rather than ours. What our own systems get is a payment token and the final four digits. Never the full number, never the security code. That is a practical decision as much as a technical one. If somebody broke into our servers tomorrow, there would be no card numbers there for them to carry off.
What's your position on PCI compliance?
PCI breaks down into shared responsibilities, so the honest answer depends which piece you are asking about. Card handling sits wholly on Stripe's side and never crosses our servers at all, which puts those obligations with Stripe, and Stripe holds PCI DSS Level 1 certification. Your own store works the same way. Route payments through a gateway like Stripe or PayPal that handles cards on its own infrastructure, and you land in the lightest PCI bracket, usually a short self-assessment questionnaire. Our share of the work is the encrypted, isolated, monitored platform underneath your site. Your share is patched software and strong admin passwords.
Are you certified to ISO 27001, SOC 2 or anything similar?
No, and we would sooner say so than dance around the question. HostingFast is a small, young company, and we have not been through ISO 27001 or SOC 2. Both are serious undertakings, and claiming either without holding it would be considerably worse than owning up to their absence. What we can put in front of you instead is a verifiable legal identity, a named upstream platform, the concrete controls written out on this page, and a disclosure channel that actually works when someone uses it. Where certification is a hard requirement on your side, we will tell you plainly that we are the wrong provider rather than burn weeks of your time.
Where does my data actually live, and who can reach it?
Everything lives in a London datacentre, files and databases alike. Access is restricted to the staff who genuinely need it, either to keep the platform running or to answer a ticket you have opened. We never sell customer data, and your site content serves no purpose here beyond running the service itself. All the legal detail sits in our privacy policy: lawful basis for processing, how long things are retained, and which sub-processors are involved.
What's the process for reporting a vulnerability?
Write to info@hostingfastnet.com with the specifics and we will acknowledge the report. We ask for a reasonable window to investigate and ship a fix before anything goes public, and for testing that never degrades service for other customers or reaches data that isn't yours — so no denial-of-service attempts and no probing of other accounts. We run no paid bounty and cannot promise a reward, but we will credit you if you'd like, and we will keep you informed as the fix goes in.
Which parts of security are down to me?
Defending the platform is our job: server, network, firewall, malware scanning, backups, encryption. Whatever you deploy on top of it belongs to you. In practice that means keeping WordPress, plugins and themes patched, running strong unique passwords with two-factor switched on, pulling out plugins you no longer use, and thinking twice before installing somebody's code. Almost every hacked site that reaches us was not breached through the server at all. The way in was an outdated plugin, or a password recycled from somewhere else.
And if my site gets compromised regardless? What then?
Open a ticket and we get moving. The usual order of things: work out how they got in, restore from a clean backup taken before the infection landed, then close the hole so the same trick fails a second time. That is exactly why automatic daily backups matter more than any single preventative layer. Recovery is the bit that actually rescues you. And where the root cause turns out to be an abandoned plugin or a weak password, we will say so straight out, because otherwise you will be back with us inside the month.
Protection that comes as standard.
Every plan — even the $2.42 one — carries SSL, DDoS filtering, malware scanning and daily backups.
See Hosting Plans