Secure web hosting services should include a web application firewall, DDoS protection, account isolation, bot protection, free SSL, and automatic backups at no extra cost. Malware cleanup, hourly backups, and advanced scanning are usually paid add-ons. Once you know which group a feature belongs to, any host’s pricing page gets a lot easier to read.
Key takeaways:
- Six protections belong in every secure hosting plan by default: a WAF, DDoS protection, account isolation, bot protection, free SSL, and daily backups.
- Server-level protections have to come from the host, because you can’t install a network firewall or isolate accounts on a shared server yourself.
- Backup retention matters as much as frequency: if an infection goes unnoticed longer than your host keeps backups, every restore point is already compromised.
- Check whether malware scanning, malware cleanup, and hourly backups are included or sold separately, since that’s where plans at the same price differ most.
- When you compare secure web hosting services, sort each feature into one of three groups: included by default, available as an add-on, or not offered.
- SiteGround includes all six default protections on every plan, and its brute-force defense blocks an average of 1.4 billion malicious requests per day.
What secure hosting should include by default
Secure hosting should include every protection that runs at the server or network level, because those are the parts of web hosting security you can’t add yourself. A website plugin can’t filter traffic before it reaches the server, and you can’t separate your hosting account from its neighbors on a shared machine. If the plan doesn’t include these, you’re not getting them.
SiteGround runs all of these on every hosting plan as part of its enterprise-grade security system, which runs health checks every 0.5 seconds to spot and fix issues.
Web application firewall (WAF) and account isolation
A web application firewall filters malicious requests before they reach your site, including known attack patterns against WordPress, plugins, and forms. What separates a strong WAF from a basic one is who writes the rules and how fast.
SiteGround’s security team writes its own WAF rules, including virtual patches for newly disclosed plugin vulnerabilities where possible, which can block an exploit before the plugin’s developer ships a fix. The WAF runs on all servers, and there’s nothing to configure.
Account isolation matters most on shared hosting. It keeps each account’s files and database separate, so a compromised site on the same server can’t read or change yours. SiteGround isolates each account on its servers, on every plan.
DDoS protection
DDoS protection filters floods of fake traffic at the network level, before they overload the server your site runs on. Without it, a relatively small attack can take a site offline for hours, even if nothing on the site itself was hacked. SiteGround includes DDoS protection on all plans.
This included protection covers the baseline. For sites that become direct targets, CDN Premium adds a second layer at the network edge, covered in the paid add-ons below.
AI anti-bot and brute-force protection
Bot protection stops automated login attempts and malicious crawlers before they reach your site. Brute-force attacks don’t need a vulnerability. They just need a login page and a list of common passwords, and bots can cycle through those lists far faster than any person could.
SiteGround’s AI anti-bot system blocks this traffic at the server level, so it never reaches your WordPress login form and doesn’t eat into your site’s resources.
SSL, auto-updates, and backups: on by default
SSL, automatic updates, and backups should come switched on with any secure hosting plan, not as setup tasks you have to remember. They’re still settings, though, and parts of them can be changed later, sometimes by a developer who meant to change them back. On SiteGround, all three are on from day one and managed in Site Tools. A two-minute check after signing up confirms they’re all set the way you expect.
Free SSL
An SSL certificate encrypts data between the visitor’s browser and your server, which protects logins, forms, and checkout details in transit. It doesn’t protect the site itself: a hacked site with a valid certificate still shows the padlock. When comparing hosts, check whether SSL is free for good or only for the first year, and whether it renews on its own. SiteGround installs free Let’s Encrypt certificates and renews them automatically, so there’s no expiry date to track.
Automatic updates
Automatic updates close known vulnerabilities in WordPress core and plugins before attackers get to them. When comparing hosts, check whether updates run automatically, whether you control their timing, and whether there’s a backup to roll back to if an update breaks something. On SiteGround, the in-house WordPress Autoupdate tool runs from Site Tools > WordPress > Autoupdate, where you set how soon after a new release your site updates and whether plugins update along with WordPress.
Before every update, the tool creates a backup and then emails you to let you know your site has been updated. If anything looks broken when you check it, you can restore the pre-update backup with one click. Premium plugins may not update this way because of their license validation, so it’s worth checking those yourself.
Daily backups
Daily backups give you a clean restore point when something breaks, whether that’s malware, a bad update, or a developer’s mistake. SiteGround creates automatic backups for all sites, keeps up to 30 daily copies on shared hosting, and stores them in geo-distributed locations at no extra charge. You restore them from Site Tools > Security > Backups, without opening a support ticket.
Retention depth matters as much as frequency. If an infection sits undetected for 10 days and your host only keeps seven backups, every restore point is already compromised. That’s one reason daily backups may not be enough for busy stores, which the next section covers.
Common paid add-ons, and when they’re worth it
Paid security add-ons cover detection, cleanup, and faster recovery: the parts of security that happen after something gets through. Paid doesn’t mean optional for everyone. A five-page brochure site and a store taking 50 orders a day need very different coverage.
Site Scanner, Premium Backups, and CDN Premium are priced per site and ordered from Client Area > Marketplace > Hosting > Additional Services. Expert Care works differently: it’s a monthly subscription with credits you can use across your sites, ordered from Client Area > Services > Expert Care.
| Add-on | What it adds | Worth it if | At SiteGround |
| Malware scanning | Regular file and URL scans, instant alerts | Nobody checks the site regularly, or it runs many plugins | Site Scanner Basic or Premium |
| Malware cleanup | Automated or hands-on removal | Nobody on the team can clean a hacked site | One-click cleanup with Site Scanner Premium; hands-on cleanup via Expert Care |
| More frequent backups | Hourly restore points, downloadable copies | A day of lost orders or content is too much | Premium Backups |
| Edge protection | Attack mode at the CDN, extra caching | The site gets targeted attacks or can’t go down during traffic spikes | CDN Premium |
Malware scanning
Malware scanning finds infections early, before visitors, Google, or your customers do.
What matters is what gets scanned and how often: URL scans catch infections that show up on your public pages, while file scans find malicious code hidden on the server. Daily file scans with instant alerts are the standard to look for.
SiteGround Site Scanner Basic scans your site’s URLs and checks your domain against blacklists every day, runs an automated scan of all your files every week, and lets you run up to 10 full scans a day on demand. It also includes Site Protect, which lets you shut off FTP, SSH, PHP uploads, or PHP shell commands if you suspect someone is trying to get in. Site Scanner Premium moves file scans from weekly to daily, covering subdomains and staging copies, and can quarantine newly uploaded files that look suspicious.
Quarantine is off by default, so turn it on in Site Tools > Security > Site Scanner if your site accepts uploads.
Malware cleanup
Malware cleanup removes an infection once it’s found, and it’s usually the most urgent paid service. Hosts handle it in different ways: some include automated cleanup, some bill per incident, and some leave it to a third-party service.
At SiteGround, Site Scanner Premium includes one-click cleanup for detected malware. If the automated cleanup can’t fix the issue, SiteGround’s support team reviews the case manually, and an extra cleanup fee may apply. With an Expert Care subscription, a full malware cleanup (code removal, a review of the site, and security recommendations) is one of the tasks you can request using your monthly credits. It’s worth having a plan before you need it, because the steps in cleaning up a hacked site go wrong fast when you’re improvising.
More frequent backups
Daily backups leave up to a day of changes unprotected. For a store, that gap is concrete: restoring a 6 AM backup at 3 PM wipes out every order placed in between. Hourly backups narrow it to under an hour, and downloadable backups give you a copy outside your host’s servers.
SiteGround’s Premium Backups adds hourly backups, kept for 48 hours, on top of the daily copies, plus seven extra days of daily backups, five more manual backup slots, and downloads for any backup.
CDN-level protection
Included DDoS protection covers the baseline, but a site that becomes a direct target may need protection at the edge of the network, where suspicious visitors are challenged before they reach the server. Hosts usually offer this as part of a premium CDN tier rather than the base plan.
At SiteGround, it comes with CDN Premium, whose main security feature is Under Attack Mode. You switch it on from Site Tools > Speed > CDN when you suspect a DDoS attack: every visitor sees a short verification page, and any visit that can’t be verified automatically gets a challenge to prove it’s a real person. Under Attack Mode switches itself off after 24 hours, so it’s a tool for riding out an attack, not something you leave on.
The same plan adds dynamic content caching, CDN coverage for subdomains and parked domains, and a Keep Site Online mode, which makes it worth a look for stores and other sites that can’t afford to go down during a traffic spike.
How to compare secure web hosting services
Compare secure web hosting services by sorting each security feature into three groups: included by default, available as an add-on, or not offered. The headline price only tells you part of the story. Two plans at the same price can land very differently once you add the backups and scanning one of them charges extra for. Use the “What to check” column on any host’s pricing page, and see how SiteGround fills it in:
| Feature | What to check | SiteGround |
| Firewall/WAF | Included on every plan, or only on higher tiers? | ✓ In-house WAF on every plan, nothing to configure |
| DDoS and bot protection | Filtered at the network level, before traffic reaches your site? | ✓ DDoS protection and AI anti-bot system |
| Account isolation | Is your account separated from others on a shared server? | ✓ On every plan |
| SSL | Free for good, or only for the first year? | ✓ Free for good, auto-renewed |
| CDN | Included on every plan | ✓ Free CDN; Under Attack Mode with CDN Premium |
| Automatic updates | Is there a backup to roll back to if an update breaks something? | ✓ Backup before every update, one-click restore |
| Backups | How often, how many copies, and can you restore without a ticket? | ✓ Daily: 30 copies on shared, 7 on Cloud, one-click restore; hourly with Premium Backups |
| Monitoring and reports | Does the host tell you what it’s blocking, without you asking? | ✓ Health checks every 0.5 seconds, free Monthly Security Reports |
| Malware scanning | Daily file scans, and instant alerts when something’s found? | Add-on: Site Scanner, worth adding for stores and client sites |
| Malware cleanup | Is cleanup included, automated, or billed per incident? | Add-on: one-click cleanup with Site Scanner Premium, or hands-on cleanup via Expert Care |
| 2FA | Available for the hosting account? | ✓ For your SiteGround account |
| Support | Can you reach a person 24/7 during an incident? | ✓ 24/7 phone, chat, and tickets |
Most sites are well covered by what’s included. Add-ons are there for sites that need more, like a store that can’t afford to lose an afternoon of orders, and they’re added from the same account, with no third-party plugins to install.
Two-factor authentication and access controls
Two-factor authentication should be available for both your hosting account and your site’s admin, because a stolen password is still the easiest way in. On SiteGround, you turn it on for your hosting account from Client Area > Login & Profile. Also check whether you can give developers their own access instead of sharing your login, so you can remove them when the project ends.
Security support
Security support is what your host does when something actually goes wrong, and it’s where plans differ most in the fine print. Ask two things: can you reach support 24/7 during an incident, and which parts of the fix are billed separately? At SiteGround, 24/7 support is included on every plan, while hands-on malware cleanup falls under paid services.
How to spot a paid add-on on a pricing page
Whether a feature is included or extra usually comes down to the wording. Look for these signals on any host’s pricing page:
- “Available,” “optional,” or “add-on” next to a feature, instead of a checkmark.
- “Starting at” pricing in a footnote, which usually means an extra monthly fee.
- Features listed only in the full plan comparison table, not on the main pricing cards.
- Security extras that appear for the first time at checkout. Read what each one covers, and keep only the ones your site needs.
A pricing page won’t tell you everything, though. For the questions to ask a host’s support team, like how fast they patch or how accounts are isolated, the answers show you what’s behind the checkmarks.
How SiteGround compares to other hosts
If you already have a specific host in mind, SiteGround’s head-to-head pages lay out the plan-level differences, from backups to migration: SiteGround vs. Bluehost, SiteGround vs. Hostinger, and SiteGround vs. GoDaddy. And if you’re already planning to leave your current host, the guides to alternatives to Bluehost and alternatives to GoDaddy cover what to look for before you switch.
Choosing a secure web hosting service
When comparing secure web hosting services, start with the protections included in the base plan. A firewall, DDoS protection, account isolation, SSL, and daily backups should be part of your checklist, not unexpected expenses.
Then look at what your website actually needs. A small business website may be well covered by daily backups and the included protections, while an online store may benefit from more frequent backups and malware monitoring. Security is one part of the decision, so weigh it alongside support, speed, and growth room when you choose a web hosting partner. A host that can’t tell you which column a feature belongs in has already answered the question.
Every SiteGround plan comes with its core security protections switched on, from the in-house WAF to geo-distributed daily backups. There’s nothing to install and nothing to configure: the protections run from the moment your site goes live.
As your site grows, optional services add extra coverage when you need it. Explore SiteGround’s hosting plans to compare what’s included and what you can add along the way.
[86]
Frequently asked questions about web hosting security
Secure web hosting services include server-level protections by default: a web application firewall, DDoS and bot protection, account isolation, free SSL, and daily backups. SiteGround includes all of these on every plan, so there’s no separate security tier to buy.
Web hosting includes some security, but not all of it. Server-level protections like firewalls and backups are usually included, while malware scanning and cleanup are typically paid add-ons.
Backups are included with some web hosting plans, like SiteGround’s, and cost extra with others, so check three things when a host says backups are included: how often they run, how many copies are kept, and whether restoring one costs extra. SiteGround runs daily backups on every plan, keeps up to 30 copies on shared hosting and 7 on Cloud, and lets you restore them yourself at no extra cost.
Security reports from your web hosting company should show what’s being blocked, how protected your site is, and what you could improve. SiteGround sends free Monthly Security Reports for every site, with an overall security score, a breakdown for each check (from bot traffic blocked to backups and 2FA), and tips for anything that needs attention. If you add Site Scanner, you also get an instant email when malware is detected and a weekly summary of your site’s status.
Hosting security add-ons are usually priced per site, per month, and vary by host. At SiteGround, Site Scanner, Premium Backups, and CDN Premium are priced per site in the Client Area Marketplace, while Expert Care is a monthly subscription, so you only pay for what your site needs. Current prices are shown in your local currency before checkout.







