WordPress hosting that answers to your security review.
Security teams are rarely the ones choosing the host and always the ones signing off on it. The questions you have to answer are about evidence, isolation and how fast a CVE gets patched.
Everything a security review asks of a host.
Not a feature list — the specific things a reviewer asks for evidence of, and where that evidence comes from.
Every administrative action is recorded
Logins, plugin changes, user role edits and file writes are logged with actor and timestamp, and the log is exportable rather than only viewable in a dashboard.
Access you control centrally
Single sign-on with enforced two-factor, per-user roles, and one-click admin login that leaves a record instead of a shared password in a password manager.
One compromised site is one compromised site
Each site runs in its own container with its own filesystem and database credentials, so lateral movement between sites on the same account is not a path that exists.
A named window for patching
Core and plugin vulnerabilities are patched to a committed timeline rather than to best effort, and the change is visible per item rather than as a single 'updated' flag.
Backups you can prove restore
Daily snapshots replicated off the origin, with restores you can rehearse on staging rather than discover the state of during an incident.
The things a reviewer asks to see.
Most hosting security pages describe controls. What a review actually needs is the artefact — the log, the isolation boundary, the retention setting.
- Exportable audit log with actor and timestamp
- SSO and enforced two-factor on all accounts
- Per-site isolation, no shared credentials
- Documented retention and restore rehearsal
Blast radius, measured.
The security question that matters is not whether a site can be compromised but what a compromise reaches. Isolation is what decides that.
What we configure for a security team
These differ from a standard site on the same plan, and each exists because somebody has to produce evidence for it during a review.
| Setting | What we do | Why |
|---|---|---|
| Audit log export | Streamed to your own collector rather than held only in our dashboard | Evidence that lives exclusively in a vendor's interface cannot be correlated with the rest of your estate, and it disappears at exactly the moment a dispute about the vendor makes it most relevant. |
| Authentication policy | SSO with two-factor enforced at the account level, not per user | A control that individual users may opt out of is not a control a reviewer can accept, because its coverage is a matter of habit rather than of configuration. |
| Credential scope | Separate database users and filesystem boundaries per site | Sharing one database account across an estate means the impact of a single leaked credential is the whole estate, which turns a routine plugin vulnerability into an account-wide incident. |
| Patch window | Committed remediation timeline per severity, with per-item status | Best-effort patching cannot be evidenced, so a reviewer has no way to distinguish a host that patched within a day from one that happened not to be targeted yet. |
| Backup retention | Retention period set explicitly and restores rehearsed on staging | A backup nobody has restored is an assumption rather than a control, and an incident is the worst possible moment to discover which of the two you had. |
Simple, transparent pricing.
Every plan includes free migration, daily backups, SSL and 24/7 support.
- 1 WordPress site
- 10 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Support tickets
- 5 WordPress sites
- 50 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Priority support tickets
- 20 WordPress sites
- 200 GB NVMe disk
- Free SSL
- Daily backups
- One-click deployment
- Dedicated support
Questions, answered.
Can we export audit logs to our own SIEM?
How are sites isolated from each other?
What is your patching timeline for a WordPress CVE?
Can you enforce SSO and two-factor for everyone?
Do you support penetration testing?
Hosting your security team can actually sign off.
Exportable evidence, real isolation, and a patch window with a number attached.