TopHost hosting security: Imunify360, firewall, backups and your part
PrintA website hosted with TopHost is never left exposed. Several security systems run all the time on our shared hosting servers, and they cover for each other without any setup on your side. Some of a website's safety, though, depends on how it is looked after. This page explains both halves.
In short: the server is protected by Anti-DDoS filtering, a firewall, Imunify360 (malware scanning, a WAF request filter and proactive defence) and CloudLinux, and data is backed up daily with JetBackup 5. Keeping the website updated, choosing good passwords and holding your own copy stay with you. If you get a notice about infected files, you have 24 hours to clean the account and let us know.
The layers running on the server
- Anti-DDoS, DoS and Flood protection. It filters out floods of junk requests meant to overload the server, so that real visitors can still reach the websites.
- The server firewall. It blocks IP addresses that keep entering a wrong password for FTP, SSH, mail (SMTP, POP3) or cPanel, and addresses that repeatedly trip the security rules. See the main reasons the firewall blocks an IP address.
- Imunify360. It scans hosting accounts for malicious files and suspicious behaviour, filters web requests and stops dangerous scripts. The details are in the next section.
- ModSecurity rules (a web application firewall). They inspect requests sent to the website and stop the ones that look like an attack, such as SQL injection attempts or scripts being slipped into pages.
- CloudLinux. Each account gets its own CPU and memory limits. An overloaded or compromised website cannot take resources away from the other accounts on the server. See CloudLinux explained: your own resources on a shared server.
- JetBackup 5 backups. Copies are made daily, stored in two separate locations and kept on a 30-day rotation. You can restore them yourself from cPanel, as shown in the JetBackup 5 guide.
- A free SSL certificate. It is issued automatically for the domains in the account and encrypts the traffic between visitors and the website.
- Two-factor authentication for the client area. Turn it on with an authenticator app (TOTP) and a password alone is no longer enough to sign in.
Imunify360: what it checks and how you would notice
Most of the time you will not notice Imunify360 at all. It only shows up when it finds something suspicious or stops a connection.
| Part of the system | Its job | What you see |
|---|---|---|
| Malware scanner | Looks for malicious files and suspicious behaviour in the account | A notice about infected files; the list and the scan history are also in cPanel, under Security, then Imunify360 |
| Firewall | Stops IP addresses that keep guessing passwords or attack the server | The site, cPanel, FTP or e-mail stops responding from one particular connection |
| Web request filter (WAF) | Rejects requests that look like attacks on web applications | A 403 error on a specific action, such as submitting a form |
| Proactive PHP protection and bot checks | Stops dangerous scripts from running and screens suspicious automated traffic | Rarely: a browser check page before the site opens |
For a 403 error caused by the request filter, see A 403 caused by ModSecurity: why it happens and how to get an exception.
If you get a malware notice
Under the TopHost Terms and Conditions, when malware that could endanger the server or other clients is found in your account, you are notified straight away. From then on you have 24 hours to clean up, look into the cause and tell us what you did. If the threat is serious, the account may be blocked immediately, and we will contact you with the details. The practical steps are in An Imunify notice about infected files.
Your share of the job
Under the Terms and Conditions, the client is responsible for choosing and updating the CMS, themes and plugins. In real life, most hacked websites had an outdated plugin or a weak password rather than a server problem.
| What to do | Why it matters |
|---|---|
| Keep WordPress, themes and plugins up to date, most easily from cPanel with WP Toolkit (or, as an alternative, from the WordPress admin) | Flaws in old versions are public, and bots scan for them automatically |
| Remove plugins and themes you have switched off | A disabled plugin left on the server can be exploited just like an active one |
| Use a separate password for cPanel, FTP, mail and the website admin | A password leaked from another service will not open your hosting account |
| Keep your own copy of the website on your computer or other storage | Server backups are a safety net, not a replacement for a backup you control |
| Run an antivirus on the computers you use for cPanel and FTP | Malware on your computer can steal even freshly changed passwords |
What server-side protection cannot do
- It does not update your site. An outdated plugin is still an open door, however quickly infected files are spotted. The protection cannot fix a flaw in the website's own code.
- It does not protect your computer. If your FTP or cPanel password is stolen from an infected PC, the attacker logs in with valid credentials, and the server cannot tell them apart from you. See also There are viruses on my site, what should I do?
- It does not replace your own backups. JetBackup takes copies automatically, but we recommend keeping your own copies outside the hosting as well.
Questions clients ask
Do I need to switch anything on?
No. Everything listed above is enabled by default on shared hosting. The only thing you turn on yourself is two-factor authentication in the client area.
So my website can no longer be hacked?
It can. The protection lowers the risk a lot and stops most automated attacks, but updates and strong passwords still count.
Imunify360 blocked something legitimate
The protection runs at server level and cannot be switched off for a single account. If it gets in the way of normal site activity or has blocked your IP, open a ticket, describe what you were doing and, if you know it, include the IP address you work from. We will check and, where it is justified, add an exception.
Imunify360 flagged a file I know is clean
It happens, especially with hand-written or obfuscated code from a developer. Do not put the file back yourself over the warning: send us its full path in a ticket and we will review it.
What if I suspect a problem?
Look at the scan history in cPanel, under Security, then Imunify360, and open a ticket describing what you noticed.
I have a VPS. Does this apply there too?
Everything described here applies to shared web hosting. On VPS Pro (managed), security setup is part of the service. On an unmanaged VPS, the security of the server is in your hands.
