What is Secure Hosting?

Every website is a target, even a small one. Many attacks are automated: scripts scan the web for outdated software and weak passwords, then plant malware or hijack the server to send spam. "Secure hosting" isn't a standardized product or a guarantee. It's a label for hosting where those risks are actively managed: your host builds some protections into the server, and others stay your job.

The stakes are highest for online stores. A hacked store leaks the card numbers and personal data it holds, and once Google's Safe Browsing list flags the site, browsers warn visitors away until it's cleaned up and reviewed. Accepting card payments also puts you under PCI DSS, the payment card industry's security standard for any business that stores, processes, or transmits cardholder data. Start with the basics: serve every page over HTTPS, and know exactly what security your host provides.

Security features to look for in a web host

Compare plans on the specific protections they include, not on the word "secure" in the marketing. Many web hosts bundle most of this checklist:

• A free SSL/TLS certificate, which encrypts traffic between visitors and the server so logins and card numbers can't be read along the way.
• A web application firewall, which filters malicious requests, such as SQL injection attempts, before they reach your site.
• Protection against DDoS attacks, which absorbs the traffic floods meant to knock your site offline.
• Malware scanning, which checks your files for malicious code and alerts you when something slips through.
• Daily automated backups, which give you a clean copy to restore after a hack or a bad update.
• Encrypted SFTP and SSH access, which protects file transfers and server logins from eavesdropping.
• Two-factor authentication on the hosting account itself, so a stolen password alone can't open it.

An SSL certificate is one layer, not the whole answer

An SSL/TLS certificate lets your server prove its identity and encrypts the connection between a visitor's browser and your site, so pages load over HTTPS and data in transit can't be read. Browsers mark such connections with site-information indicators whose appearance varies by browser and version. Hosts commonly include a certificate free through Let's Encrypt (every DreamHost plan does). What a certificate can't do matters just as much: encryption in transit doesn't stop malware, patch outdated software, or block a guessed password. Treat it as one layer of secure hosting, not proof of it.

Who secures what: the host's job and yours

Hosting security is shared. On web hosting and managed plans, the host secures the infrastructure: it patches the server's operating system, mitigates DDoS attacks, and monitors the network around the clock. You secure everything you install and control: your CMS core, plugins, themes, passwords, and user accounts. On an unmanaged VPS or dedicated server, more of the stack shifts to you, including operating system updates.

That split is why software updates and a security plugin still matter on even the most secure host, and why a recent backup is worth verifying before you need it. If your site does get hacked, a verified clean backup turns cleanup from a disaster into an inconvenience, once the entry point is found and closed. For the owner's side of the work, our WordPress security guide walks through hardening your site step by step.

What secure hosting costs

Baseline protection is commonly part of the plan price, not a separate product. Every DreamHost plan, for example, includes free Let's Encrypt SSL certificates, daily automated backups, DDoS protection, and web application and network firewalls at no extra cost. Paid add-ons appear at the advanced tier: at DreamHost, daily malware scanning is the DreamShield add-on. Before you buy a third-party security service, check what your plan already includes so you don't pay twice for the same firewall or backups.