Secure WordPress hosting

What makes WordPress hosting secure?

WordPress itself is well maintained. Most problems come from around it: outdated plugins, weak or reused passwords, automated attacks, and servers shared with sites that have already been compromised. Secure hosting reduces each of those risks, so your own effort can go on the parts only you control.

A useful way to judge any host is to check each layer in turn:

The sections below take each layer in turn, with what Cloudways, Krystal and WP Engine say on their own sites. Our comparison table further down puts all three side by side.

Firewall and DDoS protection

Bad traffic is easiest to deal with before it reaches your site. All three hosts describe a firewall and DDoS protection, built in different ways:

• Cloudways says the Imunify360 firewall on its servers blocks common attacks with WAF rules plus DoS, brute force and bot protection. Its Cloudflare Enterprise add-on adds a WAF, rate limiting and edge caching, and its Autonomous plans include a Cloudflare WAF and DDoS protection
• Krystal says network-level filtering blocks malicious traffic before it reaches your WordPress site, and its technology page describes a mod_security WAF with daily rule sets and on-premise and upstream DDoS mitigation
• WP Engine lists a proprietary firewall and Layer 3 and 4 DDoS protection on every plan. Advanced DDoS protection and a managed WAF are an optional add-on, and part of its Enterprise plan; its Global Edge Security product adds Layer 7 mitigation and managed WAF rule sets

Edge protection means attack traffic is dealt with across a large network rather than on the machine running your site. Server-level firewalls filter what reaches the server itself. Many hosts combine the two. Cloudflare is named here only to describe the technology each host says it uses.

Bot protection and AI crawler controls

A large share of the traffic hitting any WordPress site is automated. Some of it is useful, such as search engine crawlers. Much of it is not: content scrapers, login-guessing scripts, fake form submissions and crawlers collecting content for AI services. For a business site, unwanted bots waste server resources, distort analytics and fill inboxes with spam enquiries.

What the hosts describe:

• WP Engine says its Global Edge Security product classifies human, AI and bot traffic and lets you allow or block traffic by category or region. WP Engine's go-live guide refers to it as something you purchase
• Cloudways includes bot protection in the Imunify360 firewall it describes on its servers
• Krystal describes network-level filtering and firewalls

If AI crawlers or heavy scraping matter to you, check which settings are in the dashboard as standard and which come with an add-on.

Vulnerability scanning and patching

Most WordPress compromises start with a known flaw in a plugin or theme that has not been updated. The fix is usually published; the risk is the gap between the flaw becoming public and the update being applied. Hosts close that gap in two ways: scanning tells you which plugins are vulnerable, and virtual patching blocks the exploit at server level until you update.

What each host describes (Cloudways and Krystal both name Patchstack as the technology behind it):

• Cloudways says its Patchstack-powered scanner flags vulnerable plugins and themes on your WordPress applications so you can update before they cause trouble
• Krystal says every managed WordPress plan includes Intelligent Protection, powered by Patchstack, which deploys a virtual patch that blocks an exploit at server level when a vulnerability is disclosed
• WP Engine lists security patching and plugin risk scans on every plan, and says its team manages WordPress core updates

Automatic updates help too. Krystal says its managed plans update WordPress core, plugins and themes automatically. Cloudways and WP Engine offer update tools of their own: Cloudways says Site Manager Pro tests updates on a staging clone and rolls back if something fails, and WP Engine lists plugin and theme updates checked with visual regression testing, through Smart Plugin Manager.

SSL certificates

Every business site needs HTTPS: browsers warn visitors about pages without it, and forms and logins must be encrypted. All three hosts include SSL certificates:

• Cloudways offers Let's Encrypt SSL certificates, installed in one click
• Krystal says SSL certificates are included and renew automatically
• WP Engine lists auto-renewing SSL on every plan

If your organisation needs a certificate from a particular authority, check that the host lets you upload your own.

Malware scanning and clean-up

Even well-run sites can be compromised, through a stolen password or a plugin flaw published before a fix exists. What matters then is who cleans up, on what terms, and how quickly. The hosts describe different arrangements:

Two conditions come up again and again. Hosts expect genuine plugins and themes rather than nulled (pirated) copies, and they expect you to complete follow-up steps such as changing passwords and updating software after a clean-up. Check, too, whether a site that was already infected before the move is covered: WP Engine, for example, says it is not.

Backups and restores

Backups are the last line of defence against everything else on this page, and against ordinary mistakes too. When you compare hosts, look at how often backups run, how long they are kept, where they are stored, and whether you can restore them yourself.

• Cloudways describes automated and on-demand backups with one-click restore; offsite backup storage is charged by usage on its Flexible servers
• Krystal says managed plans have daily backups as standard, more frequent backups on larger plans (hourly on Business), and restore points covering the last 30 days
• WP Engine keeps automatic and on-demand backups for no less than 30 and no longer than 60 days, stored offsite on Amazon S3 in the same region as the site and encrypted in transit and at rest

Whichever host you choose, keep an occasional copy of your own, outside the hosting account. A downloadable backup, an external backup add-on or a separate backup service all give you that. Staging helps here too: all three hosts offer staging copies, so updates can be tested before they reach the live site.

Access control: 2FA, SSO, roles and activity logs

Your hosting dashboard controls everything about the site, so it deserves the same protection as your email. The hosts describe:

• Cloudways: two-factor authentication on the account, alerts for login attempts from an unidentified device, an IP allow list for SSH and SFTP, and team members with full or limited access. Its Site Manager add-on lists SSO
• Krystal: its Onyx dashboard lets you enable SSH and SFTP access per site and add users with access only to the sites you choose
• WP Engine: single sign-on for its User Portal, MFA, granular user permissions, and a central view of attacks and logins across your sites

Separate logins for each person, rather than one shared account, make it simple to remove access when someone leaves or a contract ends. If you use Microsoft 365 or Google Workspace for sign-in, single sign-on keeps hosting access tied to the same accounts and policies.

Security features at each host

This table sums up what each host says on its own site, A to Z. A feature described by one host is not automatically the same as another host's version, and some items are add-ons, so check each host's current plans.

Certifications matter most when a customer, insurer or auditor asks about your suppliers. A SOC 2 Type II report looks at whether security controls operated effectively over a period of time; ISO 27001 is the international standard for an information security management system; Cyber Essentials Plus is the UK government-backed scheme with a hands-on technical check. Each host sets out its certifications on its own site: Cloudways (opens in a new tab), Krystal (opens in a new tab) and WP Engine (opens in a new tab). Our enterprise WordPress hosting guide covers the larger plans, and the WordPress hosting comparison puts the hosts side by side on everything else.

What you still need to do: updates, passwords and plugins

Managed hosting covers the server and the network. Some parts of security sit inside WordPress and with your own staff, and these habits make the biggest difference:

• Keep plugins and themes up to date, or use your host's automatic update tool, and act on vulnerability alerts when they arrive
• Remove what you do not use: deactivated plugins and old themes still contain code
• Use genuine plugins and themes from their developers or the official directory. Nulled copies are a common source of malware, and hosts' clean-up terms usually exclude them
• Use strong, unique passwords and two-factor authentication for every WordPress administrator and every hosting login
• Give people the lowest role they need: editors and authors rarely need administrator rights
• Review who has access when staff leave or agencies change, both in WordPress and in the hosting dashboard
• Protect your domain's email with SPF, DKIM and DMARC records, so nobody can easily send email pretending to be you

If you run a shop, our WooCommerce hosting guide covers what changes when you take payments. If your site is small, WordPress hosting for small business covers which hosting features matter most, and if you are moving to a more secure host, our guide to moving a WordPress site to a new host covers the DNS and email steps.