Hosting Security Responsibility
Splitting Security Tasks Between Host and Customer
Web hosting security responsibility describes which security tasks belong to the hosting provider and which belong to the customer. The provider secures the parts it controls, typically the data center, physical hardware, network and, in most plans, the server's operating system and core software. The customer secures what runs on top: the website software, plugins, content, passwords and uploaded files.
The boundary is not the same for every plan, and it is one of the most misunderstood parts of hosting. A provider can keep its servers patched and still be unable to protect a site whose administrator password is weak. Understanding the split also helps explain why websites get hacked, since many compromises begin on the customer's side.
How the Split Changes Between Plan Types
The responsibilities shift as control moves from the provider to the customer:
- Shared hosting: the provider runs and isolates the server, and each account is separated from the others. The customer manages the site's software, passwords and file permissions within the account.
- Managed hosting: the provider often takes on more, such as server software updates and monitoring. The customer still controls plugins, content and logins, which remain the most common source of problems.
- Unmanaged or self-managed servers: the customer is responsible for almost everything, including the operating system and server software. Good practice here includes server hardening, which reduces what the server exposes.
The exact scope is set by each provider's plan description and terms. Words like "managed" do not mean the same thing at every company, so the written scope is worth reading rather than assuming.
Example: A Plugin Flaw on a Managed Plan
A business runs a content management system on a managed plan. The provider keeps the server patched and watches the network. A plugin installed on the site then gets a security flaw, and attackers start using it to upload files. The provider can block some suspicious traffic, but only the site owner can remove the plugin or apply its update. The plugin remained the customer's responsibility the whole time, even though the plan was managed.
Frequently asked questions
Does a managed hosting plan make a website secure?
Not on its own. A managed plan usually reduces the work of keeping the server up to date, but the website's software, plugins, passwords and content still belong to the customer. Security depends on both sides doing their part. Keeping software current is covered in security updates and patching, and a managed plan does not remove the need for strong passwords or careful plugin choices.
Who should I contact if my hosted website is hacked?
Start with your hosting provider's support team. They can check the server and tell you what they can see from their side, and they may isolate the account while the problem is investigated. Cleaning the site and fixing its software usually remains the site owner's task, often with help from a security specialist.