English
Magyar
If your website is hacked or becomes inaccessible, is it the hosting provider or you who is responsible for the lack of security? Server-side security does not depend on a single switch: it requires the coordinated operation of multiple layers and a clear division of responsibilities. The hosting provider’s built-in security is an important foundation, but it does not necessarily extend to the plugins you have installed, your passwords or updates to the operating system running on your VPS.
It is not always clear what the service provider manages and what remains the responsibility of the operator. The scope of responsibility may differ between shared hosting and VPS, so it is worth clarifying this before making a choice. HTTPS, two-factor authentication and backups are also useful security measures, but it is important to understand how they work and to check their settings regularly.
In this article, we’ll look at the main layers of server-side security, the responsibilities of both the provider and the customer, and how to minimise the risk of hacking, malware infection and service outages. You’ll be given practical checklists for reviewing your hosting or VPS, so that you know what to check whether you’re using a cPanel environment or managing your own server.
What does server-side protection mean, and what does it actually protect?
Server-side security is the combination of technical measures and operational practices that mitigate the risk of unauthorised access to data stored on the server and to the services running on it, as well as the risk of malware and downtime. It is not a single program or setting, but rather multiple, complementary layers of protection.
The scope of protection depends on which system component is being examined. Protecting the server’s operating system and network settings falls under server security, whilst protecting the website’s code and components falls under application security. The protection of user accounts depends on the proper management of passwords and permissions, whilst the protection of endpoints – such as the computer used to manage the website – is a separate task. If an unauthorised person gains access to an account, the server’s other layers of protection will not necessarily prevent misuse on their own.
In practice, server-side protection covers the following areas, amongst others:
- Access management: controls who can access the control panel, files or the server, and what their access rights are. Two-factor authentication adds an extra layer of security to the login process.
- Updates: keeping the operating system, control panel and applications up to date can help to fix known bugs.
- Network control: regulating the availability of connections and services can mitigate the risk posed by access points left open unnecessarily.
- Backup: this can help you recover your data following an incident or technical fault. Check that your backups are actually available and can be restored.
These measures reduce the risk, but do not make the system completely secure. Settings, updates and backups must be checked regularly.
How does server protection differ from SSL/TLS encryption?
HTTPS uses SSL/TLS encryption to protect traffic between the browser and the website, making it more difficult for the information being transferred to be intercepted en route. However, it does not fix application bugs, does not protect against weak passwords, and is no substitute for updates or backups. SSL/TLS is one component of a broader security system. You can also find further details on the page explaining HTTPS and SSL certificates.
What threats should a website operator be aware of?
Unauthorised access, malware and ransomware can compromise accounts, files or the operation of the service. The aim of a denial-of-service attack is to disrupt availability. Phishing is not a server-side issue, but a user-side risk: attackers may attempt to obtain login details through deceptive messages. Therefore, in addition to server settings, you should also pay attention to protecting access points and the devices used to manage them.
Layers of server-side security: access, updates, network and backup
Server-side protection works consistently when it does not rely on a single measure. Access management, regular updates, network control and data recovery together address various risks. A firewall, for example, can restrict certain network connections, but it is no substitute for secure account settings or data backups.
The measures must be tailored to your hosting type and scope of responsibility. With shared hosting, the provider manages part of the server environment, whilst with VPS, the division of tasks depends on the service model. Clarify in advance who will update the operating system and who is responsible for application maintenance.
Access management and software updates
Create a separate account for everyone who needs access to the control panel or the server. This allows you to tailor permissions to individual tasks and, if necessary, revoke access on a case-by-case basis. Where available, two-factor authentication provides an additional layer of security, but it is no substitute for a strong password and proper access control.
Updates can fix known bugs in the operating system, the control panel and website applications. If you’re using a VPS, check whether it’s your responsibility to keep the system and installed software up to date. If you’re using shared hosting, ask what is included in the provider’s server maintenance responsibilities and which applications you need to update yourself.
Firewall, malware protection and backup layer
Firewall rules are used to allow or restrict network connections. Their purpose is to minimise unnecessary access, rather than to guarantee the prevention of all attacks. Malware detection can help identify suspicious files or activities, whilst backups are used to restore data. Neither solution is a substitute for the other.
Ask your provider how often backups are taken, how long they are retained, and under what conditions they can be restored. Familiarise yourself with the restoration process as well, because a backup is only of practical use if it can be utilised when needed. The CISA website security checklist can provide further considerations for reviewing the security of your web server and applications.
If you need greater freedom in configuration, take a look at the KVM VPS options, and before you do so, clarify which operational tasks the provider will undertake and which will remain your responsibility.
Shared hosting or VPS: how do security tasks differ?
When choosing a hosting plan, don’t just consider the resources and access options. Also clarify how operational and security tasks are divided between you and the provider. Greater control over access may also mean more independent configuration and maintenance. No single hosting model is more secure in every situation: the right choice depends on your needs, technical expertise and the terms of service.
| Hosting type | Typical liability limit | What should you check? |
|---|---|---|
| Shared web hosting | The provider supplies the shared server environment, whilst the customer typically manages their own website and account. | Who updates the operating system, the control panel and the applications you have installed? |
| VPS hosting | A virtual server can offer greater independence, but managing the operating system and the installed software can be a separate task. | Exactly which system and security tasks does the service cover? |
| Dedicated web hosting | The customer has exclusive use of the server’s resources, but this alone does not determine who carries out the administration. | Who is responsible for updates, access rights, network settings and backups? |
The scope of liability for each service depends on the package and contract. The table is intended as a general guide only and does not replace checking the terms and conditions of the specific service.
What can the provider manage in the case of shared hosting?
With shared hosting, the provider supplies the shared infrastructure, whilst you are responsible for your own website, accounts and the settings of any plugins you install. The exact scope may vary from service to service, so do not assume that the hosting automatically covers all website-level tasks. You can also find out about the available solutions in our overview of web hosting services.
When is a VPS or dedicated web hosting the right choice?
If your application’s resource requirements or the level of configuration flexibility you need exceed the capabilities of shared hosting, a VPS or dedicated web hosting may be a more suitable option. You should also assess whether you have the technical knowledge and capacity required for regular administration. On a VPS, for example, updating and securely configuring the operating system may be your responsibility, depending on the service model. The OWASP Web Application Security Risks provide further guidance for assessing application risks.
Server security checklist: what should you do before an attack or a fault occurs?
Server-side security also involves advance preparation. If you know where to find your backups, how to notify your provider and which access permissions you need to review, you’ll be able to respond more quickly and effectively in the event of an incident. Work through the checklist below and make a note of your answers.
- Check your accounts: review who has access to your hosting, control panel and website administration. Revoke any access that is no longer required, and check whether two-factor authentication is available.
- Clarify the update responsibilities: set out who is responsible for updating the operating system, the control panel, the website and the plugins. In the case of a VPS, make a point of asking specifically about the management of the server’s operating system.
- Find out about backups: ask what data is backed up, how often this happens, and how long the backups remain available.
- Try out the recovery process: clarify the procedure and conditions for restoration before any errors occur. Don’t just check whether a backup exists, but also whether it can be used to restore the website.
- Find out where to find alerts: check which platform or email address you’ll receive notifications about service-related faults on, and where you can report a fault.
What questions should you ask your web hosting provider?
Ask about the frequency of backups, their retention period and the restoration process. Clarify which infrastructure security and update tasks are handled by the provider, and which remain your responsibility. Look for the security documentation included with the plan, or ask where it can be found. Record the answers in one place, for example in your internal operational notes.
What should you do first in the event of a security incident?
Make a note of the time you noticed the issue and the symptoms, such as the error message, the affected parts of the website or any unusual account activity. Then use the provider’s official fault reporting channel to submit the information you have gathered. Do not delete any logs or backups whilst the cause is being investigated. Adjust password changes and access revocations to the affected systems, and check your website accounts as well.
When choosing a hosting plan, you should also consider how tasks will be distributed. An overview of aWh’s web hosting solutions can help you compare the different types of hosting available.
How does aWh’s hosting relate to server-side security?
When choosing the right hosting plan, in addition to your resource requirements, you should also consider how much administration you wish to carry out and what security features you need. aWh’s range includes web hosting, cPanel hosting, VPS and dedicated web hosting. These offer different management options, but the level of security is not determined by the type of hosting alone. Both the terms of service and the maintenance you carry out are important factors.
Which aWh hosting option should you consider?
If you’d like to manage your website via a graphical interface, cPanel hosting could be a good place to start. cPanel makes managing your web hosting settings more straightforward, but it doesn’t automatically take care of all your website maintenance tasks. You can find out more about the service in aWh’s cPanel hosting overview.
If you require more resources or greater freedom to customise settings, it is worth considering a VPS. However, greater control may entail more system administration tasks, such as keeping the operating system and applications up to date. Dedicated web hosting is another option, but the fact that server resources are dedicated does not in itself mean that the provider will carry out all administrative or security tasks. Before making a decision, clarify exactly what is included in the service in question.
What security features should you check before making your choice?
When reviewing server-side security, don’t just look at the names of the features. Also ask whether they are available in the service in question, and under what conditions they can be used:
- Backups and automatic backups: what data is backed up, how often, and how can you request a restore?
- HTTPS: is it part of the solution you’ve chosen, and do you need to carry out any configuration?
- Two-factor authentication: on which control panels can it be enabled?
- AI security system: exactly what does it scan for, what threats does it cover, and in which plans is it available?
The availability and terms of use of these features may vary from package to package, so please check the service description or enquire with the provider. Take a look at aWh’s web hosting solutions and choose the option that best suits your needs and the operational tasks you are able to undertake.
Strengthen your website’s security by making an informed choice
Server-side security consists of several complementary layers: access management, regular updates, network monitoring and recoverable backups. No single measure can replace the others. The effectiveness of the security also depends on exactly which tasks you and the hosting provider manage.
With shared hosting, cPanel hosting, VPS and dedicated web hosting, the level of administrative freedom and the division of responsibilities may vary. Before making your choice, check who is responsible for updates, what backup and restore options are available, and whether features that are important to you – such as HTTPS and two-factor authentication – are included in your chosen plan.
With over 10 years’ experience in the web hosting industry, aWh offers a range of hosting solutions. The availability of backups, HTTPS and two-factor authentication may vary depending on the plan, so it is worth checking these in advance. Take a look at aWh’s web hosting solutions and choose one based on your resource requirements, technical expertise and the operational tasks you are able to handle.
Frequently asked questions about server-side security
What does server-side protection mean?
Server-side protection refers to the set of measures designed to ensure the security of the operating system running on the server, the data stored there and the delivery of the website. This may include access control, software updates, monitoring of network traffic and backups. These tasks are shared between the hosting provider and the operator, depending on the type of service and its terms and conditions.
Is HTTPS enough to keep a website secure?
No, HTTPS alone is not enough. SSL/TLS encryption protects traffic between the browser and the website, but it does not fix application vulnerabilities, nor does it prevent access via weak passwords. For more comprehensive protection, you also need to update your software, secure access and check your backups. You should therefore treat HTTPS as part of a wider security system.
Is server-side protection necessary even on shared hosting?
Yes, server-side security is important even on shared hosting. The provider manages certain parts of the shared infrastructure, but the security of your website and accounts may require special attention. Keep your website’s applications and plugins up to date, use strong authentication, and monitor access rights. Also ask which tasks the provider carries out and which are your responsibility.
How can I protect myself against DDoS attacks?
A combination of network and operational measures can help protect against DDoS attacks, but no single setting can guarantee complete protection. Ask your hosting provider what network traffic filtering and incident management procedures apply to your service. For your website application, consider limiting the number of requests and monitor for unusual spikes in traffic. If you suspect an attack, record the time and symptoms, then report them to your provider.
How often should you back up your server?
The frequency of backups is determined by how much data loss you can tolerate and how often the website’s content changes. An online shop that is updated frequently may require a different schedule to a ‘About Us’ page that is rarely modified. Check with your provider regarding the frequency of backups, retention periods and restoration conditions. You should also check from time to time whether the website can actually be restored from a backup.
When is it better to choose a VPS rather than shared hosting?
You should consider switching to a VPS if your website’s resource requirements or configuration needs exceed the capabilities of shared hosting. A VPS can give you greater control, but managing it may also involve more technical tasks. Depending on the service model, you may need to take care of updating the operating system and any installed applications yourself. Before making a decision, assess your resource requirements and the expertise available for operation.
Does two-factor authentication protect the server from attacks?
Two-factor authentication adds an extra layer of security to account access, but on its own it does not protect the server from all attacks. It is no substitute for a strong password, access restricted to the necessary permissions, updates or backups. Enable it in the relevant control panels where available, and regularly check who has access to your hosting and website administration.