Managed WordPress hosting security: what is covered and what is not

Managed WordPress hosting is a real step up from a bare server. The host patches the machine, keeps WordPress current and takes backups, so a whole class of maintenance stops being your job. The risk is assuming it also means your site is being watched for attacks. Whether it does depends on the host and the plan, and the marketing words ("secure", "protected") rarely say.

What managed hosting usually covers

• The server underneath. The operating system, web server and PHP are patched and configured by the host, and sites are usually isolated from one another so that one compromised site is less likely to spread.
• WordPress core updates. Most managed hosts apply security releases of core automatically. Some also update plugins and themes, but many do not, so check which.
• Backups. Regular copies, often daily, with a restore option. How long they are kept, and where, varies by plan.
• Some traffic filtering. A basic firewall or network-level filter blocks known bad requests and floods of traffic before they reach WordPress. How far it goes depends on the provider.
• Malware scanning, on some plans. A number of hosts scan files for known malware. Others only scan on request, or only on higher plans.

What it usually leaves to you

• Plugins and themes. A host cannot fix a flaw in code written by someone else. A vulnerable plugin stays vulnerable until you or the plugin author update it, and this is how most WordPress sites are broken into.
• Passwords and accounts. If an attacker has a valid WordPress login, the server hardening does nothing, because the login looks like normal traffic. Weak or reused passwords, and administrator accounts nobody remembers, are yours to manage.
• What is inside the site. Server protection does not read your WordPress files and database for injected code, a new administrator or a changed setting, unless your plan specifically includes that.
• Configuration mistakes. A file left with permissions that are too open, an exposed debug log or a leftover backup in a public folder all sit in your site, not in the server.

A backup is not a security scan

Backups help you recover, but they copy whatever is on the site, including an infection. If malware was planted three weeks ago and your backups go back thirty days, you can restore a copy that already contains it. A backup tells you what the site looked like. A scan tells you whether that is what it should look like.

Questions to ask your host

Send these to your host's support, or read the plan's documentation for the answers. Specific answers are a good sign. Vague ones are worth noting.

• Do you scan my files for malware, and how often? Ask also whether you are told when something is found, and whether the host cleans it or only reports it.
• Are plugins and themes updated automatically, or only core?
• What does the firewall block, and does it protect the site if someone reaches the server directly?
• How long are backups kept, and are they stored away from the server? Ask whether you can restore files and the database separately.
• Do you offer SSH and WP-CLI access? It matters for checking the site yourself, and for any tool that works from the server.
• What happens if my site is found infected? Some hosts suspend the site until it is cleaned.
• Can I see access and error logs? They are the first thing you need after an incident.

Checks you can run yourself

None of these depends on the host. Where a step needs the command line, many managed hosts offer SSH on at least some plans.

• Review administrators. In wp-admin, open Users and filter by Administrator. Remove or question any account you do not recognize.
• Turn on two-factor login for every administrator, and use a unique password for each.
• Remove plugins and themes you do not use. A deactivated plugin can still be attacked if its files are on the server.
• Compare core files with the official copies: wp core verify-checksums. The core file integrity guide explains what the result means.
• Look at the site as a visitor does, from a phone and from a search result, because some infections only show to visitors who arrive from Google. The five-minute hack check walks through it.

The gap in one sentence

Managed hosting secures the building, but it does not necessarily watch what is happening inside your own unit. Most WordPress compromises happen in the application layer, through a plugin, a password or a setting, and that is the layer server-level protection reaches least.