SSL/TLS certificates are now an important part of secure web browsing, as well as any connections by FTP or Email. Legal regulations and promotion by Google have made it essential that every site should have one. We partner with Let’s Encrypt to provide every site we host with a free SSL certificate.

All of our free SSLs are 'wildcard' certificates to ensure that you can secure sub-domains as well as your primary domain using one certificate. To ensure that you can get a free 'https' certificate your site needs to use the SIRSTEVEHQ name servers. Our free SSL certificates provide the same level of encryption and security as a paid for SSL certificate.

If your business takes card payments, your hosting needs to be PCI compliant.

To accept, store and process debit/credit card information, the hosting provider must be compliant with Payment Card Industry Data Security Standards (PCI-DSS). These standards were introduced to reduce credit card fraud.

The PCI Security Standards Council are responsible for ordering regular tests on hosting providers. They test for vulnerabilities where hackers could potentially steal cardholder information. SIRSTEVEHQ consistently pass these independent audits.

Unfortunately many security measures are rendered ineffective if your password is compromised. So we offer the option to use two-factor authentication (2FA) in all our hosting control panels, and SSH access.

2FA is a way to add an extra layer of security. Our 2FA uses TOTP apps, which provide you with a time-sensitive single-use code to enter as well your password. 2FA app providers include Google and Microsoft. The apps are run from your phone.

We also enforce another form of ‘2FA’: random security checks when payments are made. This will require you to call us and confirm additional security information provided by yourself when first signing-up.

One way to stop security breaches is to prevent criminals getting access to your code on the server. Our Web Application Firewall (WAF) protects your data and software by blocking suspicious activity. A common attack on a website is to use web forms to insert malicious code. Forms aren’t covered by traditional firewalls, as they need to allow information to pass from the user to the server where the website is hosted. They can be an access point for data thieves or ransomware.

Even in the best-case scenario, being a victim of this will cost your business time and money. Worst case: a breach could end your company.

The SIRSTEVEHQ WAF helps prevent this by inspecting every HTTP request for SQL injection, trojans, cross-site scripting, path traversal and many other types of attack. It does this at the edge our network, so it happens before any scripts from web apps like WordPress execute. It takes less than a millisecond.

The SIRSTEVEHQ security team regularly update the set of rules that filter-out malicious requests. This ruleset is made from commercially-available resources and custom rules written by the SIRSTEVEHQ security team. All this makes it much more difficult to hack your sites, and goes on behind the scenes at SIRSTEVEHQ.

A common attack vector for cyber criminals is to use brute force to guess your website’s ‘admin’ password. These are applications that cycle through common passwords and use trial and error – random letters and numbers – to try to crack your credentials.

Our platform includes StackProtect, which monitors log-in attempts to your website. It checks for potential ‘evil’ automated requests. If they’re detected, it uses Google’s latest reCAPTCHA tools and if necessary, blocks those attempts.

This also stops our platform being slowed-down. It blocks up to six million requests – every day. Logins to our WordPress hosting platform are our most popular target, but StackProtect covers all common website logins.