Web hosting security is the set of measures that protect a web server and its hosted sites from unauthorized access, data breaches, DDoS attacks, and malware. It operates on two levels: what your hosting provider handles at the infrastructure layer — DDoS mitigation, network firewalls, and physical data center controls — and what you manage directly on the server — SSH hardening, firewall rules, SSL certificates, software updates, and backups.
Why Web Hosting Security Matters
A compromised server costs more than the time to fix it. Downtime loses visitors and revenue; a data breach carries legal exposure under GDPR and similar regulations; Google deindexes sites hosting malware. On an unmanaged VPS — the type Contabo provides — you hold full root access, which means full responsibility above the hypervisor layer. Contabo handles physical security, network-level DDoS mitigation, and hypervisor isolation. Everything above that — the OS, your applications, your access rules — is yours to harden.
What Your Hosting Provider Should Handle
Before hardening anything yourself, know what your provider covers. A reputable host should handle the following infrastructure-level protections:
| Security layer | What it protects | Contabo provision |
|---|---|---|
| DDoS protection | Absorbs volumetric and protocol attacks before they reach your server | Always-on DDoS mitigation — included on all VPS plans at no extra cost |
| Network firewall | Filters inbound traffic at the network edge before it hits your VPS | Free Contabo Firewall on every VPS — activate at new.contabo.com → Network Services → Firewall |
| Physical security | Prevents unauthorised physical access to the hardware your VPS runs on | ISO 27001-certified data centers; strict access control and CCTV |
| Hypervisor isolation | Ensures one tenant’s VPS cannot read or affect another’s data | KVM-based virtualisation — your VPS is fully isolated from other customers |
| Network infrastructure | Protects traffic between data center nodes and upstream providers | Handled at the infrastructure layer by Contabo’s network team |
One important distinction: Contabo is an unmanaged VPS provider. OS configuration, application-level security, user accounts, and backups are entirely the customer’s responsibility. That is not a limitation — it is the tradeoff for full root control.
Web Hosting Security Best Practices: What You Control
These seven steps cover the most common attack vectors on a Linux VPS. Apply them in order on any fresh server before it goes into production.
- Disable SSH password authentication. Edit /etc/ssh/sshd_config: set PasswordAuthentication no, PubkeyAuthentication yes, PermitRootLogin no. Restart SSH after: sudo systemctl restart ssh. Use SSH key pairs only — brute-force attacks become pointless.
- Configure a software firewall. On Ubuntu, UFW is the simplest path: sudo ufw default deny incoming && sudo ufw allow 443 && sudo ufw allow 80 && sudo ufw allow <your-ssh-port> && sudo ufw enable. Then activate the Contabo network-level Firewall at new.contabo.com → Network Services → Firewall for an additional perimeter layer.
- Install an SSL/TLS certificate and enforce HTTPS. Let’s Encrypt is free: sudo apt install certbot && sudo certbot –nginx (or –apache). Redirect all HTTP traffic to HTTPS via your web server config — serving content over HTTP in 2026 is an unnecessary risk.
- Enable automatic security updates. On Ubuntu: sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades. Unpatched vulnerabilities in the OS and packages are the most common breach entry point.
- Set up automated off-server backups. Contabo Auto Backup is an available add-on. For full control, use rsync or rclone to push daily backups to Contabo Object Storage (from €2.49/250 GB). Test restores monthly — a backup you have never restored is untested.
- Apply the principle of least privilege. Never run web servers, databases, or application code as root. Create a dedicated system user per service: adduser –system –no-create-home appuser. Limit sudo access to only the users who need it.
- Install Fail2ban. It monitors authentication logs and automatically bans IPs after repeated failures: sudo apt install fail2ban. Default config protects SSH; configure jails for Nginx, Apache, or your app as needed.
DDoS Protection: What It Is and Why Every Hosted Site Needs It
A DDoS attack — Distributed Denial of Service — floods your server from many sources simultaneously to exhaust bandwidth, CPU, or RAM until legitimate traffic can’t get through. Three main types exist: volumetric attacks that saturate your bandwidth, protocol attacks like SYN floods that exhaust connection state tables, and application-layer attacks like HTTP floods targeting specific endpoints.
Contabo’s always-on network-level DDoS mitigation filters volumetric and protocol attacks before they reach your VPS — this runs automatically with no configuration required. What it does not cover: sophisticated application-layer attacks crafted to look like legitimate traffic. For those, add Cloudflare’s free plan in front of your domain. Cloudflare acts as a reverse proxy, absorbing HTTP floods and offering a WAF (Web Application Firewall) on paid plans. The combination of Contabo’s network-layer DDoS mitigation plus Cloudflare’s application-layer filtering covers the full attack surface for the vast majority of self-hosted sites and APIs.
What to Look For in a Secure Web Hosting Provider
Use this checklist when evaluating any hosting provider, particularly before migrating a production site.
| Feature | Why it matters | What to ask |
|---|---|---|
| Always-on DDoS protection | Attacks arrive without warning — opt-in protection is too slow | Is it included on all plans or only premium tiers? |
| Network-level firewall | First filter before traffic reaches your server or OS | Is it free and self-configurable, or managed-only? |
| Full root access | Lets you apply SSH hardening, custom firewall rules, and OS-level security | Required on VPS; typically absent on shared hosting |
| KVM hypervisor isolation | Prevents cross-tenant memory access — relevant for PCI-DSS, GDPR | Ask which virtualisation layer is used (KVM vs OpenVZ) |
| ISO 27001-certified data centers | Confirms physical and procedural security meets audited standards | Ask for certification documents or check the provider’s security page |
| Backup options | Ransomware and admin errors both require clean restore points | Available as add-on? Off-server? How long are backups retained? |
| Unmanaged option | Full control over your software stack and security configuration | Can you install, configure, and update everything yourself? |
FAQ: Web Hosting Security
Web hosting security is the combination of infrastructure protections — DDoS mitigation, network firewalls, physical data center controls — and server-level hardening — SSH key authentication, UFW firewall rules, SSL certificates, software updates, and automated backups — that keeps a hosted website and its data protected from attacks, breaches, and data loss.
It depends on the type. Shared and managed hosting typically bundles DDoS protection, malware scanning, and automatic OS updates. Unmanaged VPS hosting — what Contabo provides — includes infrastructure security: DDoS mitigation, network firewall, and KVM hypervisor isolation. OS-level hardening, application security, and backups are the customer’s responsibility. That tradeoff gives you full control in exchange for managing your own security posture.
Security depends more on configuration than on hosting type. A well-hardened unmanaged VPS beats a poorly configured dedicated server. Dedicated servers remove the multi-tenant hypervisor surface entirely. Unmanaged VPS gives full control to those who apply SSH hardening, firewall rules, and updates. Shared hosting limits your ability to apply OS-level security at all. For most developers and SysAdmins, a hardened VPS with DDoS protection and SSH key auth is the practical best answer.
DDoS protection is active by default on all Contabo VPS plans — no setup required. For additional network-level filtering, activate the Contabo Firewall: log in at new.contabo.com, go to Network Services → Firewall, and add rules to allow only the ports your server needs. For application-layer protection on top of that, route your domain through Cloudflare.
