{"id":33080,"date":"2026-08-04T16:39:43","date_gmt":"2026-08-04T14:39:43","guid":{"rendered":"https:\/\/contabo.com\/blog\/?p=33080"},"modified":"2026-08-04T16:39:46","modified_gmt":"2026-08-04T14:39:46","slug":"web-hosting-security","status":"publish","type":"post","link":"https:\/\/contabo.com\/blog\/web-hosting-security\/","title":{"rendered":"Web Hosting Security: Best Practices, DDoS Protection & What to Look For"},"content":{"rendered":"\n

Web hosting security is the set of measures that protect a web server and its hosted sites from unauthorized access, data breaches, DDoS attacks, and malware. It operates on two levels: what your hosting provider handles at the infrastructure layer \u2014 DDoS mitigation, network firewalls, and physical data center controls \u2014 and what you manage directly on the server \u2014 SSH hardening, firewall rules, SSL certificates, software updates, and backups.<\/p>\n\n\n\n

Why Web Hosting Security Matters<\/h2>\n\n\n\n

A compromised server costs more than the time to fix it. Downtime loses visitors and revenue; a data breach carries legal exposure under GDPR and similar regulations; Google deindexes sites hosting malware. On an unmanaged VPS \u2014 the type Contabo provides \u2014 you hold full root access, which means full responsibility above the hypervisor layer. Contabo handles physical security, network-level DDoS mitigation, and hypervisor isolation. Everything above that \u2014 the OS, your applications, your access rules \u2014 is yours to harden.<\/p>\n\n\n\n

What Your Hosting Provider Should Handle<\/h2>\n\n\n\n

Before hardening anything yourself, know what your provider covers. A reputable host should handle the following infrastructure-level protections:<\/p>\n\n\n\n

\n \n \n \n \n \n \n \n \n \n
\n What Your Hosting Provider Should Handle: Infrastructure-Level Security Coverage\n <\/caption>\n
Security layer<\/th>\n What it protects<\/th>\n Contabo provision<\/th>\n <\/tr>\n <\/thead>\n
DDoS protection<\/td>\n Absorbs volumetric and protocol attacks before they reach your server<\/td>\n Always-on DDoS mitigation \u2014 included on all VPS plans at no extra cost<\/td>\n <\/tr>\n
Network firewall<\/td>\n Filters inbound traffic at the network edge before it hits your VPS<\/td>\n Free Contabo Firewall on every VPS \u2014 activate at new.contabo.com \u2192 Network Services \u2192 Firewall<\/td>\n <\/tr>\n
Physical security<\/td>\n Prevents unauthorised physical access to the hardware your VPS runs on<\/td>\n ISO 27001-certified data centers; strict access control and CCTV<\/td>\n <\/tr>\n
Hypervisor isolation<\/td>\n Ensures one tenant’s VPS cannot read or affect another’s data<\/td>\n KVM-based virtualisation \u2014 your VPS is fully isolated from other customers<\/td>\n <\/tr>\n
Network infrastructure<\/td>\n Protects traffic between data center nodes and upstream providers<\/td>\n Handled at the infrastructure layer by Contabo’s network team<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n<\/div>\n\n\n\n

One important distinction: Contabo is an unmanaged VPS provider. OS configuration, application-level security, user accounts, and backups are entirely the customer’s responsibility. That is not a limitation \u2014 it is the tradeoff for full root control.<\/p>\n\n\n\n

Web Hosting Security Best Practices: What You Control<\/h2>\n\n\n\n

These seven steps cover the most common attack vectors on a Linux VPS. Apply them in order on any fresh server before it goes into production.<\/p>\n\n\n\n

    \n
  1. Disable SSH password authentication. Edit \/etc\/ssh\/sshd_config: set PasswordAuthentication no, PubkeyAuthentication yes, PermitRootLogin no. Restart SSH after: sudo systemctl restart ssh. Use SSH key pairs only \u2014 brute-force attacks become pointless.<\/li>\n\n\n\n
  2. Configure a software firewall. On Ubuntu, UFW is the simplest path: sudo ufw default deny incoming && sudo ufw allow 443 && sudo ufw allow 80 && sudo ufw allow <your-ssh-port> && sudo ufw enable. Then activate the Contabo network-level Firewall at new.contabo.com \u2192 Network Services \u2192 Firewall for an additional perimeter layer.<\/li>\n\n\n\n
  3. Install an SSL\/TLS certificate and enforce HTTPS. Let’s Encrypt is free: sudo apt install certbot && sudo certbot –nginx (or –apache). Redirect all HTTP traffic to HTTPS via your web server config \u2014 serving content over HTTP in 2026 is an unnecessary risk.<\/li>\n\n\n\n
  4. Enable automatic security updates. On Ubuntu: sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades. Unpatched vulnerabilities in the OS and packages are the most common breach entry point.<\/li>\n\n\n\n
  5. Set up automated off-server backups. Contabo Auto Backup is an available add-on. For full control, use rsync or rclone to push daily backups to Contabo Object Storage (from \u20ac2.49\/250 GB). Test restores monthly \u2014 a backup you have never restored is untested.<\/li>\n\n\n\n
  6. Apply the principle of least privilege. Never run web servers, databases, or application code as root. Create a dedicated system user per service: adduser –system –no-create-home appuser. Limit sudo access to only the users who need it.<\/li>\n\n\n\n
  7. Install Fail2ban. It monitors authentication logs and automatically bans IPs after repeated failures: sudo apt install fail2ban. Default config protects SSH; configure jails for Nginx, Apache, or your app as needed.<\/li>\n<\/ol>\n\n\n\n

    DDoS Protection: What It Is and Why Every Hosted Site Needs It<\/h2>\n\n\n\n

    A DDoS attack \u2014 Distributed Denial of Service \u2014 floods your server from many sources simultaneously to exhaust bandwidth, CPU, or RAM until legitimate traffic can’t get through. Three main types exist: volumetric attacks that saturate your bandwidth, protocol attacks like SYN floods that exhaust connection state tables, and application-layer attacks like HTTP floods targeting specific endpoints.<\/p>\n\n\n\n

    Contabo’s always-on network-level DDoS mitigation filters volumetric and protocol attacks before they reach your VPS \u2014 this runs automatically with no configuration required. What it does not cover: sophisticated application-layer attacks crafted to look like legitimate traffic. For those, add Cloudflare’s free plan in front of your domain. Cloudflare acts as a reverse proxy, absorbing HTTP floods and offering a WAF (Web Application Firewall) on paid plans. The combination of Contabo’s network-layer DDoS mitigation plus Cloudflare’s application-layer filtering covers the full attack surface for the vast majority of self-hosted sites and APIs.<\/p>\n\n\n\n

    What to Look For in a Secure Web Hosting Provider<\/h2>\n\n\n\n

    Use this checklist when evaluating any hosting provider, particularly before migrating a production site.<\/p>\n\n\n\n

    \n \n \n \n \n \n \n \n \n \n \n \n
    \n Secure Web Hosting Provider Checklist: Features to Evaluate\n <\/caption>\n
    Feature<\/th>\n Why it matters<\/th>\n What to ask<\/th>\n <\/tr>\n <\/thead>\n
    Always-on DDoS protection<\/td>\n Attacks arrive without warning \u2014 opt-in protection is too slow<\/td>\n Is it included on all plans or only premium tiers?<\/td>\n <\/tr>\n
    Network-level firewall<\/td>\n First filter before traffic reaches your server or OS<\/td>\n Is it free and self-configurable, or managed-only?<\/td>\n <\/tr>\n
    Full root access<\/td>\n Lets you apply SSH hardening, custom firewall rules, and OS-level security<\/td>\n Required on VPS; typically absent on shared hosting<\/td>\n <\/tr>\n
    KVM hypervisor isolation<\/td>\n Prevents cross-tenant memory access \u2014 relevant for PCI-DSS, GDPR<\/td>\n Ask which virtualisation layer is used (KVM vs OpenVZ)<\/td>\n <\/tr>\n
    ISO 27001-certified data centers<\/td>\n Confirms physical and procedural security meets audited standards<\/td>\n Ask for certification documents or check the provider’s security page<\/td>\n <\/tr>\n
    Backup options<\/td>\n Ransomware and admin errors both require clean restore points<\/td>\n Available as add-on? Off-server? How long are backups retained?<\/td>\n <\/tr>\n
    Unmanaged option<\/td>\n Full control over your software stack and security configuration<\/td>\n Can you install, configure, and update everything yourself?<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n<\/div>\n\n\n\n

    FAQ: Web Hosting Security<\/h2><\/div>\n\n\n\n
    What is web hosting security?<\/strong>

    Web hosting security is the combination of infrastructure protections \u2014 DDoS mitigation, network firewalls, physical data center controls \u2014 and server-level hardening \u2014 SSH key authentication, UFW firewall rules, SSL certificates, software updates, and automated backups \u2014 that keeps a hosted website and its data protected from attacks, breaches, and data loss.<\/p> <\/div>

    Does web hosting include security?<\/strong>

    It depends on the type. Shared and managed hosting typically bundles DDoS protection, malware scanning, and automatic OS updates. Unmanaged VPS hosting \u2014 what Contabo provides \u2014 includes infrastructure security: DDoS mitigation, network firewall, and KVM hypervisor isolation. OS-level hardening, application security, and backups are the customer’s responsibility. That tradeoff gives you full control in exchange for managing your own security posture.<\/p> <\/div>

    What is the most secure type of web hosting?<\/strong>

    Security depends more on configuration than on hosting type. A well-hardened unmanaged VPS beats a poorly configured dedicated server. Dedicated servers remove the multi-tenant hypervisor surface entirely. Unmanaged VPS gives full control to those who apply SSH hardening, firewall rules, and updates. Shared hosting limits your ability to apply OS-level security at all. For most developers and SysAdmins, a hardened VPS with DDoS protection and SSH key auth is the practical best answer.<\/p> <\/div>

    How do I enable DDoS protection on my Contabo VPS?<\/strong>

    DDoS protection is active by default on all Contabo VPS plans \u2014 no setup required. For additional network-level filtering, activate the Contabo Firewall: log in at new.contabo.com, go to Network Services \u2192 Firewall, and add rules to allow only the ports your server needs. For application-layer protection on top of that, route your domain through Cloudflare.<\/p> <\/div> <\/div>\n\n\n\n

    Articles you may like<\/h2><\/div>\n\n\n\n