Secure Hosting
Your site runs on a server hardened to published government and industry baselines, measured by a scanner, and looked after as if the outcome were ours. It is.
Whose problem security is
The United States Cybersecurity and Infrastructure Security Agency asks the people who build and run technology to take ownership of their customers' security outcomes rather than leaving the customer to work it out. We agree, and it is the simplest way to say what this service is: the server is our responsibility, not a box you rent and hope about. What follows is what that responsibility consists of, named control by control, because a claim about security that does not name the control is just a claim.
Hardened to a written standard, and measured against it
The operating system is configured to the Defense Information Systems Agency's Security Technical Implementation Guide for Ubuntu 24.04, the configuration baseline the US Department of Defense requires of its own systems, and measured against the Center for Internet Security's Ubuntu Linux Benchmark, control by control. The web server is measured against the CIS NGINX Benchmark the same way. Where the two baselines disagree, the stricter one is applied, and each place they differ is written down against its control number rather than quietly decided.
Measured means measured: a compliance scanner runs the government's own checklist against the live server, produces a result for every control, and that result is kept. When the checklist is updated, the server is scanned against the new one. The handful of controls that do not apply to a public website are recorded as decisions, with the reason, not skipped.
The connection
- Every page is served over HTTPS with a certificate from Let's Encrypt, renewed automatically well before it expires, with the renewal itself tested rather than assumed
- Only TLS 1.2 and 1.3 are offered; the older protocols that every current guideline retires are switched off
- Browsers are told to use HTTPS on every future visit, so a plain-HTTP link cannot be used to downgrade a visitor
- Your domain's records are signed with DNSSEC, so a resolver can tell a genuine answer from a forged one, and a CAA record names the one authority allowed to issue certificates for it
- If we host your mail domain's records as well, they carry the policies that let other mail servers refuse to deliver your mail over an unencrypted connection, and report when they had to
The server
- The host firewall denies everything inbound except the two ports a website needs, and the cloud firewall in front of it does the same
- There is no remote login service on the server at all. It is administered through the cloud provider's own session channel, with every action logged, and the emergency path is a console that needs a password kept in a vault
- Security patches are applied automatically every day, with a scheduled restart when a patch needs one
- An intrusion prevention service watches the web server's logs and blocks an address that misbehaves
- Privileged activity is audit-logged under rules that are locked at boot and cannot be changed without a restart, and the audit log is shipped off the server every week to a store the server itself cannot read or delete
- A file integrity monitor takes a fingerprint of the system and reports every day what changed, so an unexpected change is noticed the next morning, not the next year
- The credentials the server holds are sealed to a hardware security chip on the machine, so a copy of its disk is worthless anywhere else
Backups you can actually restore
Snapshots are taken daily and weekly and kept under a retention schedule. That is the easy part. The part most hosting quietly omits is proving the restore: on a schedule, a snapshot is restored to a separate machine and checked, so that when a restore is needed for real it is a rehearsed procedure and not a first attempt.
The code, and the people
Anything that runs on the server, including the site's own contact form, is reviewed against the OWASP Application Security Verification Standard, and every automation script is checked by a linter before it is allowed to run. The practice's own controls are built to the catalog of requirements in NIST Special Publication 800-171, the one the Department of Defense uses for its contractors. We are not certified against it and do not say we are; we build to it because it is a good standard and because we intend to be assessed against it.
All of this is written down: every procedure, every decision and every known fault, in a library that is kept current. When something goes wrong, the record says what happened and what was changed so it does not happen again.
What it costs
The same infrastructure serves a one-page site and a fifty-page one, so the price does not climb with your ambition. Ask, and you will get a number rather than a call.