Cybersecurity for the Websites We Host
Managed Hosting · Cybersecurity
Every website we host is protected by layered defenses, watched around the clock and patched as soon as a fix exists. When a serious threat appears, we act the same day, and we keep the wider business community informed through our own publications.
- Layered firewalls
- Same-day patching
- Verified backups
- Continuous monitoring
How We Protect Your Website
Security Built Into Every Hosting Plan
- Layered firewalls. Attack traffic is filtered at the network edge, at the server and inside WordPress, so a request has to pass several independent checks before it reaches your site.
- Rapid patching. We track newly published vulnerabilities, check every site we host and apply the fix as soon as it is released, instead of waiting for a scheduled update.
- Malware detection and cleanup. Real-time scanning, including machine-learning detection that recognizes new threats by how they behave, with infected files cleaned up immediately.
- Backups before every change. Verified backups are taken before updates are applied, with copies kept off the server and off-site, so any site can be restored.
- Hardened logins. Two-factor login and login challenges for administrators, bot protection against password guessing, and administrator names hidden from the public.
- Monitoring and response. Uptime and security events are watched continuously, and firewall rules are adjusted as attacks change.
See everything included with hosting on our Managed Hosting & Website Security page.
Our Track Record
Security Events We Have Mitigated
These are the largest threats our hosted websites have faced, how we responded and what came of it.
PHP2Shell: Two Critical PHP Vulnerabilities
October 21, 2026 · CVE-2026-109618 and CVE-2026-109619
The PHP maintainers announced two critical flaws, each rated 9.2 out of 10, that could let an attacker run code on a web server without logging in. PHP runs WordPress and most of the web, there was no workaround, and attack traffic was reported before the fix was even released.
- October 20: as soon as the advance notice was posted, we put the release on watch.
- October 21, early morning: we inventoried every server we run that uses PHP and confirmed our admin tools could be reached only from our own offices until patched.
- Before the fix: we took fresh, verified backups of 67 client WordPress websites, 97.4 GB in all.
- 9:37 to 9:45 AM: the fix arrived earlier than scheduled. Checking every 10 minutes, we caught it and updated all 97 websites on our client hosting server, comparing each site before and after. All 97 came back normal.
- Afterward: we scanned for signs of compromise and found none, then updated every remaining system we run, finishing the next morning.
We Spread the Word
While we patched, we published guidance for business owners across our own sites.
NewSunSEO BlogPHP Security Release Fixes CVE-2026-109618 and CVE-2026-109619- BizScoreAICritical PHP Vulnerabilities: Patch Now
- SEOScanPROPHP Security Release Fixes Two Critical RCE Flaws
- LocalSEOBotCritical PHP Update: What Local Businesses Must Do Now
- Managed TechnologyPHP Security Release Fixes CVE-2026-109618 and CVE-2026-109619
- Managed TechnologyCritical PHP Vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Released
- Managed TechnologyCritical PHP Memory Corruption Flaws: What Small Businesses Should Do Now
Distributed Vulnerability Scan
August 14, 2026
A coordinated network of scanning servers in several countries hit the server that hosts our clients’ websites at up to 1,350 requests a minute, hunting for password files, code repositories and weak plugin pages.
- Our firewall rules blocked the probes, including rules we had added earlier that month for exactly this kind of attack.
- Every scanning address was blocked automatically as it appeared.
- Sites slowed for a few minutes at the peak and recovered on their own. No probe succeeded, and no file or password was exposed.
Coordinated Credential Harvesting Campaign
July 2 to July 24, 2026
Attackers from multiple networks swept the websites we host, trying to download configuration files, database passwords, private keys and other secrets. One client website was singled out and probed continuously for three weeks.
- Our web application firewall refused the requests on every site we host.
- The three-week campaign probed 772 different paths on the targeted site, rotating fake browser identities. None succeeded.
- No site was compromised, and the campaign stopped on its own.
Secure Hosting
Put Your Website Behind Our Protection
Tell us about your website and where it is hosted today. We will show you how we would protect it, keep it updated and respond when the next threat appears.
NewSunSEO
Grow in Google and AI Search
AI-SEO, local search, paid ads and websites from one team, with offices on Long Island and in Myrtle Beach.
- AI-SEO
- Local AI-SEO
- AI Consulting
- PPC
- Web Design
- Web Development
- Long Island Office(631) 320-1700
- Myrtle Beach Office(843) 492-7131
Request a Free Proposal
Tell us about your business and where you want to grow.
We will reply by email to talk through your goals and what a proposal would include.
We use your details only to reply to you and send what you asked for. See our Privacy Policy.
