Web Hosting Security: Who Handles Updates, Scans and Cleanup?
Assign a person to each security task before you compare hosting plans. A plan can provide a firewall and backups while leaving plugin updates, account access and incident coordination to you. “Managed” is a starting point for questions; the written scope for the exact product establishes what is included.
This guide is a buying and handover checklist. If a site may already be compromised, use the WordPress malware recovery checklist. For the difference between protection features, read WAF versus malware scanning.
Separate infrastructure from the website application
WordPress’s hardening handbook distinguishes hosting infrastructure from the application responsibilities of the website owner. It recommends keeping software current, limiting access, preparing backups and monitoring. Treat that as a framework for risk reduction; a host’s security feature list does not establish that every application task is covered.
For a WordPress site, ask about core, plugins and themes separately. For an unmanaged server, also ask who maintains the operating system and server software. The answers can change across products from the same company. Start with shared hosting versus managed WordPress or managed versus unmanaged VPS when choosing the service model.
Turn update ownership into a practical routine with the WordPress update checklist. Use the PHP upgrade checklist when the change involves the hosting runtime.
Build a responsibility record for the exact plan
| Task | Question to ask | Record before purchase |
|---|---|---|
| Server maintenance | Who applies server security updates, and which components are excluded? | Provider or administrator; product name; documented scope. |
| Application updates | Who updates core, plugins and themes, checks compatibility and verifies the result? | Named maintainer; update process; rollback owner. |
| Firewall rules | Who enables rules and handles legitimate requests that are blocked? | Rule owner; support route; access to relevant events. |
| Malware detection | What is scanned, how often, and who receives an actionable alert? | Scan coverage; alert recipient; next action. |
| Malware cleanup | Is removal included, a paid service or outside support? | Eligibility; exclusions; quote route; responder. |
| Backup recovery | Who selects a recovery point, approves data loss and tests the restored site? | Retention; restore access; approval and verification owners. |
| Account access | Who can recover the hosting, domain and email accounts? | Business owner; recovery contacts; delegated access. |
Do not fill this record with “the host” or “the agency” unless that party has accepted the task. Save the relevant support article and the plan name alongside the answer. A verbal assurance is difficult to use during a handover or incident.
Ask what the provider actually does after an alert
For a documented example of a boundary, Kinsta’s managed WordPress support scope covers help with platform features and server-error investigation, while excluding code editing and code audits. This illustrates why platform assistance and application maintenance need separate owners; it is not a comparison of providers’ response quality.
Send a prospective host a concrete scenario: “A security scan flags a file in a paid plugin on this plan. Who investigates, who removes it, who replaces or updates the plugin, and who verifies checkout afterward?” Ask whether there are extra charges, prerequisites or excluded components. Use the hosting support scope guide to record the boundary.
Keep recovery independent of a single login
Make account ownership and backup access part of the same review. Use the domain and hosting ownership guide to identify the business’s controlling accounts. Record the approved recovery route without placing passwords or recovery codes in a shared document.
Check whether a usable backup remains available if the hosting account is restricted. Our hosting backup guide covers independent copies, and the restore test checklist covers practical recovery verification. Someone should be able to explain what will happen before an emergency makes the decision urgent.
Compare the cost of completing the work
Put uncovered maintenance, security add-ons and incident assistance into your operating budget. A cheaper subscription can still be suitable when you already have a capable maintainer. A higher-priced managed plan can be useful when its written scope covers work you would otherwise buy separately.
Use managed WordPress hosting options for the shortlist, then verify each candidate against this responsibility record. Recheck ownership and scope when you change plans, replace an agency or hand the site to a new employee. Include the record in the website handover checklist.
Walk through a concrete responsibility gap
Suppose a firewall alert reaches the business owner, but the hosting plan excludes application cleanup and the maintenance agreement covers only updates. The alert has a recipient but no accepted remediation owner. Resolve that gap before an incident: name the responder, support route, authorization owner and recovery verifier. Record the actual scope beside the plan, rather than assuming the word managed covers it.
Sources and scope
Official WordPress and Kinsta documentation checked October 5, 2026. The question table and buying process are HRL’s editorial recommendations. This page does not report security tests, malware removal or support response tests performed by HRL.