[{"data":1,"prerenderedAt":169},["ShallowReactive",2],{"publication:en:P185":3},{"meta":4,"copy":17,"relatedArticles":128,"terms":161,"term":162,"resourceParent":163,"glossaryParent":166},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P185","\u002Fblog\u002Fhosting-security-responsibility","article","shared hosting vs VPS security responsibility","Shared hosting vs VPS security responsibility: who owns each task?","Shared hosting vs VPS: security responsibility","Compare hosting responsibility across updates, access, backups and incident support. Use a task-owner matrix rather than assume a hosting label means managed.",[13,14],"\u002Fservices\u002Fservers-hosting","\u002Fservices\u002Flinux-vps","2026-06-16","2026-10-30",{"intro":18,"sections":19,"checklist":88,"faq":94,"links":104,"sources":121,"cta":123},"Shared hosting vs VPS security responsibility is mainly a question of who operates each layer and task, not which label sounds safer. Establish who owns operating-system and application updates, access, backups, restoration and incident support for the actual plan. A VPS can add control and work; a managed label only helps when the included tasks, exclusions and acceptance evidence are clear.",[20,25,61,70,78,83],{"title":21,"paragraphs":22},"Separate the infrastructure type from the management service",[23,24],"Shared hosting, a virtual server and a managed application service can give customers different control and different obligations. The hosting category does not answer who updates the application, checks a failed backup or handles a compromised administrator account. Read the actual plan and service scope. Avoid assuming that root access creates security or that lacking root access means the provider operates every necessary control.","Start with the business workload: website, database, email, integrations and recovery needs. Identify which services are bundled and which are separate suppliers. A migration can move responsibility even when the visible website looks unchanged. Before comparing plans, list the tasks the business needs performed and the owner capable of doing them under each proposed arrangement.",{"title":26,"paragraphs":27,"table":30},"Fill a responsibility matrix before accepting a plan",[28,29],"Use a task-owner matrix to turn marketing descriptions into operational questions. For every important task, record the provider, business or technical supplier responsible, the evidence they supply and the escalation route. If the answer is shared, identify the actual handoff rather than leave both parties assuming the other will act. A task with no agreed owner remains a gap regardless of the plan's name.","This original worksheet does not prescribe a hosting product or declare one architecture best for every business. It helps compare whether the offered service fits the team's capabilities. Include absence and supplier-change scenarios: the owner must be able to reach support, retrieve required records and authorize recovery when the person who bought the plan is unavailable.",{"caption":31,"headers":32,"rows":36},"Hosting task, owner and evidence worksheet",[33,34,35],"Task","Question for the actual plan","Evidence or handoff to request",[37,41,45,49,53,57],[38,39,40],"Operating system","Who maintains the guest or platform layer?","Included components, exclusions and update handling.",[42,43,44],"Website\u002Fapplication","Who updates code, plugins and dependencies?","Approved source, release and functional acceptance record.",[46,47,48],"Administrative access","Who owns accounts, recovery and supplier changes?","Named owner, revocation process and escalation route.",[50,51,52],"Backup and restore","What is retained and who performs restoration?","Scope, access, consistency, limits and a usable test result.",[54,55,56],"Security incident","Who contains each layer and what support is available?","Actual scope, evidence access and specialist dependencies.",[58,59,60],"Exit or migration","Who controls exports, domain and billing access?","Usable handoff and known data\u002Frecovery limitations.",{"title":62,"paragraphs":63,"sources":66},"Use shared-responsibility examples within their real scope",[64,65],"AWS's shared-responsibility model explains that duties vary with the chosen service. Its EC2 example places guest operating-system, installed-application and security-group configuration tasks with the customer. More abstracted services divide responsibilities differently. This is a useful provider-specific illustration of why renting infrastructure does not necessarily include managing the customer's entire application environment.","Do not copy that allocation onto every shared-hosting company or managed plan. Ask the actual provider which tasks it performs, what access it needs and what the customer must maintain. A supplier's infrastructure controls may be valuable without covering plugin configuration or business-account recovery. The agreement and operational handoff need to describe the service actually purchased rather than a generic diagram.",[67],{"label":68,"url":69},"AWS: service-dependent shared-responsibility model","https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fshared-responsibility-model\u002F",{"title":71,"paragraphs":72,"example":75},"Check the application and recovery workflow, not only the host",[73,74],"Review how the website is deployed, who controls its code and which integrations remain outside the host's service. A healthy virtual machine does not establish that a form delivers, a checkout records the right order state or an application account is secure. Define the expected business functions and who tests them after hosting or application changes, using controlled data and supported test modes.","Backups need specific questions: which data and configuration are included, whether the selected recovery point is usable, how access is protected and who can perform the restore. A provider snapshot can have a different scope from application-consistent recovery. Record restoration limits and any data reconciliation required. Do not treat a line saying daily backup as proof of the recovery the business expects.",{"title":76,"text":77},"Illustrative example: more control creates an unowned task","A fictional business moves from a platform-managed site to a VPS. The site runs, but nobody has accepted responsibility for guest operating-system updates. The owner adds that task and its verification to the service scope before treating the migration as complete. This illustrates a responsibility gap, not a comparison of named providers or an actual customer migration.",{"title":79,"paragraphs":80},"Make incident support and evidence access concrete",[81,82],"Ask what happens when the host restricts the site or a user reports unwanted behavior. Who can change the relevant account, retrieve logs and approve a restore? Which activities need another supplier or specialist? Record the real support channel and service terms without turning an advertised response target into a promise about the time needed to resolve every incident.","Evidence availability can matter as much as the support label. Clarify which records are retained, who can request them and what limitations apply to shared resources. A provider may be able to contain part of the environment while the application still needs its own review. Keep those handoffs explicit so a business is not left with separate suppliers each declaring their own layer operational while the incident remains unresolved.",{"title":84,"paragraphs":85},"Choose a service the business can actually operate",[86,87],"Compare the completed matrix with the people and maintenance capability available. More control may be appropriate when someone owns the work; a narrower managed service can also fit when its constraints match the workload. Include the cost and practicality of the missing tasks in the decision without inventing price comparisons or assuming that a more expensive infrastructure tier guarantees stronger security.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website, Linux and digital-infrastructure knowledge. We can discuss the scoped technical responsibilities described on this site and their provider dependencies. No hosting partnership, provider certification or continuously staffed managed service is claimed. Bring the actual plan and workload description so included tasks, exclusions and acceptance can be agreed before changes begin.",[89,90,91,92,93],"Separate hosting category from the purchased management scope.","Assign updates, access, backups and incident tasks explicitly.","Request evidence and escalation routes for shared responsibilities.","Verify application functions and actual restoration capability.","Keep migration, exit and supplier absence ownership clear.",[95,98,101],{"question":96,"answer":97},"Is a VPS always more secure than shared hosting?","No universal ranking is given. The workload, configuration, maintenance and actual responsibility allocation matter. More control can also create more tasks for the customer.",{"question":99,"answer":100},"Does managed hosting include WordPress plugin maintenance?","Check the actual agreement. A managed label does not establish which application components, configurations or acceptance checks are included.",{"question":102,"answer":103},"Does a hosting backup guarantee recovery without data loss?","No: establish the backup scope, selected recovery point, restoration process and business-data acceptance. A successful backup job alone does not prove that result.",[105,108,111,114,117,119],{"path":106,"label":107},"\u002Fblog\u002Flinux-server-hardening","Define an owned server baseline",{"path":109,"label":110},"\u002Fblog\u002Fdocker-security-checklist","Assign container and host responsibilities",{"path":112,"label":113},"\u002Fblog\u002Fbackup-provider-checklist","Ask concrete backup-provider questions",{"path":115,"label":116},"\u002Fblog\u002Fbusiness-recovery-plan","Define business recovery acceptance",{"path":13,"label":118},"Review infrastructure and hosting support",{"path":14,"label":120},"Discuss Linux and VPS technical scope",[122],{"label":68,"url":69},{"title":124,"description":125,"button":126,"type":127},"Clarify who owns the technical work around your hosting","Describe the hosting plan, website and unclear responsibilities without submitting account passwords or confidential service records.","Discuss the responsibility scope","check",[129,138,145,153],{"id":130,"path":131,"title":132,"description":133,"category":134,"artwork":135,"order":136,"publishedOn":137},"P056","\u002Fblog\u002Fcloudflare-waf-false-positives","Cloudflare WAF false positives: restore a legitimate workflow safely","Investigate a legitimate-request block using Cloudflare events and origin evidence. Plan a narrow exception and verification without disabling all protection.","infrastructure","security",26,"2026-05-31",{"id":139,"path":109,"title":140,"description":141,"category":134,"artwork":142,"order":143,"publishedOn":144},"P187","Docker security checklist for small business: verify the boundaries","Review Docker daemon access, users, mounts, published ports, images and recovery. Separate container configuration from host and application security.","integrations",35,"2026-07-02",{"id":146,"path":147,"title":148,"description":149,"category":134,"artwork":150,"order":151,"publishedOn":152},"P176","\u002Fblog\u002Fdiagnose-ddos-vs-overload","DDoS attack or website overload? Compare the evidence","Compare traffic, origin resources, errors and recent changes before calling an outage DDoS. Match protection to the affected layer and verify key workflows.","performance",21,"2026-05-15",{"id":154,"path":155,"title":156,"description":157,"category":134,"artwork":158,"order":159,"publishedOn":160},"P101","\u002Fblog\u002Flinux-ssh-hardening","SSH hardening for Linux servers without losing authorized access","Review SSH users, keys, privileges and network exposure. Plan recovery access, syntax checks and fresh-session tests before retiring the old access route.","servers",42,"2026-07-18",[],null,{"path":164,"label":165},"\u002Fresources","Website security resources and templates",{"path":167,"label":168},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058268]