Your website is a set of files on a computer in a data centre, reached through your domain name. Keeping it safe is split between your host and you. The mistakes security professionals worry about most happen on your side of the line, and that side takes ten minutes to check.
What is hosting, actually?
Hosting is the computer that stores your site and sends it to every visitor. It is one of three separate things a website needs, and they are often bought from different companies:
- The domain is your address, such as yourbusiness.com. You rent it a year at a time from a registrar. If it lapses, someone else can eventually register it.
- The hosting is the computer that stores your site's files and sends them to every visitor. It sits in a data centre run by your host.
- The site is the files themselves: the pages, images, text and any forms.
Email is often a fourth piece. It is attached to the domain but runs separately.
Think of a shop. The domain is the address on the signboard, the hosting is the premises, and the site is the stock and fittings. You can move premises and keep your address, as long as the address is registered in your name.
Who looks after what?
Your host looks after the building and the machines; you look after the logins and the data. Amazon Web Services, one of the largest hosts in the world, calls this the shared responsibility model: the host secures the cloud itself, and the customer secures what they put in it. The more the host manages for you, the further the line moves towards them. Your data and your logins always stay on your side.
For a typical small-business website on managed hosting, the split looks like this:
| Part | Who looks after it |
|---|---|
| Data centre buildings, power and hardware | The host |
| Server software and security updates | The host on managed hosting; you or your developer on a rented bare server |
| The secure connection (the padlock in the browser) | Usually the host |
| Your account logins and passwords | You |
| Who else has access: staff, agencies, freelancers | You |
| Domain renewal, and the card it is billed to | You, unless your provider renews it for you |
| What you publish, and what people send through your forms | You |
| A copy of your site and data kept somewhere else | You |
The host's half is the expensive, technical half. Yours is mostly about people and passwords, and that is exactly why it gets neglected.
Where do problems usually start?
On the customer's side, usually with people and passwords. Breaking into a well-run data centre is hard; guessing a reused password is easy. In the 2021 Cloud Security Report from Cybersecurity Insiders and (ISC)², a survey of 613 security professionals, the top threat named was misconfiguration (67%): settings left wrong by the customer, not attacks on the host. Accidental exposure of passwords and keys was a top concern for 46%.
For a small business, it usually looks like one of these:
- A password reused from another site that was leaked years ago.
- No two-step sign-in on the business email. Email is the master key, because every other password can be reset through it.
- A former employee or an old agency that still has a login.
- A domain that lapses because the card on file expired.
- A domain registered in the agency's name, so moving it needs their permission.
- Enquiries forwarded to an inbox nobody checks any more.
None of these needs a hacker with special skills. Each one takes minutes to prevent.
A ten-minute check of your side
Do this once now, and again whenever someone joins or leaves:
- Turn on two-step sign-in for your business email, your domain registrar and your website account. If you sign in with Google or Apple, protect that account too.
- Use a different password for each, kept in a password manager.
- List everyone who can log in, and remove anyone who has left or finished their work.
- Check when your domain expires, that auto-renew is on, and that the card on file is current.
- Look up who your domain is registered to. It should be your business, not your web agency.
- Send a test enquiry through your own form, and check that it arrives where someone reads it.
- Keep a copy of your site's files and important data somewhere other than your host.
That last one has a post of its own: Backups You Have Actually Restored. If your site or anything else runs on your own AWS account, the 20-minute security check covers the settings inside it.
What does Quantum Accord handle, and what stays with you?
If your site is built and hosted with Quantum Accord, we handle the hosting, the padlock and the security of your account; you handle your sign-in, who you share it with, and your own copy of the site.
We look after:
- Keeping the site online. Hosting is included with every paid site: no separate hosting fee and no monthly hosting bill.
- The padlock. Sites on your own domain get free HTTPS.
- Connecting your domain. We connect your own domain for free. If you buy the domain through us, it is registered in your name and we renew it for you.
- Your account's security. Sign-in passwords are stored as salted hashes we never see, all traffic is encrypted, and each project is walled off at the database level so nobody else can read it.
- Payments. These go through Stripe and Razorpay. We never store card, UPI or bank details.
You look after:
- Your sign-in. Use a strong, unique password, or sign in with a Google or Apple account that has two-step sign-in turned on.
- Who you share access with.
- What you publish, and the enquiries your form sends to your email.
- Your own copy of the site. Once you have bought a site, you can download its files at any time. Edits made with Quantum Tune are not included in the download.
- Your domain's renewal, if you bought it from a registrar yourself.
The details are on our security page. If you think you have found a security problem, email support@quantumaccordbg.com.