How we keep your websites and data safe
Security at Twerple is not a product tier. Every plan runs on the same patched, monitored and isolated platform, with the same encryption, the same backups and the same people watching over it.
Protection at every layer
No single measure keeps a platform safe. These work together, from the edge of our network to the account you sign in to.
DDoS Protection
Traffic to our network is filtered to absorb volumetric and application-layer attacks before they reach your website, so a flood of junk requests aimed at you, or at a neighbour on the same server, does not take you offline.
- Always on, nothing to set up
- Network and application layers (3, 4 and 7)
Web Application Firewall
Rules that block the most common attacks on websites, such as SQL injection and cross-site scripting, before they reach your code, plus scanning that catches malware if something slips in through a plugin or theme.
- Each account isolated from its neighbours
- Automatic malware scanning
Encryption Everywhere
Every domain hosted with us gets a free SSL certificate that renews itself, and every connection to our control panel, client area, mail and APIs is encrypted. Passwords are stored only as salted hashes.
- Modern TLS on every connection
- Free certificates, renewed automatically
Backups Stored Separately
Shared, WordPress and reseller hosting is backed up regularly to storage separate from the live server, and the backups are tested. You can restore files, databases or a whole account yourself from the control panel.
- Restore yourself from the control panel
- Kept apart from the live server
Account Security & 2FA
Two-factor authentication is available on every customer account and required for our own staff. Access to customer data is limited to the people who need it for their work, and it is logged.
- Works with any authenticator app
- Authorized contacts with their own permissions
Data Centres
Our servers sit in professional data centres in the United Kingdom, Germany, France and the United States, with controlled physical access, redundant power and network, and security on site around the clock.
- Controlled physical access
- Redundant power and network
Found a vulnerability? Tell us.
If you believe you have found a security weakness in our website, control panel or infrastructure, we would like to hear from you before anyone else does. Email the details to the address below, with steps to reproduce it if you can.
support@twerple.com
We acknowledge every report within two working days, keep you informed while we fix the issue, and will not take legal action against anyone who researches responsibly, in good faith and without accessing or damaging other people’s data.
Your Part: A Three-Minute Checklist
Most security incidents we see start on the customer side, and all three of these are quick to fix:
- Turn on two-factor authentication in your client area, and use a password you use nowhere else.
- On a VPS or dedicated server, sign in with SSH keys rather than passwords, and keep the operating system updated.
- Keep WordPress or your CMS, its plugins and themes up to date. Outdated plugins are how most websites get compromised.