Founding Backer Campaign: lock in WP Pro 4 for $300/yr for life. Ends Dec 31.
Web7 was founded by a cybersecurity professional who saw, audit after audit, how poorly many hosting companies protect their customers. Here's exactly how we do things differently, layer by layer.
4 layers
of firewall, each from a different vendor
≤ 2 weeks
between patch cycles, and weekly when we can
Daily
offsite backups that can't be deleted
0
shared hosting plans. VPS or better, always.
Why security comes first here
Before starting Web7, founder Zig Warner was head of IT for a global security company, helping more than 100 government agencies improve their security posture.
Part of that work was auditing hosting companies, and time after time, their security practices fell short. Web7 exists because of what those audits found: it's a hosting company built with a security-first approach from day one.
“
I watched hosting companies fail security audits time and time again. So I built the hosting company I wished they'd been.
Zig Warner
Founder, Web7 Technologies
The Quad Firewall
Most hosts run a single firewall because it's easy. We firewall at four separate layers, and each layer uses a different vendor or software. It's more complex and more work for us to manage. That's the point: if a vulnerability turns up in one of them, three more still stand between an attacker and your site.
Optional · Layer 5
Cloudflare firewall
Route your domain through our Cloudflare protection with a single CNAME.
Layer 1
Edge firewall
Filters traffic at our network edge, before it reaches any server.
Layer 2
Hypervisor firewall
Enforced on the physical host that runs your VPS.
Layer 3
VM firewall
Runs inside your VPS's own operating system.
Layer 4
Container firewall
Wraps each individual website on your server.
Your website
WHY DIFFERENT VENDORS
A flaw in one firewall product can't open all four layers, because no two layers run the same software.
OPTIONAL 5TH LAYER
Point your domain at a dedicated hostname we provide, and your traffic passes through our Cloudflare firewall before it ever reaches layer one.
CLOUDFLARE HELP
We know Cloudflare well and can help you set it up. Our knowledge base, launching January 1, 2027, will include guides on Cloudflare, firewall configuration and recommended security settings.
Patching
We regularly see sites arrive from other hosts running on kernels and SQL databases that haven't been updated in years. That doesn't happen here.
Every 2 weeks
Our minimum patch cadence for every server.
Weekly
What we aim for whenever we can.
Immediately
Urgent, high-risk CVEs are patched as soon as a fix is known.
Many updates can be applied with live patching, with no reboot needed. When a server does need one, our high-availability cluster means a reboot is never a reason to put off a patch:
1
We move your VPS to another server in our high-availability cluster.
2
We patch the server you were on.
3
We reboot it so every update takes full effect.
4
We migrate your VPS back to the server it was on.
Isolation
We don't offer shared hosting at all, unlike most hosting companies. Every plan is a virtual private server or better, so your sites never share an operating system with strangers.
And within your VPS, every website runs in its own container. A compromised site can't infect the host operating system, and it can't reach the other sites on the same server.
Your VPS
Container
shop.example
Container
blog.example
Container
client.example
Each site is walled off from the others
Host operating system
Sites can't reach it
PHP lifecycle
A PHP version that has reached end of life no longer gets security fixes, so we retire unsupported versions regularly.
SUPPORTED
Supported PHP versions are available in the control panel for every customer.
END OF LIFE
When a PHP version stops receiving support, we remove it from the control panel for new customers. Existing customers still using it are messaged and encouraged to upgrade.
BY REQUEST ONLY
Moving a very outdated application that needs an old version? Contact support. We'll explain the risks before we enable it.
Optional add-on · free
Want even more protection? Add BitNinja to your account free of charge. It's a server security suite that works alongside the Enhance control panel.
✓
AI-powered malware scanning that detects known and zero-day malware
✓
A web application firewall that stops SQL injection, XSS and CMS exploits
✓
IP reputation from a defense network shared across thousands of protected servers
Good to know
Because it actively scans and filters traffic, BitNinja needs more CPU and memory than a server without it. Depending on your sites, you may need a larger plan to run it comfortably. We're happy to help you decide.
Backups
Backups aren't a firewall, but they're what turns a security incident into a quick restore.
Every site is backed up automatically every day, and each backup is kept for 30 days. Backups are stored offsite, separate from our main data center, for regional safety.
You can access and restore your backups yourself at any time, but you can't delete them. So even if a site is infected, a malicious script can't wipe out the backups you'd use to recover.
Primary
Your server
Albuquerque data center
→
Offsite
Backup storage
Separate location · 30 days kept
✓
You can browse and restore any backup
✕
Nobody on your account can delete them, not even a malicious script
Also on every plan
FACILITY
Our servers live in a SOC 2 certified facility in Albuquerque, New Mexico, on hardware we own.
LOGINS
The control panel blocks brute-force login attempts, and you can turn on two-factor authentication.
MANAGED
We handle operating system hardening and monitoring, so your server's security never depends on remembering to do it.
SSL
Let's Encrypt certificates are issued and renewed automatically, so every site runs on HTTPS.
Questions about security?
Need details for a security review, or want help hardening your sites? Our in-house team is happy to walk you through how everything works.
