How We Keep Your Site Safe: Imunify360, CSF and JetBackup Explained

Good hosting security is layered, mostly automatic, and — when it's working — almost completely invisible. You never see the login attempts that were blocked overnight or the malware that was quarantined before it ran. On every Hostinap server, three tools do most of that quiet work: CSF, Imunify360 and JetBackup. Here's a plain-English tour of what each one actually does, and why we run all three rather than trusting any single one.

Security is layers, not a single wall

The reason serious hosting never relies on one tool is simple: every defence has a gap, and different attacks arrive by different routes. A firewall is superb at stopping unwanted connections but can't read the contents of a legitimate web request. A malware scanner is superb at spotting bad code but only after something has landed. And no matter how good your prevention is, you still want a way to undo damage. Each layer covers the previous one's blind spot.

CSF — the firewall at the front door

CSF (ConfigServer Security & Firewall) is the outermost layer, deciding which connections are even allowed to reach the server. It keeps every port closed except the few that need to be open, and it watches for patterns that signal an attack — most importantly, repeated failed logins.

Its login-failure daemon is the workhorse here: an IP address that keeps guessing SSH, FTP or mail passwords is automatically blocked before it can brute-force its way in. We harden CSF ourselves rather than leaving it on stock defaults, because the default configuration is a starting point, not a finished policy.

Imunify360 — the guard inside

Some things get past any firewall, because they arrive through the front door as ordinary web traffic — a malicious upload through a contact form, a vulnerability in an out-of-date plugin. That's where Imunify360 works. It's a multi-layered security suite that operates inside the account, not just at the network edge.

It scans files in real time for malware, runs a web application firewall that recognises and blocks known attack patterns against apps like WordPress, and can clean infected files automatically. Its reputation system also shares threat intelligence across a huge network of servers, so an attack seen elsewhere is already known here. In short: CSF keeps strangers out, Imunify360 watches the ones you let in.

JetBackup — the safety net

Here's the honest truth every serious host plans around: no prevention is perfect, and the most common cause of lost data isn't hackers at all — it's mistakes. A bad plugin update, an overwritten file, a delete that shouldn't have happened. JetBackup is the layer that makes all of those survivable.

It runs automatic backups on a schedule and — crucially — stores them offsite, on separate infrastructure from your live site. That separation matters: a backup sitting on the same server it's meant to protect is no backup at all if that server has a bad day. Restores are self-service and free, so recovering from a mistake is a few clicks rather than a support emergency.

Why all three, and not just one

Put together, the three cover the whole timeline of a threat. CSF tries to stop it arriving. Imunify360 catches what still gets in and neutralises it. JetBackup undoes the damage if something ever slips through both. Remove any one layer and you leave a gap: a firewall with no scanner misses app-level attacks; a scanner with no backups can clean an infection but not recover deleted data; backups with no prevention mean you're always restoring instead of stopping problems.

What's still your part

Server-side security does the heavy lifting, but a few habits close the gaps only you control:

• Keep applications updated. The large majority of site compromises exploit a known vulnerability in an out-of-date plugin, theme or CMS — patches exist, they just weren't applied.
• Use strong, unique passwords and two-factor authentication on your control panel and CMS logins.
• Remove what you don't use. Every abandoned plugin or old install is an unmonitored door.

The honest part

No one can promise a site will never be attacked — anyone who does is selling something. What layered security genuinely buys you is that the common attacks are stopped automatically, the uncommon ones are caught quickly, and the worst case is a restore rather than a disaster. That's the standard we run on every plan, not just the expensive ones. If you ever suspect something's wrong with your site, tell us — we'd far rather look and find nothing than have you wait.