Managed WordPress hosting security means the host runs a web application firewall, DDoS protection, SSL and backups for you. EasWrk includes a firewall, DDoS protection, free SSL and daily backups kept for 30 days on every plan. No host stops every attack, so keep plugins current and use strong admin logins.
This page states what we include and what we do not claim. Each included item below is also on our hosting and pricing pages.
What managed WordPress hosting security should cover
- A web application firewall that filters hostile requests before WordPress loads.
- DDoS protection so floods of traffic do not take the site down.
- SSL so traffic between visitors and the site is encrypted.
- Backups with a stated retention period and a clear way to restore.
- Visibility so you can read your own logs and see what is installed.
Ask any host for all five, in writing, with what each one does and does not do. This page does that for EasWrk.
What every EasWrk plan includes
- Web application firewall. An always-on firewall sits in front of your site on every plan.
- DDoS protection. Included alongside the firewall.
- Free SSL. A free certificate on every domain, set up and renewed automatically.
- Daily backups kept for 30 days. We keep thirty days so you can go back to before a problem started, including one you only notice later.
- WrkMate. The assistant built into your account can read your error log and list your plugins in plain language.
How WrkMate treats actions on your account
WrkMate cannot run a raw command. It returns a typed request, and the server maps it to one known, allowlisted action. Every action runs through 11 security layers before it touches your site. Payment data and billing data stay locked, and deleting databases, DNS records or files needs your confirmation. After an action runs, WrkMate checks it took effect and reports failure if it did not. See WrkMate for the full list.
WordPress hosting backup: how it works
Backups are daily and kept for 30 days. Our terms on backups and data say restoration is available on request through the support ticket system, that restoring to a specific point in time may not always be possible, and that backup availability is not guaranteed. The terms also tell you to keep your own independent backups of critical data. We recommend that as well.
What we do not claim
- No certification. This page makes no claim of SOC 2, ISO 27001 or any other audit.
- No guarantee against attacks. A new vulnerability in a plugin can be used before any firewall has a rule for it.
- No claim to scan or clean malware. We do not say a plan finds or removes it.
- No claim on your plugin updates. Updating plugins stays with you unless you take a care plan.
- No detailed rule or limit settings. We do not publish firewall rule sets or login limit thresholds here. For specifics on your plan, ask support.
EasWrk hosts your files and data. You own them and control them.
Hosting security reduces what reaches your site. It does not replace updates, strong admin logins and a backup you have tested.
What stays with you
Three things stay with you on any host: plugin updates, admin passwords and two-factor login. Our guide to brute force attacks shows how bots guess logins and what limits them. If you want help, support is a ticket away.
Questions people ask
What does managed WordPress hosting security cover?
Managed WordPress hosting security typically covers a web application firewall, DDoS protection, SSL and backups. EasWrk includes all four on every plan: a firewall, DDoS protection, free SSL and daily backups kept for 30 days. WrkMate, built into every plan, reads your logs and plugins.
Is managed WordPress hosting security enough on its own?
No. Hosting lowers the volume of attacks that reach your site, but outdated plugins and weak admin logins remain your risk. Patchstack found 91% of the 11,334 new WordPress vulnerabilities of 2025 in plugins, which no firewall setting can update for you.
How long does EasWrk keep backups?
Daily backups are kept for 30 days on every EasWrk plan. Under Section 9 of our terms, restoration is requested through the support ticket system, a specific point in time may not always be possible, and you should keep your own backups of critical data too.