Security
Security built in, not bolted on
Every SteboHost plan includes WAF, malware scanning, automatic SSL, DDoS mitigation and 24/7 monitoring. Peace of mind should not be a premium feature.
- WAF included
- Daily malware scans
- Automatic SSL
- DDoS mitigation
Defence in depth
Nine layers, zero configuration
Every layer runs on every plan from the moment your account is created. You do not install, configure or pay for any of them.
Web Application Firewall
A managed WAF inspects every request and blocks SQL injection, XSS and known exploit patterns before they reach your application. Rules update automatically as new threats are published.
Malware scanning & quarantine
Imunify360 scans every account daily, quarantines infected files automatically and alerts you — so a compromised upload never sits unnoticed for weeks.
Automatic SSL
Let's Encrypt certificates are provisioned on launch and renewed automatically on every domain. HTTPS is the default, not a checklist item.
DDoS mitigation
Network-level mitigation absorbs volumetric attacks upstream, before traffic ever reaches your account.
Daily backups
Automated daily backups with 7-day retention and one-click restore. Higher plans add offsite copies for protection against server-level failure.
24/7 monitoring
Uptime, resource usage and security events are watched around the clock. When something degrades, we usually know before you do.
Account isolation
CloudLinux cages every account with its own CPU, memory and process limits. One compromised site cannot read another's files or exhaust shared resources.
Brute-force protection
Login endpoints for cPanel, email and WordPress are rate-limited; repeated failures are blocked automatically and reported.
Security scoring
Each account receives an actionable security score — TLS status, software currency, permissions — with concrete steps to improve it.
Security plans
Plans and pricing
Only the billing periods this product is offered for — renewal costs shown upfront.
When something goes wrong
Our incident response, in four steps
Security is not just prevention — it is what happens at 2am when something slips through.
- 1
Detect
Monitoring watches uptime, resources and security events 24/7. Anomalies page our on-call engineer — we do not wait for a customer to notice.
- 2
Contain
Threats are quarantined at the account level first. Isolation means the blast radius stops at your account boundary.
- 3
Restore
Clean daily backups let us restore affected files fast — usually before you have finished reading the incident email.
- 4
Explain
You receive a plain-language incident summary: what happened, what we did, and what to change. No jargon, no blame.
Compliance & data protection
Your data, handled properly
We operate under Kenya's Data Protection Act and align with GDPR for customers serving EU users. Compliance is not a checkbox — it is how we are built.
Kenya Data Protection Act
We operate under Kenya's Data Protection Act with documented subprocessors, breach-notification procedures and data-subject request handling.
GDPR alignment
For customers serving EU users, our data processing practices align with GDPR requirements. A DPA is available on request.
Data retention & deletion
Clear retention schedules for logs, backups and customer data. Data is deleted on account closure — not kept indefinitely.
Data subject rights
Access, rectification, export and deletion requests are handled via support@stebohost.com with identity verification.
Subprocessor register
A public list of subprocessors (data-centre, payment, email delivery) is maintained. Customers are notified of additions.
Audit logging
Every administrative action — provisioning, billing, support access — is logged with who, what, when and why. Nothing happens silently.
How we compare
Security that others charge for
Most hosts sell security as add-ons. We include it — because peace of mind should not be a premium feature.
| Security feature | SteboHost | Typical host |
|---|---|---|
| WAF | Included on every plan, rules update automatically | Paid add-on or not available |
| Malware scanning | Daily scans with automatic quarantine | Manual or weekly, extra cost |
| SSL certificates | Automatic Let's Encrypt, renewed for you | Manual setup, paid after first year |
| DDoS mitigation | Network-level, included, no config needed | Extra cost, often self-managed |
| Backups | Daily, 7-day retention, one-click restore | Weekly, limited retention, extra cost |
| Account isolation | CloudLinux cages every account | Shared environment, cross-site risk |
| Monitoring | 24/7, we usually know before you do | Business hours, customer-reported |
| Incident response | Detect, contain, restore, explain | Ticket queue, no communication |
Security FAQ
Security questions, answered
What is included, and what happens if the worst occurs.
Included on every plan
We do not charge extra for security. Every hosting plan includes the full stack — because peace of mind should not be a premium feature.