Website security is not a single setting, but an ongoing process. In Seravo's WordPress upkeep, security is based on the principle of shared responsibility: Seravo manages server-level infrastructure, 24/7 monitoring, and automated security updates around the clock, while the site owner is responsible for user account password hygiene and WordPress-level content.
This guide covers Seravo's automated security measures as well as best practices and additional protections you can implement to achieve the highest possible security level for your site.
Seravo's Automated Server-Level Protection
Seravo's server environment has been built and optimized from the ground up specifically with WordPress security in mind. Your hosting plan includes multiple built-in layers of automatic protection:
DDoS mitigation and Web Application Firewall (WAF): Seravo's WAF and traffic filtering block common attacks and malicious bot traffic before requests ever reach WordPress.
Automated security updates: We automatically apply critical security updates across the entire server environment. This covers the operating system and server stack (including nginx, database services, and minor security patches for your active PHP version), as well as essential security fixes for the WordPress core and plugins.
Continuous monitoring and nightly scans: We monitor servers 24/7 and regularly scan site files and databases for malicious code and security anomalies.
Daily backups: An automated backup of your site files and database is created once every 24 hours, and backups are retained for 30 days.
Key Administrator Best Practices
Even though the server layer is strongly protected, the vast majority of website breaches exploit weak passwords or outdated code. You can strengthen your site's security by following these practices:
Practice good password hygiene: Never reuse passwords across multiple systems, and assign each administrator a personal account instead of using shared logins. We recommend using a dedicated password manager (such as 1Password, Bitwarden, or KeePass). Maintaining proper password hygiene is also a prerequisite for Seravo's Security Guarantee.
Keep your PHP version up to date: Switching the PHP version used by your site is not done automatically to avoid unexpected code incompatibilities. We recommend checking and upgrading your site's PHP version regularly by following our PHP version upgrade guide.
Remove inactive plugins and themes: Any code residing on the server represents potential attack surface. Completely delete all deactivated plugins and check our guide on unnecessary, prohibited, and malicious plugins.
Additional Security Measures and Tools
You can enable the following recommended protections on your site:
Two-Factor Authentication (2FA)
Two-factor authentication (2FA) requires a one-time verification code (e.g., via Google Authenticator or another TOTP app) alongside your password during login. Enabling 2FA effectively prevents unauthorized access even if an administrator's password is leaked. See our instructions in Enabling Two-Factor Authentication.
Seravo Plugin Security Tools
The Seravo Plugin, included on all sites hosted with us, features built-in tools for inspecting site security. Under Tools > Security in the WordPress admin dashboard, you can review site status, clean up temporary files, and audit recent user logins and accounts.
HTTP Security Response Headers (HSTS and CSP)
HSTS (HTTP Strict Transport Security): Forces browsers to always communicate over an encrypted HTTPS connection, mitigating man-in-the-middle attacks. HSTS is enabled by default at Seravo, but directives can be tightened if needed. See our guide on Managing and Tightening HSTS Settings.
CSP (Content Security Policy): Defines trusted content sources (scripts, stylesheets, and images) for the browser and shields your site from XSS and clickjacking attacks. See our guide on Configuring Content Security Policy (CSP) Directives at Seravo.
Security Scans and Penetration Testing
If your organization or a third-party security partner plans to perform a security audit, vulnerability scan, or penetration test on your site, this must be agreed upon with Seravo in advance.
Important Note on Audits and Scans:
We monitor our server infrastructure 24/7, and our automated intrusion prevention systems detect aggressive scanning traffic as malicious attacks. Please notify our customer support well in advance at [email protected] to confirm proper authorization and finalize an audit agreement, ensuring scans do not result in automated IP bans or service interruptions.
See Also
By maintaining good password hygiene and taking full advantage of Seravo's multi-layered server protections, you ensure your site has the best possible defenses against modern web threats. If you notice any suspicious activity on your site or need advice on strengthening your site's security, Seravo's customer support and WordPress specialists are always available to help at [email protected].