Security at veldhost

The short version lives at veldhost.eu/security. This article covers what it means for your site day to day.

Where your site actually runs

Your site, its database, DNS and email run on infrastructure we operate ourselves in German datacenters. Nothing about serving your site touches a US cloud provider, and site data doesn't leave the EU. Every site runs in its own isolated container — a neighbour's badly written plugin can't touch your files.

What's protected automatically

• TLS everywhere — certificates are issued and renewed for you, including custom domains.
• Security patching — operating-system and runtime security updates roll out across the fleet automatically, with daily vulnerability scanning behind the scenes.
• Backups — nightly restore points, encrypted, and replicated every night to storage in a second region, physically separate from the servers running your site.
• DNSSEC — available on our nameservers so DNS answers for your domain can't be forged.
• WordPress hardening — every WordPress site gets an admin gate: an extra browser login (HTTP basic auth) in front of /wp-admin/ and /wp-login.php, checked at our edge so automated scripts never reach the WordPress login. The /wp-json/batch/v1 endpoint and xmlrpc.php are blocked outright, and the login is rate-limited per address. Details in WordPress: your first steps.

Your account

Use a passkey or hardware security key — it's the strongest option and veldhost Manage supports them natively (Security page in your dashboard). Authenticator-app 2FA and recovery codes are there as backups. API access uses scoped tokens you can revoke at any time, and anything that spends money or deletes data always asks you to confirm interactively.

Reporting a vulnerability

Email security@veldhost.eu. Reports are acknowledged within one business day — please give us reasonable time to fix an issue before publishing, and don't access data that isn't yours while testing.