Website security is not one tool that gets installed when a site launches. It requires several systems working together, along with someone responsible for maintaining the software, watching for unusual activity, and knowing what to do when something changes.
That ongoing responsibility is part of hosting with interGen. We use multiple layers of protection so that a problem has more than one opportunity to be blocked, detected, or recovered from.
How Layered Security Works
No single lock can prevent every break-in, and no single security tool can protect a website from every type of online threat. A firewall may block one kind of attack while another control limits login attempts. File monitoring may catch an unexpected change that slipped past both. If something still goes wrong, separate backups provide a path to recovery.
These systems overlap intentionally. Each one addresses a different point of failure, and our team is responsible for maintaining and monitoring them over time.
For the websites we host, that protection includes three primary layers: website-level security, server-level security, and off-site backups. Ongoing software maintenance supports all three by reducing exposure to known vulnerabilities.
Website-Level Protection
The first layer operates inside the website itself. Every Joomla site we host includes security controls designed specifically for the software powering the site.
These controls evaluate activity as it reaches the website and respond automatically to several common attack patterns:
- Web Application Firewall: Incoming requests are inspected before the website processes them. Requests that match known malicious patterns can be blocked before they reach the application.
- Login Protection: Automated programs frequently try to gain administrative access by submitting large numbers of username and password combinations. Repeated failed login attempts are detected and suspicious sources can be blocked automatically.
- Probing Prevention: Automated scanners often request large numbers of nonexistent pages or files while searching for known weaknesses. Unusual patterns of repeated errors can trigger an automatic block before the scan continues.
- Protected Media Folders: Attackers sometimes try to upload malicious files into folders normally used for images, documents, or other media. Server rules restrict executable files from running in those locations, reducing the chance that an uploaded file can be used to compromise the site.
- File Change Monitoring: Security tools track the files that make up the website. Unexpected file changes can be flagged so our team can determine whether the change was legitimate or needs attention.
- Configuration Monitoring: Important site settings are monitored for changes. When a critical configuration change occurs, our team receives an alert rather than relying on the client to notice that something has changed.
Server-Level Protection
Behind the website itself is the hosting environment that stores and processes the site's files and database. interGen manages this environment directly, which allows us to apply security controls across the server rather than relying only on protections installed inside each individual website.
Think of the server as an apartment building with advanced safety features:
- Account Isolation: Each hosting account operates in its own isolated environment. A problem affecting one account is restricted from simply reaching across to view or alter another client's site files.
- Hardened Server Environments: Server settings restrict functions and commands that are unnecessary for normal website operation but could be useful to an attacker. Additional rules also limit the ability of disguised or unauthorized files to execute.
- Server Login Protection: Administrative access to the server is protected separately from the Joomla administrator login. Failed and suspicious server-level login attempts are monitored and blocked independently.
- Encrypted Connections: SSL certificates encrypt data traveling between a visitor's browser and the website. We install and automatically renew SSL certificates for the domains we host so normal website traffic uses HTTPS. For a deeper explanation, see our article on SSL certificates.
- Nightly Malware Scanning: Our servers are scanned each night for known malicious files. This complements website-level file monitoring by looking for suspicious files that may have been added to the hosting environment.
- Network Edge Filtering: Many of the websites we host are also configured behind Cloudflare. For those sites, some malicious and automated traffic can be filtered at the network edge before it reaches our hosting environment at all.
Off-Site Backups and Recovery
Prevention and monitoring matter, but a dependable security strategy also needs a recovery plan. Hardware can fail. Files can be damaged. A software update can introduce an unexpected problem. A successful attack may require restoring a clean copy of the site.
For that reason, we maintain a comprehensive, automated backup strategy for every site, and backups are kept separately from the live hosting environment.
- Multiple Backup Schedules: Backups are created automatically on daily, weekly, monthly, and yearly schedules.
- Long-Term Retention: We retain approximately one week of daily backups, one month of weekly backups, one year of monthly backups, and seven years of yearly snapshots.
- Separate Cloud Storage: Backup files are stored off-site with an independent cloud provider. A problem affecting the primary hosting server does not also remove the recovery copies stored elsewhere.
- Immutable Backups: Off-site backup copies are locked during their retention period so they cannot be altered or removed through normal administrative access. This provides additional protection against attacks such as ransomware that attempt to damage both live data and its backups.
- Backup Verification: A completed backup job is not enough on its own. Our systems verify that the backup file actually reaches its off-site destination rather than assuming the process succeeded because it finished running.
Security Updates and Vulnerability Monitoring
Security controls are less effective if the software behind the website is allowed to become outdated. Many website compromises rely on vulnerabilities that are already known and, in many cases, already have an available fix.
Software maintenance therefore remains an ongoing part of website security rather than something handled only when a client requests an update.
- Centralized Software Tracking: We track the Joomla version and installed extensions across the websites we host from a centralized system. This gives our team visibility into which sites are running which software versions.
- Vulnerability Monitoring: We follow security announcements affecting Joomla and commonly used extensions and compare them against the software installed on hosted sites. When a vulnerability affects a site we manage, we can identify the affected installation and apply an available update or mitigation quickly.
- Form Abuse Protection: Public website forms are common targets for automated spam and abuse. We use hCaptcha on older sites and Joomla's built-in Proof of Work CAPTCHA on newer websites to reduce automated submissions. You can read more about the difference in our article on hCaptcha and CAPTCHA protection.
This is also why staying on a supported version of Joomla matters. Once an older version stops receiving security fixes, maintaining it safely becomes increasingly difficult. Learn more about keeping Joomla current.
Security Requires Ongoing Responsibility
Website security changes over time. New vulnerabilities are discovered. Software versions change. Automated attacks evolve. Backups need to continue running, alerts need to be reviewed, and someone needs to know what action to take when something unusual appears.
Those responsibilities do not quietly become the client's job after launch. As part of our managed hosting and ongoing website care, interGen maintains the security systems, monitors alerts, manages software updates, and maintains separate recovery copies.
No hosting provider can eliminate every security risk. Layering prevention, monitoring, maintenance, and recovery gives us several opportunities to stop a problem, identify it early, or restore the site if something does get through.