What your host and a firewall can take over

Who updates what on a WordPress site, what WordPress expects from a host, what a firewall in front of the site does, and five questions for your host.

Key points

Your host runs the server and PHP. You run WordPress, the plugins, and the themes. A flaw in either part can open your site.
A firewall in front of your site can block attacks before a fix exists. Cloudflare says its free plan includes one.
Ask your host which PHP version your site runs, how fast it installs fixes, and what its backups contain.

Who updates what

On shared hosting, the usual kind for small sites, the work is split:

Part of the site	Who updates it
Server operating system and web server	your host
PHP	your host, often only when you ask for a newer version
WordPress, plugins, and themes	you, or the automatic updates you turn on
Passwords and user accounts	you
Backups	both: ask what your host keeps, and keep a copy of your own

What WordPress expects from a host

WordPress recommends a host with PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, and HTTPS support. Its hardening guide advises SFTP instead of plain FTP, because FTP sends passwords unencrypted.

What a firewall in front of the site does

A firewall in front of your site receives every request first. It blocks known attack patterns and floods of requests before they reach your server. WordPress recommends limiting login attempts there, “at the edge (WAF/CDN),” or on the web server.

This is what the makers of the two firewalls listed here state:

	Cloudflare	Sucuri
Free	yes: “Unmetered DDoS Protection,” a web application firewall, and the “Free Managed Ruleset”	the firewall is not part of the free plugin
Own rules	5 custom rules on the free plan, 20 on Pro, 100 on Business	not stated
Switched on by	changing your DNS records	changing your DNS records

A firewall helps most in the hours after a flaw becomes public. When the flaw PHP2Shell was fixed on October 21, 2026, Cloudflare said its rules protected sites behind its free or paid firewall from that day on. It still advised updating PHP. The case PHP2Shell shows the whole timeline.

Five questions for your host

Which PHP version does my site run, and how fast do you install PHP security fixes?
Do your backups contain both the files and the database? How long do you keep them, and can I restore them myself?
Is my site separated from other customers’ sites on the same server? WordPress warns that on shared hosting, the problems of one site can reach others, for example when the server’s email address gets blocked for spam.
Do you offer SFTP and two-factor sign-in for the hosting account?
What do you do when my site is hacked? WordPress advises contacting the host early, because it may already be taking steps.

Next step

The guide Hacked? How to clean up a WordPress site shows what to do when an attack got through.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.