Security & upkeep
What makes a secure web host?
Key takeaway
A secure host protects logins, maintains its systems, watches for problems and keeps usable backups. Lightning Web Hosting combines AWS infrastructure, AWS WAF, SSL, CloudFront CDN and daily website backups to help protect your website. Security essentials are included in both hosting plans.
In this guide
A secure host has several jobs to do
A secure web host protects access, maintains the systems it manages, watches for problems and keeps a usable recovery copy. For your business, the practical question is who does each job and what happens when something goes wrong.
Look for clear answers about software updates, account permissions, encrypted connections, backups and incident help. A recognised infrastructure provider is a useful foundation. It still needs to be configured and operated properly for your website.
SSL protects the connection
HTTPS, often described as SSL, encrypts the connection between a visitor’s browser and the website. That matters when people send an enquiry or sign in. It does not prove that a business is trustworthy or that the website’s software is free of security problems.
Lightning includes SSL in both hosting plans. We also use Amazon CloudFront to deliver public website content. You do not need a more expensive security tier to get SSL, CloudFront CDN or the platform security included with our service.
AWS provides the foundation. We operate our part
AWS, short for Amazon Web Services, provides cloud infrastructure to major businesses including Netflix and Canva. It is also the infrastructure we use for Lightning Web Hosting. Your business gets a service built on that established foundation, without having to manage an AWS account yourself.
Our hosting platform runs on AWS servers, with CloudFront delivery. AWS looks after the physical infrastructure behind its services. We are responsible for the parts we configure and run, including our application, access rules and recovery processes. That division is called shared responsibility.
The service still needs to be run properly. A neglected website, a leaked password or the wrong access setting can cause problems on any infrastructure. We explain what is included in our service so you can judge both the foundation and the people operating it.
Software security questions at Lightning Developments
Sources: Businesses using AWS (opens in a new tab)AWS shared responsibility model (opens in a new tab)
Traffic protection has different purposes
Some attacks try to overwhelm a website with traffic. Others try to take advantage of a fault in its software. CloudFront benefits from AWS Shield Standard’s automatic protection against common attacks on the network. It is a useful layer, with a different job from keeping website software up to date.
A web application firewall, or WAF, checks incoming website requests against security rules. AWS WAF is part of our platform security and helps protect websites from common web attacks and unwanted automated traffic. It works alongside SSL, protected accounts and daily website backups.
Sources: AWS Shield Standard protections (opens in a new tab)AWS WAF rule actions (opens in a new tab)
Website software needs someone responsible for it
If your site uses WordPress, ask who maintains WordPress, its themes and its plugins. A server can be maintained while the website software on it is out of date. A custom website also needs its code, libraries and connected services looked after.
Our modernised websites can use HTML or React. Removing an unnecessary plugin or login can simplify what needs protecting, but the result still needs maintenance. We assess imported websites and their features before agreeing what we will support.
People should have their own access
Shared passwords make it harder to know who changed something and to remove access when a person leaves. In our portal, people use individual accounts and are linked to the company and websites they are authorised to use.
Website changes go through private previews and approval. The system records who requested and approved a change. That is useful protection against mistakes as well as a record of responsibility. Keep your own login private and remove people who no longer need access.
Monitoring and backups matter when prevention is not enough
Our platform has independent AWS availability checks and operational alerts. Daily AWS website backups keep recovery copies of website files and published content. The team checks the available copy and arranges recovery when needed.
Checking that a website responds is not the same as testing every enquiry form or completing a purchase in your shop. A daily backup is also not a record of every change since it ran. Tell us about important functions and recovery needs before setup so we can agree the right checks.
What is included with Lightning hosting?
Thunder is NZ$55 + GST a month per website. Lightning is NZ$99 + GST and adds Arc’s everyday website updates, subject to fair use. Both include SSL, CloudFront CDN, platform security, daily AWS website backups, free domain registration and DNS. Security essentials are part of the service from the start.
Tell us if your website holds sensitive information, takes payments or has a specific data-location requirement. We confirm the right setup and responsibilities before moving it. A useful security discussion ends with an agreed plan, not a promise that nothing can ever go wrong.