1

If I host my website in a shared hosting, then do i need to worry about how much secure other websites are which are hosted in the same server?

My website developer is saying so and he is advising me to go for dedicated server as security is a major concern.

Please advise.

Improve this question
5
  • 1
    Your developer is right. If a neighboring website get compromised the attacker can easily reach your site.
    – t.m.adam
    Commented May 29, 2017 at 17:47
  • 1
    Sorry but I disagree. This may be the case, but if correct server hardening and access controls are in place then the site will be fine. It's a possibility the server could be compromised due to poor server management leaving to vulnerabilities that can be exploited - not the site itself. I think good isolation would be fine for the majority of use cases
    – ISMSDEV
    Commented May 29, 2017 at 18:03
  • 1
    Sorry but I respect your opinion and I except it is a threat. But only if poorly configured. There are many web servers and websites on shared space with no issues. In 10 years I have only ever seen sites hacked where by the the servers access control structure was incorrectly configured (leading to a hacked site compromising other sites) or the server had services running that were incorrectly locked down (if at all). A correctly setup and maintained server can host multiple sites without issue for the majority of cases.
    – ISMSDEV
    Commented May 29, 2017 at 18:24
  • 1
    @ISMSDEV - I respect your opinion, but I dissent. If the server hosting two websites is compromised, both websites are victims. Websites are hacked every day, all day long. Small fish or not. Just because you don't work around it daily doesn't mean it doesn't happen. If security is a concern of the OP, then you must cover the bases I've mentioned in my answer below. Don't just hope that a host takes proper measures. Make sure they do. This is MANDATORY if OP is subject to any kind of regulatory law (depending on the country of origin) such as HIPAA or SOX.
    – 1234567
    Commented May 30, 2017 at 20:56
  • 1
    @austin I agree. If the server is compromised. That's not what he said. He said if another site was compromised. The attack impact is very different by attack target.
    – ISMSDEV
    Commented May 30, 2017 at 21:11

3 Answers 3

Reset to default
2

It would be worthwhile to consider a single-tenancy server. By default, most providers will give you a multi-tenant server (which can be vulnerable, albeit difficult). Most multi-tenant servers are virtualized at the operating-system level, so you cannot see other user directories, as the operating system is totally independent of each tenant (e.g. you could be running WinServer 2016, another tenant could be running Debian, and another CentOS). In other circumstances (less desirable), you're all on the same operating system, just separated by a chroot (or similar). In this case, a compromised server can affect hundreds of websites.

TL;DR: It depends on your hosting plan. If you have an entire operating system to yourself, you're more secure than just sharing the same OS and being separated by software. The most secure option is to have a dedicated server.

Realize that a dedicated server will cost a significant amount more than your typical hosting. Most of the time this requirement is seen for HIPAA or SOX regulations.

Improve this answer
1
  • You are correct it is considerably more. The cost benefit will only be known by the OP and this will vary based on their risk appetite. You are correct some compliance may come into the decision, but the OP doesn't state that so we should assume this is out of scope at this stage. I feel the developer may well be attempting to charge for a service that may not be worth the cost. Again, only the OP can make that decision.
    – ISMSDEV
    Commented May 30, 2017 at 21:16
1

I would advise if you can't afford dedicated (which will be a lot more expensive) that you host on a server where by all the sites on the box are managed by the developer.

If the server is correctly configured the level of isolation provided will be fine. Shared server space has been typical for many years and many servers go on for years without issues. Just don't choose a poor hosting company and/or developer. Your developer should understand secure coding and even a reasonable amount of secure hosting in this day and age. Your risk then isn't necessarily the exploit of vulnerable code, but the risk of a vulnerability in a unpatched or poorly configured server (both of which can be mitigated by choosing a suitable company). A good development company will have expertise in server management and security.

Improve this answer
1
  • Managing all sites on a box is the same thing as dedicating the server to yourself. It will cost the same. Unless you elect for a dedicated server, you cannot know nor guarantee that another tenant is not added to the server.
    – 1234567
    Commented May 30, 2017 at 21:04
0

This is not a good choice nowadays. If you are using the shared hosting which means you bet your server to other servers in term of security. Just imagine that, if one website got hacked 2 bad scenarios will happen:

1, They can easily implement Local Attack, abuse the compromised website to attack other websites in the same server. It means, your website will be infected, hacked if other sites got hacked.

2, After uploaded a malicious files to the vulnerable website, what if they can get root and shutdown the server?. Well, your website and your recourses will be shutted down, is it?

In this case, you are highly trusting to other random people, if they fuq up you will be affacted.

Solution: Stop using this service and it's way better if you change to use VPS instead :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .