Website Security & Protection Policy

Supersedes all prior versions

This Policy outlines Crystal Webhosting's operational protocols regarding automated security defenses, vulnerability scanning, software maintenance, and emergency isolation procedures to protect the shared network environment and maintain high levels of system availability. This Policy is incorporated by reference into and should be read alongside Crystal Webhosting's primary Acceptable Use Policy (AUP) and Terms of Service.

1. Definitions

For the purposes of this Policy, the following terms apply:

• Active Compromise: Confirmed evidence that an account, script or database is currently being exploited, exfiltrating data, serving malware to visitors or being used to attack other systems (e.g., an active web shell, live spam injection, confirmed C2 traffic).
• Critical Vulnerability: A known, unpatched security flaw (typically CVSS 9.0+, or any flaw with a published working exploit) that has not yet been observed being exploited on the account but presents an imminent risk to server integrity.
• End-of-Life (EOL) Software: Any CMS core, plugin, theme, framework, or script no longer receiving security updates from its vendor or maintaining community support.
• Malicious Code: Web shells, backdoors, trojans, spam injectors, cryptominers, phishing kits, or any script designed to gain unauthorized access, exfiltrate data, or abuse server resources.
• Zero-Day Exploit: A vulnerability being actively exploited in the wild before a vendor patch is publicly available.
• Quarantine: Isolation of affected files, directories, or database instances (via permission changes, file relocation or network-level blocking) without full account suspension, where technically feasible.

2. Shared Responsibility Model

Website security is a shared obligation across multiple distinct layers. A secure infrastructure does not automatically mean a secure website; if you run an outdated script, framework dependency or plugin with a known vulnerability or weak credentials, attackers can compromise your site regardless of how secure the underlying data center and servers are.

The security layers break down across the following operational domains:

1. Third-Party Data Center Facilities: Physical & Core Network Security

Our third-party Tier-4 partner data center facilities control the physical infrastructure. They are responsible for:

• Physical Security: Securing data center buildings, server cages, 24/7/365 armed security guards, CCTV surveillance and biometric/keycard access controls.
• Core Hardware & Power: Uninterruptible Power Supplies (UPS), redundant diesel generators, climate control (HVAC) and physical server rack hardware.
• Core Network Routing: Physical switches, routers and high-capacity backbone network connections. (Note: Crystal Webhosting and our clients who have Dedicated Servers/VPS access and manage these servers exclusively via secure remote connections).

2. Crystal Webhosting (The Host): "Security of the Cloud & Virtual Infrastructure"

Crystal Webhosting manages the virtualized environment running on top of that hardware. This includes:

• Host Operating System & Hypervisor: Managing virtualization layers, server operating systems (e.g., CloudLinux), web server and proxy software (like LiteSpeed, Nginx, Apache), and server-level firewalls.
• Infrastructure Defenses: Deploying enterprise Web Application Firewalls (WAF), ModSecurity rulesets, server-wide bot mitigation, DDoS protection, rate-limiting frameworks and automated node-level malware scanning suites.
• Control Panels & Availability: Maintaining hosting control panels, ensuring remote management uptime and providing automated daily backup infrastructure snapshots.

3. The User (You): "Security in the Cloud & Application Layer"

You are entirely responsible for everything you build, upload, configure or manage inside your specific hosting account across all supported technology stacks. This includes:

• Application Runtimes & Frameworks: Keeping all application files, dependencies, and frameworks secure and updated, including:
  • PHP Ecosystem: Content Management Systems (WordPress, Drupal), custom PHP scripts, and MVC frameworks (Laravel, CodeIgniter).
  • JavaScript & Node.js Ecosystem: Node.js backend runtimes, package.json dependencies, and modern full-stack/frontend frameworks (Next.js, Nuxt.js, React, Vue, Angular).
  • Python & Ruby Ecosystems: Python web frameworks (Django, Flask, FastAPI) and Ruby frameworks (Ruby on Rails).
  • Static Assets: Raw HTML, CSS and client-side JavaScript applications.
• Access Control & Credentials: Enforcing strong, unique passwords, multi-factor authentication (MFA), SSH keys and restricting user roles/permissions.
• Data & Content Integrity: Ensuring your website code, database contents (MySQL, PostgreSQL, MongoDB, Redis, SQLite), and media files are free of malware or vulnerabilities (e.g., SQL injection, XSS, insecure dependency packages).
• Backups: Maintaining independent, off-site backups of your website data and database (even though Crystal Webhosting offers automated daily snapshots as a courtesy).
• SSL/TLS Configuration: Proper installation and renewal of security certificates and forcing HTTPS traffic.

Key Takeaway: Even though the third-party data center protects the physical building and hardware and Crystal Webhosting protects the remote hosting environment and server-level firewalls, neither can protect a website if an attacker logs in using a compromised administrator password, exploits an unpatched application package or leaves a vulnerable script exposed. That application-level security remains firmly on your side of the model.

3. Software Maintenance & Vulnerability Patching

• Client Obligation: You are required to maintain all third-party software, Content Management Systems (CMS, e.g., WordPress), frameworks, plugins, modules, themes and custom scripts installed on your account in a secure and reasonably current state, consistent with vendor security guidance.
• Response Tiers: Crystal Webhosting's response to software risk is tiered according to severity:
  • Tier 1 (Active Compromise): Immediate action, no notice required (Section 6).
  • Tier 2 (Critical Vulnerability or EOL software, not yet exploited): You will be notified via email, support ticket, or your client portal. Depending on how urgent the risk is, you will be given a clear window of 5 calendar days (or 24 t72 hours for high-risk situations) to patch, update or remove the vulnerable software before any access restrictions are put in place.
• Prohibited Neglect: Leaving known vulnerabilities unpatched beyond the applicable cure period, running EOL software without active security support, or repeatedly ignoring vendor security alerts constitutes a failure of account security obligations and may result in automatic quarantine, disabling or access restriction of the affected scripts.

4. File Integrity Monitoring & Automated Scanning Rights

• Proactive Scanning: Crystal Webhosting reserves the right, but assumes no obligation, to deploy automated malware scanners, heuristic analyzers, and File Integrity Monitors (FIM) across hosting directories, file stores and database instances.
• No Guarantee: Automated scanning is a best-effort security measure and does not guarantee detection of all malicious code, vulnerabilities or compromises. Clients remain responsible for their own software security regardless of scanning activity performed by Crystal Webhosting.
• Scope & Privacy: These automated inspections are limited to identifying malicious code, web shells, trojans, spam scripts and known software vulnerabilities. Crystal Webhosting personnel do not manually review client content outside of security, abuse or legal investigations.
• Scan Records: Where scans are performed, summary results are retained for 30 days and may be provided to the client on request for their own remediation purposes.

5. Compliance with Server Security Controls & Rate Limiting

• Protection Mechanisms: You are prohibited from attempting to bypass, disable, circumvent or intentionally evade native server-wide security controls, including Web Application Firewalls (WAF), ModSecurity rules, bot mitigations and application-level rate limits designed to prevent brute-force attacks across the hosting infrastructure.
• Exceptions & Review: Because these configurations protect all users on shared infrastructure, requests to weaken, bypass or disable them for individual accounts will be denied by default. Exceptions require written authorization from Crystal Webhosting security personnel following a ticketed review.
• False Positive Handling: If a security rule triggers a false positive on your website, submit a support ticket referencing the affected request/log entry. Crystal Webhosting will target an initial response within 10 business hours and will work with you to safely tune the rule rather than disabling broader protections.

6. Emergency Isolation & Zero-Day Containment Protocol

6.1 Immediate Quarantine

In the event of a discovered zero-day exploit, active malware injection, active brute-force attack, or confirmed active compromise originating from an account, Crystal Webhosting reserves the right to immediately isolate, quarantine, firewall or suspend the affected website, directory or database instance without prior notice.

6.2 Post-Action Notification

Where immediate action is taken without prior notice, Crystal Webhosting will notify the client via email/ticket within 12 t24 hours of the action being taken, including: the reason for the action, the scope of what was affected and next steps for remediation.

6.3 Evidence Preservation

Quarantined files, logs, and database snapshots relevant to the incident will be preserved for 14 days tallow the client to conduct their own forensic review, after which they may be permanently deleted in accordance with Section 8.2.

6.4 Mitigating Collateral Damage

Emergency action is executed solely to prevent lateral movement of malware, data exfiltration, or resource degradation across shared or adjacent server infrastructure. Crystal Webhosting shall bear no liability for temporary downtime or business interruption resulting from good-faith proactive emergency isolation.

7. Post-Incident Remediation & Verification

• Client Responsibilities: If an account is compromised or quarantined due to malicious code or unpatched vulnerabilities, the client is responsible for root-cause analysis, cleaning the codebase and rotating all credentials (passwords, API keys, SSH keys).
• Restoration Conditions: Crystal Webhosting may condition restoration of suspended services on proof of remediation, implementation of multi-factor authentication (MFA), and/or payment of applicable administrative remediation fees as outlined in the primary AUP.
• Assisted Remediation: Clients who lack the technical resources to perform remediation themselves may request Crystal Webhosting's paid cleanup service, where available, as an alternative to self-remediation (available via support inquiry).
• Maximum Quarantine Period: Accounts left in quarantine or suspension without client response for more than 30 days may be subject to permanent data deletion and/or account termination in accordance with the primary AUP.

8. Backups & Data Recovery

• Backup Responsibility: Crystal Webhosting performs automated daily backups retained for a rolling 7-day window as a courtesy; this does not relieve the client of responsibility for maintaining independent off-site backups of their own data and database instances.
• Recovery During Incidents: Backup restoration during a security incident may be delayed until root-cause analysis is complete, to avoid re-introducing compromised code or persistent web shells back into the production environment.
• Data Deletion: Following the maximum quarantine period (Section 7) or account termination, backup data is deleted in accordance with Crystal Webhosting's standard data retention schedule.

9. Credential & Access Security Requirements

• Clients must use strong, unique passwords for all hosting accounts, email accounts, CMS admin, databases and SFTP/SSH accounts.
• Multi-factor authentication (MFA) is strongly recommended for all account-level and CMS admin access and may be required as a condition of service restoration following a security compromise (Section 7).
• SSH access should use key-based authentication where supported; shared or default credentials should never be used in production environments.

10. Regulatory & Compliance Notes

Clients hosting data subject to regulatory frameworks (such as Uganda's Data Protection and Privacy Act, Cap. 97, GDPR, or HIPAA) are solely responsible for ensuring their use of the hosting environment complies with applicable law. Crystal Webhosting's security controls described in this Policy do not constitute a legal certification of compliance with any specific regulatory framework.

11. Escalation & Appeals

A client who believes a quarantine, suspension or access restriction was applied in error may appeal by submitting a ticket support@crystalwebhosting.com within 5 calendar days of the action. Crystal Webhosting will review the affected logs/evidence and respond with a formal determination within 2 business days.

12. Limitation of Liability

To the maximum extent permitted by law, Crystal Webhosting's total liability arising from security actions taken under this Policy — including but not limited to scanning, quarantine, suspension or emergency isolation — is limited to the total fees paid by the client in the preceding billing period. Crystal Webhosting is not liable for indirect, incidental or consequential damages, including lost revenue or data arising from good-faith enforcement of this Policy.

13. Policy Amendments

Crystal Webhosting may amend this Policy at any time; material changes will be communicated via email notice and client portal alerts at least 30 days prior to their effective date. Continued use of hosting services after the effective date of an amendment constitutes acceptance of the revised Policy.