WordPress that hackers can't write to.

Every site runs inside its own isolated Linux container with its own web server, PHP and MariaDB database — not a folder on a shared server. We handle WordPress core and plugin updates (with automatic rollback if a health check fails), server-level page caching, malware scanning and quarantine, and round-the-clock uptime monitoring. You write; we keep it fast and secure.

Each site gets an nginx FastCGI page cache in front of a Redis object cache, on NVMe storage. On a cache hit PHP is bypassed entirely and the page leaves our server in roughly 0.15 seconds. Static assets are served gzipped with long-lived immutable caching, so repeat visits are close to instant.

In layers, and stricter than most hosts. Your document root is read-only to WordPress, so a compromised plugin cannot write a new .php file anywhere PHP would execute it. Dangerous PHP functions (exec, system, shell_exec) are disabled. Our firewall blocks xmlrpc.php, wp-config.php, .env and any PHP execution inside uploads, and rate-limits wp-login against brute force. We scan with roughly 49,000 WordPress-tuned malware signatures — stock antivirus misses PHP backdoors — re-checking changed files every 5 minutes, and anything found is quarantined out of your document root rather than deleted, so it can always be reviewed and restored.

On a hardened site, no — and that is deliberate. It is the same model Kinsta and WP Engine use: if wp-admin cannot write PHP, then a stolen admin password cannot plant a backdoor. We install plugins for you on request, or we can lift hardening on your site if you need full wp-admin control.

Yes, from virtually any host. We can pull from cPanel, over SSH, from an archive you upload, or via a small connector plugin you drop into your current site — which works even on hosts that give you no server access. Files, database and media come across, URLs are rewritten automatically, and we test on a staging URL before DNS moves.

Updates run against a checkpoint and roll back automatically if a post-update health check fails. You also get 1-click staging: clone your live site, test theme and plugin changes there, then apply them to production.

Yes. Redis object caching keeps cart, checkout and logged-in pages responsive, and each site has its own guaranteed CPU and RAM instead of competing with noisy neighbours. Be aware that logged-in and checkout pages bypass the page cache by design — that is how carts stay correct — so we size busy stores on the larger plans.

No. Outbound SMTP (port 25) is blocked from every site container, so even a compromised site cannot open a socket to a mail server and start spamming. Legitimate SMTP relays on port 587 still work normally.

A purpose-built WordPress dashboard rather than cPanel clutter: one-click login to wp-admin, staging, cache control, a file manager, a database manager, and visit and bandwidth analytics for every site.

Yes — every plan is covered by a 30-day money-back guarantee, subject to our refund policy (exclusions apply for domains and certain add-ons). If WordPress hosting with TOSHOST is not for you, get in touch and we will sort out a refund.