Apply for founding access

Grandhosting · managed WordPress hosting in the EU, with our own dashboard

Every site gets its own sealed room.

Its own walls, its own database, its own reserved power. Here is how we keep it that way, and what we tested ourselves.

Apply for founding accessTry breaking in next door

Try breaking in next door.

We ran these attacks on real servers. Run them here and watch your site.

Your sitePick an attack, or keep scrolling and we’ll run them.
At the front door

In front of every site.

Every request to your site passes a check before it reaches WordPress. Real visitors walk straight in. Scroll and watch who else turns up.

FirewallChecks every request against known attack patterns and flags them for our team.
Login protectionRepeated wrong passwords from one address are blocked for a while, and every attempt is kept in a login history you can read.
A hidden login pageMove your login page to an address bots don’t know.
Who’s at the door0 checked
  1. A visitoropens /shop/Let in
  2. A customerpays at checkoutLet in
  3. Someonewrong password, 1st tryFailed
  4. Same addresswrong password, 5th tryFailed
  5. Same addresstries againBlocked for a while
  6. A requestwith attack code hidden in itFlagged for our team
  7. A botlooking for hacker files“Not here”, before WordPress starts
  8. A visitorreads your blogLet in

Illustration. Your real login history is in your dashboard.

Watched, day and night.

  • Every night, every site is scanned for malware. Findings alert our team.Nightly scan
  • On every plugin install, the site is scanned again, because that is when something bad usually arrives.On install
  • In real time, what runs in each site’s space is watched. If it behaves like an intruder rather than WordPress, we are alerted.Always on
  • Underneath, every server is watched too: file changes, known vulnerabilities, weak settings. The images sites run on are scanned.Always on

A clean core, every time.

WordPress core runs from a clean, protected copy. When something needs fixing, it is replaced with a clean, updated version, not patched in place.

So a tampered core file doesn’t survive a restart. Try it: change a file, then restart.

  • wp-includes/version.phpClean
  • wp-login.phpClean
  • wp-admin/index.phpClean
Core: clean copy

Kept safe, somewhere else.

Every site is backed up every night to storage separate from the server it runs on, and each backup is kept for 30 days. We test that backups come back: a nightly backup, restored into a sealed copy and compared with the live site, matched.

58tables
409posts
493settings
  • Encrypted at restSecrets are stored encrypted.
  • Two-factor sign-inOn your dashboard account.
  • An activity logEvery change to your account, written down for good.

It stays in Europe.

Mainly in Germany, always within the EU, in ISO 27001-certified data centres. Backups stay in the EU too. Every company behind the infrastructure is named in our Data Processing Agreement; those incorporated in the US keep the data in an EU region under Standard Contractual Clauses.

Security you can check.

Founding members get 30 days free with no card (14 for everyone else). We move your site for you, free. Questions about security? Write to us.

Apply for founding accessHow we test for failure