Secure WordPress hosting for small business is less about a glowing shield icon and more about HTTPS done in the right order, fewer abandoned plugins, and backups you can restore. WordPress is PHP + MySQL; attackers love outdated plugins. WPHost runs PHP 8.4 with MySQL, preview HTTPS, and custom-domain certificates after DNS. You install WordPress — no Softaculous one-click. Plugins are not auto-updated (security is partly your patch cadence). Deploy history restores files, not a full DB backup — use UpdraftPlus. Staging on Pro+ still needs a DB copy. WooCommerce can run; no PCI/checkout SLA. No email hosting. No CDN. No forever-free. Plans $9/$30/$65/$130.

Focus: HTTPS on preview vs custom domain cert after DNS, mixed content, what we do not scan. Worked example: photographer’s gallery export. Related: WordPress hosting for nonprofits, secure WordPress website hosting, WordPress backup and security hosting.

HTTPS on preview versus custom domain

As soon as you create a site, preview HTTPS is available. Build and log into wp-admin there. That already encrypts the admin session on the preview hostname.

When you attach a custom domain, DNS must verify before the custom certificate issues. Only then set WordPress Address and Site Address to https://your-domain. Flipping WordPress URLs earlier creates redirect loops and accidental HTTP exposure.

Security takeaway: encryption is not one checkbox; it is an ordered procedure.

Mixed content: the quiet padlock killer

Serving the HTML over HTTPS while images, scripts, or embeds still load http:// triggers browser warnings. Customers hesitate. Fix content URLs, not only the certificate. After migrations, run a serialization-aware search-replace for old HTTP URLs.

What we do not scan (so you do not assume magic)

WPHost is not marketed here as a malware SOC. We do not claim to deeply scan every plugin for zero-days on your behalf. We do not auto-update plugins to “keep you safe” without your consent — automatic updates can also break shops. Security work you still own:

  • Updating core/themes/plugins in wp-admin
  • Strong admin passwords and limited roles
  • Backup hygiene (UpdraftPlus)
  • Avoiding sketchy nulled plugins
  • Keeping PHP on a current platform (8.4 here)

If you need continuous malware cleanup retainers, buy that service explicitly.

Auth, XML-RPC, and least privilege

Disable unused features. Limit admin users. Prefer SSO or at least unique passwords in a password manager. Review plugins that expose APIs. Hosting cannot invent good account hygiene.

Commerce and PCI honesty

WooCommerce can run on a small-business site. Card data should flow through reputable gateways. WPHost provides no PCI product and no checkout SLA. That statement is security honesty, not a shrug.

Worked example: photographer’s gallery export

A photographer exports a gallery and publishes portfolios on WordPress.

Secure-enough path:

  1. Pro plan if staging theme changes matter; otherwise Starter.
  2. Install WordPress on preview HTTPS; never email clients a temporary HTTP link.
  3. Upload compressed derivatives, not only RAW dumps (storage and accidental exposure of full-res files matter).
  4. UpdraftPlus offsite — galleries are painful to reconstruct from memory; file deploy history alone is insufficient.
  5. Attach domain; wait for cert; set WordPress URLs; confirm no mixed content from old HTTP CDNs.
  6. Update gallery plugins manually; do not assume auto updates.
  7. Forms mail to an external mailbox — WPHost is not your mail host; mis-set MX can lock you out of recovery emails.

Failure: zipping the parent folder so index.html is nested

(For WordPress, index.php.) Photographers or assistants zip the folder named portfolio-site, producing an extra directory level. The document root does not execute WordPress; preview looks empty or lists a directory. Someone “fixes” security by opening FTP wider or installing random plugins while confused.

Correct structure is a security hygiene issue because broken deploys lead to unsafe improvisation. Zip contents so index.php sits at /. Confirm wp-admin on preview HTTPS before clients arrive. Nested zips waste the weekend and increase the chance of shipping with debug plugins left on.

FAQ

Does WPHost auto-update plugins for security?

No. You update deliberately in wp-admin.

Is preview HTTPS enough for client proofs?

For private previews, yes. For public brand URLs, attach your domain and wait for the custom cert before advertising it.

Do you include a web application firewall product?

Do not assume a full WAF/malware product from this guide’s facts. Harden WordPress; add external protections if your risk model needs them.

Are file deploys a security backup?

They help roll back bad file uploads. They are not a complete WordPress backup. Use UpdraftPlus for database-inclusive restores.