---
title: "Security & Vulnerability Disclosure | GlobalHostia"
url: "https://globalhostia.com/security"
description: "Found a security issue on GlobalHostia? How to report it responsibly, what we commit to, and how the website, client area and administration are protected."
source: "GlobalHostia; prices are synced from the billing system and exclude any taxes shown at checkout"
---

Security

# Security at GlobalHostia

How we protect the website and client area, and how to tell us about a vulnerability.

## Report a vulnerability

If you believe you have found a security problem on globalhostia.com, the client area (my.globalhostia.com) or our hosting platform, email [support@globalhostia.com](mailto:support@globalhostia.com) with the subject **Security report**. Please include the affected URL, the steps to reproduce it and what an attacker could do with it.

- We confirm that we have received your report and keep you updated until the issue is fixed.
- Please give us reasonable time to fix the issue before you share it publicly.
- Do not access, change or delete other customers’ data, do not run denial-of-service or spam tests, and do not use social engineering against our staff or customers.
- Test only with your own account and services.

For account problems that are not security issues (a forgotten password, a suspicious invoice), open a support ticket instead. Our machine-readable contact file is at [/.well-known/security.txt](https://globalhostia.com/.well-known/security.txt).

## How the website and client area are protected

- All traffic uses HTTPS with HSTS, and pages send a Content-Security-Policy, clickjacking protection and strict referrer rules.
- Billing, payments and service provisioning run in our billing system; card details are handled by the payment providers and never stored on this website.
- Sign-in, password reset, contact forms and the website assistant are rate-limited, and public forms are protected against automated spam.
- The administration area supports two-factor authentication and session controls, and every administrative change is logged.
- API credentials for the billing system and hosting panels stay on our servers and are never sent to your browser.