Security
Security at GlobalHostia
How we protect the website and client area, and how to tell us about a vulnerability.
Report a vulnerability
If you believe you have found a security problem on globalhostia.com, the client area (my.globalhostia.com) or our hosting platform, email support@globalhostia.com with the subject Security report. Please include the affected URL, the steps to reproduce it and what an attacker could do with it.
- We confirm that we have received your report and keep you updated until the issue is fixed.
- Please give us reasonable time to fix the issue before you share it publicly.
- Do not access, change or delete other customers’ data, do not run denial-of-service or spam tests, and do not use social engineering against our staff or customers.
- Test only with your own account and services.
For account problems that are not security issues (a forgotten password, a suspicious invoice), open a support ticket instead. Our machine-readable contact file is at /.well-known/security.txt.
How the website and client area are protected
- All traffic uses HTTPS with HSTS, and pages send a Content-Security-Policy, clickjacking protection and strict referrer rules.
- Billing, payments and service provisioning run in our billing system; card details are handled by the payment providers and never stored on this website.
- Sign-in, password reset, contact forms and the website assistant are rate-limited, and public forms are protected against automated spam.
- The administration area supports two-factor authentication and session controls, and every administrative change is logged.
- API credentials for the billing system and hosting panels stay on our servers and are never sent to your browser.