Security on Templ

Templ handles a lot of security for you automatically, and a few things are still up to you. This page summarizes what's built into the platform and what you should set up yourself, with links to the details for each.

What Templ handles for you

Every website runs in its own isolated environment (a container), so it never shares resources or risk with other sites or customers.

Here's what's protected out of the box:

  • SSL certificates - free certificates are issued and renewed automatically, and HTTP is redirected to HTTPS. See SSL certificates.
  • Automatic backups - every production site is backed up daily (files and database), so you can restore after a bad change or an infection. See automatic backups.
  • Monitoring - production sites are checked for uptime and for WordPress core file integrity against the official checksums, so tampering is caught early. See monitoring and incidents.
  • Brute-force protection on file access - repeated failed SFTP/SSH logins get the source IP banned automatically. See clear banned IPs.
  • Blocked sensitive files - files like wp-config.php, PHP in the uploads folder, and backup and log files are blocked from web access by default. See what's blocked on Templ.
  • Databases closed to the internet - your database only accepts connections from the server itself, over a local socket, so it can't be reached or brute-forced from outside. See remote database access.
  • DDoS protection and WAF - through our Cloudflare partnership you can put your site behind Cloudflare's edge network for DDoS mitigation and firewall rules. See configure Cloudflare.
  • Traffic and error logs - every request to your site is logged with its IP, timestamp, and response, giving you an audit trail to trace suspicious activity after an incident. See logs.
  • Hacked site fix guarantee - if a paid production site is compromised, we clean it up for free on a best-effort basis. See hacked site fix guarantee.
  • GDPR compliance and a DPA - Templ complies with the GDPR and acts as your data processor under a Data Processing Agreement that applies to every customer automatically. See GDPR and data protection.

Security recommendations

Most WordPress compromises come from outdated software or leaked credentials, not the hosting layer. These steps close the gaps that are your responsibility:

  • Keep WordPress, plugins, and themes updated. Outdated code is the most common way sites get hacked. See automatic updates.
  • Enable two-factor authentication on WP Admin. Leaked passwords are the most common way sites get broken into, and 2FA stops a stolen password from being enough. See protect WP Admin with two-factor authentication.
  • Scan for known vulnerabilities. The Panel checks your core, plugins, and themes against a vulnerability database and tells you which version fixes each one. See find vulnerabilities.
  • Enable two-factor authentication on your Templ account. See two-factor authentication.
  • Use SSH keys instead of passwords for SFTP/SSH access. Key-based auth is stronger than passwords, which are off by default. See connect using SSH keys.
  • Share access, don't share credentials. Give people their own access to your account or selected sites instead of handing out logins. See account sharing.
  • Run a modern PHP version. Newer PHP versions receive security fixes that older ones don't. See supported PHP versions.
  • Add HSTS and security headers. Templ redirects to HTTPS but doesn't set these headers for you. See add HSTS and security headers.
  • Protect forms and login from spam and bots. See protect your site from spam.
  • Test changes on staging first so a broken update never hits production. See staging websites.
  • Password-protect sites that aren't public yet to keep work-in-progress and staging out of reach. See password protection.

If something looks off

If you notice unexpected admin users, injected spam or redirects, or files you didn't create, the site may have been compromised. Restoring a backup usually isn't the whole fix, since the gap that let it in is often still there, but we're here to help. For how we clean things up and keep it from recurring, see hacked or infected website, and what our hacked site fix guarantee covers.