Hosts generally secure the infrastructure the site runs on. The agency and client are responsible for the application: the CMS, plugins, themes, accounts, content and backups they control. Write the split down, because "I thought the host did that" is behind many incidents.
The WordPress hardening guide puts it directly: web hosts are often responsible for the infrastructure the site sits on, but they are not responsible for the application you choose to install, and sites are most often compromised through the application, not the infrastructure.
A responsibility table
| Area | Usually the host | Usually the agency | Usually the client |
|---|---|---|---|
| Server software and operating system | Yes | Check it | No |
| PHP version availability | Offers | Chooses and tests | Approves cost |
| CMS core, plugins and themes | No | Yes | Approves changes |
| User accounts and roles | No | Sets up | Reviews, removes leavers |
| Backups | Varies by plan | Verifies and restores | Owns the data |
| Domain, DNS and renewal | Sometimes | Manages with consent | Owns |
| Content and uploaded files | No | Advises | Yes |
Treat this as a template. Plans differ, so check your host's documentation and ask about anything that matters.
What to ask a host
The handbook lists qualities of a trusted host: readily discusses security concerns and features, provides recent stable versions of server software, and provides reliable backup and recovery methods. Turn that into questions.
- Which PHP versions can I choose, and when do you retire old ones?
- Are backups included, how often, where stored, and how do I restore one site?
- Are sites isolated from each other on the same plan?
- How do I enable two-step login on the control panel?
- What is your process if my site is found to be compromised?
Do not assume backups
Many plans include backups, but the details vary, and they may cover only part of the site or retain copies briefly. The WordPress handbook recommends multiple copies in different locations and a manual check of automated backups from time to time. Confirm what you actually get and keep your own copy.
Where the agency gap usually is
The usual gap is the application layer between a launch and the next redesign: plugins that are never updated, administrator accounts for people who left, and no one checking logs. Those are agency or client tasks, and they belong in the retainer.
Put it in the contract and the handover
State who does what in the statement of work and repeat it in the handover document. Review it when the host or plan changes.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how checks keep running after launch; the application layer is the part nobody else is watching.
Safeguard's dependency scanning and SBOM generation address the application layer for projects with a repository, and the free scan is a place to start.
Quick check
Does my host patch my plugins?
Usually not, unless you buy a managed service that says so. Check the plan documentation.
Who owns the data in backups?
The client does, so the copies should be in a location the client controls or can reach.
Sources
Last reviewed: 19 October 2026.
