What are some of the security risks involved with using shared hosting services such as godaddy inmotion and fatcow?
migrated from stackoverflow.com Apr 23 '10 at 20:47
This question came from our site for professional and enthusiast programmers.
I worked as a sysadmin at a hosting company and there can be many issues related to security to consider.
I think a self-managed dedicated server is great IF you know what you are doing. If you are willing to maintain the software packages installed and run regular security updates, etc, and you don't need admins to help set things up. If part of the reason you are hosting is to tap into someone else's expertise, then go shared/VPS/managed dedicated.
Otherwise you really need to ask the host (you can ask them and get a quick response, right?) about their server software versions and update policies.
A good host should be on top of all the software running on their boxes and provide rapid response (with testing) to apply security updates.
You should run from any host that is not using currently maintained software or operating systems, or is not able to provide you with quick responses about their server software update policies.
Also, a good host should have users isolated from each other via proper server configurations of PHP and Apache. On a decent host, this shouldn't even be an issue.
And this doesn't even touch the security issues with whatever Forum,CMS,Blog,etc.. software you are going to run.
For one thing, a lot of shared hosts have it setup so other users can access your home directory if you aren't careful to chmod your files. Secondly, you are putting your full trust in the shared host owner, they are usually incompetant IMO, and I'd never trust one, maybe a huge host like GoDaddy is okay, I remember last time I've seen a Hostgator shared server it was running a vulnerable kernel and everyone had access to each other's homedir.
There is always risks with shared hosting, and even virtual root servers. Take for example:
Quite recently the Kloxo/HyperVM Virtualization software got exploited, and a LOT of people lost all of their data on a host, www.santrex.net. Probably other hosts as well, but I had a few virtual servers with Santrex, and their Xen Virtual Servers STILL aren't back up. It's been two weeks.
Shared hosting has the same problems, respectively.
If you're worried about security, you need to go with a dedicated server so you know all the software being run, and so that you maintain total control over all of it.