Your website is looked after every hour of every day.
All five are free, and all five start on your first day.
Get ProtectionFrom US$3.00 a monthFree for the first 30 days.
fernwaysalon.comServing
Running from your first day
A free SSL certificate, issued and renewed for you
A firewall that turns attacks away
A malware sweep every night
A complete backup every night, kept for thirty nights
Checked every 60 seconds, day and night
All five included
Your website only ever answers real visitors.
A firewall reads each request before your site does. Anything that matches a known attack is turned away there.
Arriving at your site right now
oakhartjoinery.comRead before your site answers
A visitor in New ZealandServed
A scanner hunting for a way inTurned away
A visitor in GermanyServed
A run of guesses at the sign-in pageTurned away
A visitor in CanadaServed
oakhartjoinery.com
Oakhart JoineryWorkshopCommissionsContact
Made by hand, built to outlast us.
Start A Commission
Online
12Guesses turned awayFive refusals and that address is turned away for the next hour.
Security logKPanel
Address blocked203.0.113.42 · Turned away for the next hour
Scanner turned awayRefused before your site ran
SSL certificate renewedRenewed for you
Your site kept serving the whole time, and both blocks are in your security log.
Attacks stop before your site runs
Every request is measured against the open rule set the security industry maintains together, which alone knows 88 scanning tools by name. A request that matches an attack is refused at the door, and your site never runs a line of code for it.
Your sign-in page holds
A WordPress site is set up to allow ten sign-in attempts a minute from any one visitor, and an address that keeps guessing after five refusals is turned away for the next hour. A run of thousands of attempts gets nowhere near your password.
You decide who is let in
Block one address, a whole range or a whole country from your own panel. The block is applied in front of your site, so the visitor you blocked is turned away before your site is asked for anything.
Your pages keep answering when traffic spikes
You set the ceiling on how fast any one visitor may ask for anything, and a hundred refused requests in two minutes bans that address for an hour on its own. Everybody else carries on browsing at full speed the whole time.
Anything harmful is found while you sleep.
Every active site is swept for malware every night, and you are emailed the moment anything turns up. On Managed WordPress it is quarantined for you.
Your whole site is copied
Your files and your database are copied in one pass and written to a separate machine, so one bad night can never take the site and the copy together.
The copy is opened and confirmed
In the morning last night's copy is pulled back out of storage and read from end to end, so you know it will open on the day you need it.
DuskFirst light
Watched, every 60 seconds
Your whole site is copied
Every file is swept for malware
WordPress is read against the public register
The copy is opened and confirmed
You hear the moment your site stops answering, and again when it is back.
Every active site is checked every 60 seconds, day and night. If three in a row go unanswered, the people who look after your account are emailed straight away.
Your account tells you what needs doing
Your sites, your domains, your mailboxes and your billing are read together as one account every fifteen minutes, so a certificate coming up for renewal or a domain about to expire is already waiting on your dashboard the next time you open it.
brightwireelectrical.comThe last thirty days
Today
We saw it at 02:14 and told you
Answering again at 02:18, and we told you that too
An example month, drawn the way the panel draws it.
Your website is guarded around the clock, and one screen shows you so.
One screen tells you what is guarding your site right now.
Turn your protection up in a sentence
Ask Kora for more protection in plain words and it is applied in front of your site. There are five levels of strictness and every site starts on the balanced one, so an ordinary week asks nothing of you and a bad week is one message away.
Shut the door on an address or a country
Block a single address, a whole range or a whole country, on any address format. Allow rules are always read before block rules, so somebody you trust is never caught by a sweep you wrote for somebody else.
Write your own rules
Describe the rule you want and it is written for you, up to 25 a site. Each one can match on a visitor's address, the page they asked for, their browser, where they came from or their country, and each one can turn them away, wave them through, or simply keep a record.
Sweeps run on their own every night, on definitions refreshed the same night.
Sign-in protection
The last thirty days
930
Guesses turned away
10 a minute
The most any one visitor gets
WordPress checklist
7 of 7
Editing code from the dashboard is offThe uploads folder runs nothingThe old remote interface is closedDebug output is off
The same protection on every plan.
Other hosts lure you in cheap, then hike it at renewal. We lock yours in for as long as you stay on the plan.
How many websites?
Fits Your Sites
Start
One site, and everything it needs to be online.
US$2.50/mo
US$30.00 billed yearly
Hostinger Premium: US$2.99/mo on a 48-month term, then US$10.99/mo at renewal.Hostinger, Premium plan: “Get 48 months for $143.52 (regular price $575.52). Renews at $10.99/mo.” hostinger.com/web-hosting, read 6 Oct 2026. www.hostinger.com/web-hosting
Renews at US$30.00/yr. Locked for as long as you stay.
1 website
10 GB NVMe storage
5 mailboxes
Unlimited bandwidth
Free SSL and nightly backups
Kora included
Most PopularFits Your Sites
Pro
A handful of sites, with staging for WordPress sites and more headroom.
US$7.00/mo
US$84.00 billed yearly
SiteGround GrowBig: US$4.99/mo prepaid for 12 months, then US$29.99/mo ex VAT at renewal.SiteGround, GrowBig plan (international page): “Renews at $29.99 /mo. Prepaid for 12 months. Ex. VAT” world.siteground.com/web-hosting.htm, read 6 Oct 2026. world.siteground.com/web-hosting.htm
Renews at US$84.00/yr. Locked for as long as you stay.
10 websites
50 GB NVMe storage
25 mailboxes
Unlimited bandwidth
WordPress staging
Self restore
Fits Your Sites
Scale
For a busy shop or an agency running client sites.
US$17.00/mo
US$204.00 billed yearly
hosting.com Pro Plan: US$3.79/mo on a 4-year term, then US$19.99/mo at renewal.hosting.com, Pro Plan: “For a 4-year term. Pay $181.93 today, then $19.99/mo on renewal.” hosting.com/hosting, captured 5 Oct 2026. hosting.com/hosting/
Renews at US$432.00/yr. Locked for as long as you stay.
Unlimited websites
Unlimited storage
Unlimited mailboxes
Unlimited bandwidth
The size of the plan is the only thing that changes.30-day money-back guarantee on Start, Pro, Scale and Cloud Power. Other hosts' prices checked 6 Oct 2026, from their own pages (sources in each note).Compare Every Feature
It is already running. The certificate, the firewall, the nightly malware sweep and the nightly backup all start the minute your site is created, switched on for you and tuned the way we would tune them ourselves.
It is included in the price you can see. The certificate is free, the firewall is free, the nightly sweep is free and the nightly backup is free, on every plan we sell, and your plan renews at the price you started on for as long as you stay on it.
You are emailed the same night, with what was found and exactly which files it was in. Last night's whole copy of your site is waiting in the panel, so you can put everything back the way it was in a few clicks, and on Managed WordPress the files are moved somewhere they cannot run for you.
Yes, and it is free. Every site is issued one as soon as its domain points at us, we install it for you, and it renews itself 30 days before it runs out, so your visitors always see the padlock and their details are always encrypted.
Kora reads what your site is actually doing and answers straight away, at any hour. If it needs a person, one takes it over within 4 business hours, or 1 hour on Care Pro.
The protection here sits in front of your site rather than inside it, so an attack is refused before WordPress, your theme and your plugins are ever asked to run. That is the layer a plugin cannot reach, and it is running on your site already.
They are refused at the front door and the attempt is recorded, so you can open your site in the panel and read exactly which addresses were turned away, by which rule, and when. On a WordPress site an address that keeps guessing a password is banned outright for an hour.
Yes. Ask Kora and it reads your own site's records back to you in plain words: what was refused, how often, and from where. It is the same information our engineers look at, and you get it by asking for it in a sentence.
The firewall, the nightly malware sweep, the sign-in protection, the blocking controls and your own rules are all included in the price of your plan, on every plan we sell. The only charged thing is the security audit, US$240.00 charged once.
Book the audit and an engineer goes through it for a fixed price, US$240.00 charged once. Before that, Kora answers straight away at any hour, and if it needs a person one takes it over within 4 business hours, or 1 hour on Care Pro.