0

Few years back I hosted my website on godaddy but I was not that tech savy so they (customer care people) assisted me on hosting the website on their shared hosting server. Since then I am on a constant endeavor to educate myself in tech area and now I feel to it is pretty easy to host a website and make it up and running live.

But when I needed the assistance back then to host my website on godaddy, they were able to have access my website files and data, moving them on their end in a particular folder to make the website go live. They were also telling me to remove the custom CSS codes from a particular line as it was giving me the some error.

So I want to know, is it possible to prevent hosting providers getting access to my website files and data in it and how ?

Aseem Sharma
  • 3
  • 1
  • I don't think it is possible that your Webhoster has no access to your website data. Anyway, why are you concerned that they got it? If you Host something on the internet you want that other people find this information, so everyone can look at it. – Cyberduck Jan 16 '19 at 11:02

3 Answers3

2

is it possible to prevent hosting providers getting access to my website files and data

Short answer: no.

You are uploading your files to someone else's computer, so they have access to every single file there. You have a database? They have access to the database too, and its contents, and the server logs, and are in position to know every single byte of data sent and received from every single client you have.

How you prevent that? You have your own computer connected to the internet.

Encryption can help? Not really. You could encrypt data, but your clients would need the cleartext, so you would need to provide the decryption keys, and your provider would get that too.

ThoriumBR
  • 53,925
  • 13
  • 135
  • 152
  • Does that mean they are in position to alter my files as well ? For example, if some psycho employee in their organisation (hosting provider's office) has evil intentions and decided to break up a random client's website by altering codes, then would he not be able to prevent that ? – Aseem Sharma Jan 16 '19 at 11:48
  • Yes, any employee with a powerful enough account CAN alter your files. They will not do so, because of SLA, EULA, and Public Relations Nightmare Prevention rules... But they can. Your files are on their computer, they promised you not to change anything, but they can. – ThoriumBR Jan 16 '19 at 12:58
  • So monitoring is the only solution for this problem ? – Aseem Sharma Jan 16 '19 at 14:45
  • No, the contract is the solution. If the provider says they wont' touch your files, they won't. Their reputation is way more valuable than your files, whatever they may contain. – ThoriumBR Jan 16 '19 at 14:55
  • And once the integrity/secrecy of your files becomes worth more than a failure of the contract (both contractual penalties, and public perception) then you should take your business elsewhere (either another provider, or host it yourself) – Ruscal Jan 16 '19 at 18:04
1

If you use shared hosting (as it seemed to be the case here) your data are on a server owned and maintained by the hosting provider. This means that the provider can read all the data on the system. It would also not be possible to encrypt the data to remove control from the hoster since in order to make your web site accessible from outside the web server software running on the system needs to be able to read the plain files.

Steffen Ullrich
  • 201,479
  • 30
  • 402
  • 465
0

Assuming that you are doing everything remotely the ones that have access to your physical server have access to everything either easy way or hard way.

The only way of keeping them out is if you use HDD encryption with TPM and you personally enter in the datacenter to configure the physical machine boot and keys. (not happening many times as many do not even allow access to dataceter from third parties.)

Or build your own stuff inside your own datacenter.

In current days the biggest issue is not to protect at any cost but to audit. Most of the companies are risk driven so they have a risk of being exposed and try to mitigate it until the value they are protecting and the costs of protection are balanced and acceptable from business point of view.

If you storing your stuff in a third party host you should implement base hardening that is current with your risk and efficient monitoring that allows you to know what is happening at anytime.

Hugo
  • 1,701
  • 11
  • 12