Western Mass Hosting's hosting Articles

Home / hosting

Wordpress Plugin - Security Header Generator

Managing the hosting for thousands of websites is no easy feat. Wordpress makes that a tad more difficult because it currently runs over 1/3 of the websites on the internet. Keeping an application with this kind of global coverage secure should be the number 1 priority of every web hosting…
Read More
Apache CPanel Development Hosting IIS Javascript jQuery LAMP LEMP Linux nGinx PHP Plugins RunCloud Security Server Management Software Source Code Ubuntu Updates Wordpress apache cpanel development form security hosting javascript linux nginx php site security web development wordpress wordpress security

Restic Python Backup to S3 Compatible Storage

Forward In my quest to get my servers fully automated, I realized I needed a reliable way to backup and restore my sites and databases.  Including a way to either browse the backups, or restore them to any other machine I have access to. At first I thought... mmm...  duplicity…
Read More
Hosting LAMP LEMP Linux MySQL RunCloud Security Server Management ServerPilot Software Source Code Ubuntu Windows bash hosting mysql nginx python python 3 shell shell scripting ubuntu web hosting

RunCloud and iThemes for Wordpress

Like most good hosting support folks, security tops the list of my priorities. While a good firewall, and true Web Application Firewall are the best means for helping with this, sometimes shared hosting services will not change the configurations they have in place to support the necessary security for a…
Read More
Development Hosting LEMP Linux nGinx Plugins RunCloud Security Wordpress development hosting linux nginx ubuntu web hosting wordpress wordpress security

Cookie Notice

This site utilizes cookies to improve your browsing experience, analyze the type of traffic we receive, and serve up proper content for you. If you wish to continue browsing, you must agree to allow us to set these cookies. If not, please visit another website.

Proper Website Content Security nGinx Configuration

Wow!  It’s been a little while since I have had the time to post another article.   Well, here I am again, back at it.This time, I will show you an optimal way to keep your site secure utilizing a bit of nginx configuration.  You will need to do some work before implementing this, so please do not attempt to simply copy/paste this and expect it to work out of the box.

# Default security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; # enable, cache, and preload subdomains
add_header X-Frame-Options "SAMEORIGIN" always; # generally only allow SAMEORIGIN frame sources
add_header X-Xss-Protection "1; mode=block"; # protect against Cross-Site Scripting
add_header X-Content-Type-Options "nosniff" always; # no sniffing allowed!
add_header Referrer-Policy "strict-origin"; # protect agains cross-linking
add_header X-Download-Options "noopen"; # force the download, and do not allow direct openning
add_header X-Permitted-Cross-Domain-Policies "none"; # protect agains cross-linking
add_header X-Robots-Tag none; # only allow robots.txt# Content Security Policy
set $CSP_image "img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;"; # allowable external image domains
set $CSP_script "script-src 'self' 'unsafe-inline' 'unsafe-eval';"; # allowable external jaavscript domains
set $CSP_style "style-src 'self' 'unsafe-inline';"; # allowable external CSS domains
set $CSP_font "font-src 'self' data:;"; # allowable external font domains
set $CSP_frame "frame-src 'self';"; # allowable external frames/iframes domains
set $CSP_object "object-src 'self';"; # allowable external object domains
set $CSP_connect "connect-src 'self';"; # allowable external connect domains
set $CSP_media "media-src 'self';"; # allowable external media domains
set $CSP_form "form-action 'self';"; # allowable external form domains
set $CSP_frame_anc "frame-ancestors 'self';"; # allowable external frame ancestor domains
set $CSP "default-src 'self'; ${CSP_image} ${CSP_script} ${CSP_style} ${CSP_font} ${CSP_frame} ${CSP_object}";
add_header Content-Security-Policy $CSP always;
add_header X-Content-Security-Policy $CSP always;

First things first, you need to browse through your site and note every single external call.  By external call I mean everything that is not requested directly from your sites domain.  Items like google fonts, google analytics, etc… all pull their resources from their respective domains.  Your best bet is going to be to note what the domain is, and what type of resource it is.  An image, a font, css, javascript, etc…Once you have your list, proceed in getting your site an SSL certificate and have it applied.  When you have your list and SSL certificate applied, you will need to add the following configuration to your nginx config inside your site’s “server{}” block, although placing it in your sites “location / {}” will also work.Please see the comments in the configuration above.  You will need to use the FQDN, and not the URL for each item.  If you do not have the domains for the external resources, or there simply are none, leave well enough alone and block everything that is not allowed 🙂

Our Privacy Policy

Last Updated: June 18th, 2025

Introduction

Western Mass Hosting (“we,” “our,” or “us”) respects the privacy of all individuals and organizations that interact with our services. This Privacy Policy establishes our practices regarding the collection, use, disclosure, and protection of personal information for visitors to our website and clients utilizing our managed hosting and WordPress services. By accessing our website or engaging our services, you acknowledge that you have read and understood this policy in its entirety.

Scope and Applicability

This Privacy Policy governs our handling of information collected through our corporate website and in the course of providing managed hosting, WordPress maintenance, and development services. In accordance with global privacy regulations, we serve as a Data Controller for information related to our business operations and client relationships. When processing data on behalf of our clients through hosted services, we act as a Data Processor under applicable data protection laws.

Information We Collect

We collect various categories of information necessary to provide and improve our services. This includes personal contact and payment details provided during account registration, technical information such as IP addresses and device characteristics for security purposes, and records of communications through support channels. For clients utilizing our hosting services, we may process end-user data stored within client websites, though we do not control or monitor the collection practices of such data.

Purpose and Legal Basis for Processing

We process personal information only when we have proper justification under applicable laws. The primary legal bases for our processing activities include the necessity to fulfill contractual obligations to our clients, our legitimate business interests in maintaining and improving our services, and in limited cases, explicit consent for specific marketing communications. We maintain detailed records of processing activities to demonstrate compliance with legal requirements.

Use of Collected Information

The information we collect serves multiple business purposes. Primarily, we use this data to deliver and maintain reliable hosting services, including server provisioning, performance monitoring, and technical support. We also utilize information for business operations such as billing, customer relationship management, and service improvement initiatives. Security represents another critical use case, where we analyze data to detect and prevent fraudulent activity or unauthorized access to our systems.

Data Sharing and Third-Party Disclosures

We engage with carefully selected third-party service providers to support our operations, including cloud infrastructure providers, payment processors, and customer support platforms. These relationships are governed by strict contractual agreements that mandate appropriate data protection measures. We may disclose information when legally required to comply with court orders, government requests, or to protect our legal rights and the security of our services.

International Data Transfers

As a global service provider, we may transfer and process data in various locations worldwide. When transferring personal data originating from the European Economic Area or other regulated jurisdictions, we implement appropriate safeguards such as Standard Contractual Clauses and rely on adequacy decisions where applicable. Our subprocessors, including AWS Lightsail, maintain robust compliance certifications to ensure the protection of transferred data.

Data Retention Practices

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy. Client account information is typically maintained for five years following service termination to comply with legal and financial reporting obligations. Backup data associated with hosting services is automatically purged after thirty days, as specified in our Terms of Service. For data processed on behalf of clients, retention periods are determined by the respective client’s policies and instructions.

Security Measures

We implement comprehensive technical and organizational security measures to protect personal information against unauthorized access, alteration, or destruction. Our security program includes network encryption protocols, regular vulnerability assessments, strict access controls, and employee training on data protection best practices. We maintain incident response procedures to address potential security breaches and will notify affected parties where required by law.

Individual Rights

Individuals whose personal data we process may exercise certain rights under applicable privacy laws. These rights may include requesting access to their information, seeking correction of inaccurate data, requesting deletion under specific circumstances, and objecting to particular processing activities. We have established procedures to handle such requests in accordance with legal requirements, typically responding within thirty days of receipt. Requests should be submitted to our designated Data Protection Officer through the contact information provided in this policy.

Cookies and Tracking Technologies

Our website employs various technologies to enhance user experience and analyze site performance. Essential cookies are used for basic functionality and security purposes, while analytics cookies help us understand how visitors interact with our site. Marketing cookies are only deployed with explicit user consent. Visitors can manage cookie preferences through their browser settings or our cookie consent tool.

Policy Updates and Notifications

We periodically review and update this Privacy Policy to reflect changes in our practices or legal obligations. Material changes will be communicated to affected clients through email notifications at least thirty days prior to implementation. Continued use of our services following such notifications constitutes acceptance of the revised policy.

Contact Information

For questions or concerns regarding this Privacy Policy or our privacy practices, please contact our Data Protection Officer at info@westernmasshosting.com or by mail at:

Western Mass Hosting
22 Orlando. St.,
Feeding Hills, MA 01030.

We take all privacy-related inquiries seriously and will respond promptly to legitimate requests. For clients with specific data processing agreements, please reference your contract for any additional terms that may apply to our handling of your data.