A real security stack — one you can verify.
Security you can only take on faith isn't security. Here's exactly how Belov Cloud protects your site and your data: isolated per site, encrypted at rest, defended at the edge, and hardened all the way through the deploy. No black box, no marketing checkbox.
Seven layers, on by default.
Not one firewall you switch on — a stack that assumes any single layer can fail, so no single failure reaches your data.
Every site is boxed off from every other
Each WordPress site runs in its own hardened container on its own private network, with its own database, its own credentials, and its own Redis object-cache container that only that network can reach — so one site's cache flush cannot touch another site's keys. One compromised site can't read another's files, reach its database, or see the rest of the server, and isolation is keyed to an opaque resource id, never to your domain, so it can't be tricked by a hostname.
Secrets encrypted at rest
Environment variables and connection strings are stored encrypted with AES-256-GCM, decrypted only server-side at deploy time. The injected service URLs (DATABASE_URL, REDIS_URL) are shown as locked rows in the panel — visible, never editable into a footgun.
Attacks shed at the edge
Floods are absorbed at the edge before they reach your origin, and CrowdSec bans repeat offenders at the IP layer across the whole fleet — an attacker that hits one site is blocked for all of them. Your origin IP stays hidden behind the edge.
OWASP ruleset on every request
A Coraza web-application firewall running the OWASP Core Rule Set inspects every request for SQL-injection, XSS, traversal and scanner patterns — before the cache, before your site — and refuses a match with a 403. WordPress-specific exclusions keep wp-admin and the REST API from tripping it. If a legitimate request on a Node app ever does, an owner or admin can set up to five path prefixes to monitor-only from the app's Security tab: those paths stay inspected and logged, every other path keeps blocking.
Automatic, always-renewed HTTPS
TLS certificates are issued and renewed automatically — and only ever minted for a domain that's genuinely pointed at us, verified against our own records. If a certificate ever needs reissuing, the self-healing copilot does it and logs that it did.
Supply-chain-hardened deploys
For Node apps, every deploy clones with a fresh token scoped to only that one repository, read-only, and discarded when the build finishes. The build itself runs in a locked-down sandbox with no access to our private network — a hostile postinstall in some dependency can't reach other tenants or the rest of your org's repos.
Your account, not just your sites
Optional two-factor authentication for your login, team access by role with per-site scoping for developers, and billing visible to the owner alone. Every sensitive action lands in an audit log — who did what, when.
We move your site without ever holding your keys.
The one moment a host usually asks for full access is the migration. Ours never does — and the connector that makes that possible is built to be tamper-proof.
- ✓No password, FTP, or admin URL ever leaves your site — you prove ownership with a code generated inside your own wp-admin.
- ✓Every call between the connector and our platform is HMAC-signed, so a request can't be forged or replayed.
- ✓Outbound fetches are SSRF-guarded and DNS-rebind-pinned — the migration can't be tricked into reaching internal addresses.
- ✓The export is byte-exact and integrity-checked — a truncated or corrupted dump is rejected rather than silently imported, and character sets round-trip faithfully (latin1/utf8), so your data lands identical, not re-encoded.
Host it somewhere that shows its work.
Free byte-exact migration, verified on a preview URL before DNS. Isolated, encrypted, and self-healing from day one.