Host Vlaanderen

Host Vlaanderen is our own hosting company. Since 2020 it has given businesses in Flanders fast, secure web hosting and managed WordPress, run by people who build web platforms for a living. Today that is about 115 domains, including some 95 WordPress sites, on a dedicated Linux server that we manage ourselves.

The challenge

For years, hosting was reactive. A customer noticed something odd, or a mail provider started refusing our mail, and only then did we look. That stopped being good enough once attacks became automated.

Today, weaknesses in WordPress and PHP are probed by scripts within hours of being published. Bots hammer login pages and create fake accounts on webshops. Backdoors are disguised as normal plugin folders or image files, and admin accounts appear without anyone noticing. On a shared server, one compromised or bot-flooded site can hurt every customer at once: large mail providers then refuse mail from the whole server. And more sites are being built quickly, with plugins nobody keeps up to date. By the time a customer notices, the damage is done.

The pivot: from reacting to watching every day

We rebuilt how we run the server around one idea: find problems before customers do, and never let a machine change a customer’s site on its own.

• A daily security report, ready before the working day starts. For every site it checks the WordPress core files against the official checksums, looks for PHP files where code should never be (uploads, image files, fake plugin folders), and lists new or unknown administrators, changed core settings and the findings of the malware scanner.
• A morning check by an AI agent on every working day. The agent reads that report together with the backup status, blocked attackers, disk and load, the mail queue, mail refusals from large providers and certificate renewals. It compares everything with the day before and sums it up in a few lines.
• Automatic blocking of what is clearly hostile. WordPress login attacks are banned automatically, and repeat offenders and abusive networks are blocked at the firewall.
• A person decides. When something is caught, the agent investigates read-only, collects the evidence and writes a proposal in a ticket. A person picks an option, and only then is the change made, always with a backup first and a way back. Suspicious files go to quarantine rather than being deleted, and suspicious admins are downgraded before they are removed.

What it catches

• A critical PHP vulnerability in October 2026. Extra protection was in place within hours of the announcement, and an agent watched the server every ten minutes through the night until the patched PHP could be installed, the same day. There was no sign of exploitation.
• Hidden backdoors in several WordPress sites, disguised as legitimate files. The daily checks found them and they were quarantined before customers saw any effect.
• Bot sign-ups on a webshop. A large mail provider started refusing mail, and within a day it was traced to bots creating fake accounts. A fix was on the table the same morning.
• Updates that failed silently. One site’s automatic updates had stopped two months earlier without anyone noticing. It was found and brought up to date, with a backup first.

Deep dive: the stack

A dedicated Ubuntu server runs Plesk, with nginx in front of Apache and PHP 8. WordPress is managed through Plesk’s WordPress Toolkit, Imunify360 scans for malware, and fail2ban and the firewall do the blocking. Certificates come from Let’s Encrypt, and mail runs on Postfix and Dovecot with SPF, DKIM and DMARC. Backups run every night, incremental with a full backup every week. Security updates are applied automatically where that is safe, and urgent ones by hand on the day they come out.

On top of that sits our own toolkit of check scripts that writes the daily report, and AI agents (Claude) that do the checking, triage and preparation. Every decision has a ticket, so we can always see what was found, what was proposed and who approved it.

How we work

Host Vlaanderen keeps us honest. The agents do the tireless part: reading every report, every morning, and comparing it with yesterday. People keep the part that needs judgement: deciding what changes on a customer’s site, and talking to the customer. It is the same split we use when we build AI into a client’s operations.

Where it stands

Host Vlaanderen has been running since 2020. Since September 2026 a security report has landed every single day, 60 so far. For Ekinsol clients it means one partner from the first line of code to the server it runs on, and a server that is watched every day instead of when something breaks.