How Unpress keeps your website secure
How Unpress keeps your websitesecure.
Built for companies that care about security, compliance, reliability and speed. Here is what Unpress does to protect a website, in plain English, and where its limits are.
Claim my spot: 2 months free
Leave anytime, keep your website.
- Pre-built pages
- HTTPS on every site
- Every change tracked
Four things the public site does not have.
- Whole types of attack need one of these.
- A pre-built website has none, so those attacks have nothing to run against.
- Plugins held 91% of the new WordPress vulnerabilities Patchstack counted in 2025.
What each kind of attack needs.
A plain list of common attacks, what each one depends on, and what that means on Unpress. It is our own design described, so read it as our claim.
| Type of attack | What it needs | On Unpress |
|---|---|---|
| SQL injection | A database behind the public pages | No database on the public site |
| Plugin and theme exploits | A plugin or theme with a flaw | No plugins on the public site |
| Code run on the server | Server code running on each request | No server code runs when a page loads |
| Password guessing on the admin login | A login page on the public site | The editor is separate from the public site |
| Floods of traffic (DDoS) | A server that can be overwhelmed | DDoS protection from our infrastructure provider, and pages served from many locations |
| Eavesdropping on a visit | Traffic that is not encrypted | HTTPS on every site, with data encrypted in transit and at rest |
Sources: our own design; the security page published by our infrastructure provider, read on 22 October 2026.
How the infrastructure is protected.
What our infrastructure provider publishes about its own measures.
- Encrypted in transit and at rest
- DDoS protection
- Continuous vulnerability scans
- Annual penetration tests, bug bounty
- Intrusion prevention and monitoring
- Tested disaster recovery plans
- Development, test and production apart
- Built on leading global cloud
Unpress runs on infrastructure from a SOC 2 Type 2 certified provider. That is the provider's certification. Digital Monday itself is not SOC 2 certified, and we do not say it is.
Compliance, in plain terms.
Compliance is about showing who did what, and keeping people's data safe. Unpress helps you meet your compliance needs. We never say it makes you compliant, because that depends on your whole organisation.
- Full change historyEvery change saved with who made it and when.
- Access controlEditing is set person by person, apart from your site.
- HTTPS everywhereEvery site is served over HTTPS.
- No customer dataForms go to a separate secure service.
- Backups and recoveryVersion history, and tested disaster recovery.
- GDPROur provider works to GDPR. Your duties stay yours.
How Unpress helps with the Essential Eight.
The Australian Cyber Security Centre's Essential Eight is a baseline of eight mitigation strategies for an organisation. A website is one small part of it. Here is what Unpress covers and what stays with you. We do not say Unpress is Essential Eight compliant, because only your whole organisation can be assessed.
| Strategy | What Unpress does | What stays with you |
|---|---|---|
| Patch applications | There is no CMS core or plugin to patch on your public site. We apply updates to the platform | The applications on your own computers |
| Patch operating systems | There is no server of yours to patch for the public site | The operating systems on your own computers and devices |
| Multi-factor authentication | Not covered by Unpress | Turn it on for your own accounts, including email and your domain registrar |
| Restrict administrative privileges | Editing access is set person by person, and the editor is separate from the public site | Choosing who gets access, and removing it when someone leaves |
| Application control | Not covered by Unpress | What can run on your computers |
| Restrict Microsoft Office macros | Not covered by Unpress | Your Office settings |
| User application hardening | Not covered by Unpress | The browsers and apps on your computers |
| Regular backups | Every change is kept in version history, so you can return to an earlier version of the site | Backups of your own files, email and business data |
Source: the Australian Cyber Security Centre, Essential Eight. No set of strategies protects against every threat.
Where the limits are.
No system is immune. We say Unpress removes whole types of attack, not that a site cannot be hacked. These are the parts that still need care.
What Unpress doesn't do
- FormsSent to a separate service. You choose what to ask.
- Outside scriptsChat, ads and trackers add risk. We add few.
- Your own accountsA strong site can't protect a stolen password.
- Who can editRemove access when someone leaves.
Latest security news
SecurityPHP2Shell: what WordPress site owners should do right now
Two critical PHP flaws fixed. What to do today.
7 min read
SecurityWordPress hacked? What to do in the first 24 hours
The first 24 hours after a hack: what to do.
8 min read
Security questions.
- Can a static site be hacked?
- Yes, through fewer routes. A pre-built site has no database or server code on its public pages. The editor login, forms and outside scripts can still be attacked, so they need protection.
- What about forms?
- Forms send what people type to a separate secure service, not to code on your page. You decide what you ask for, and we keep outside scripts to a minimum.
- Is my data stored on the website?
- Your public pages are pre-built files and hold no customer data. Anything a visitor submits through a form goes to a separate service.
- Is Unpress SOC 2 certified?
- No. Unpress runs on infrastructure from a SOC 2 Type 2 certified provider. That is a statement about the provider, not about Digital Monday.
Sign up now. We open to everyone on 1 November.
Get your first two months free when we launch.
- $500 a month
- 2 months free
- Results in 60 days, or your first two months back
Got a question first? Contact us
Thanks, we'll be in touch when we launch.