SSL, password protection, IP blocks and malware scan in web hosting

Portal → Web hosting → plan → Security. Let's Encrypt issues SSL certificates free and automatically as soon as the domain points to the server; http:// is always redirected to https://. You can upload a purchased certificate per domain (PEM, key unencrypted) – we remind you 14 days before expiry. There you also set HSTS, security headers and login protection for WordPress (limits login attempts per IP), protect folders with user and password, block IP addresses or open a folder only to certain addresses and switch on hotlink protection for images. The malware scan looks for typical patterns of malicious code (also runs automatically every week); you move suspicious files to quarantine and can restore or delete them from there. Hits are indications, not certainties.