Security has always been part of running a hosting business. But the data from the 2026 Web Hosting Trends Report, produced by CloudLinux in collaboration with WebPros, suggests its role is expanding. As hosting providers grow revenue and move upmarket, security increasingly affects not just uptime, but support costs, customer retention, and margins.

Around 65% of providers reported revenue growth in 2025. But that growth comes with pressure: price competition (29%) and rising costs (28%) are the top two threats to profitability. In that environment, anything that adds to operational overhead, including unresolved security issues, has a direct impact on the bottom line.

Growth Is Up, but Margins Are Under Pressure

The report paints a picture of an industry that is growing but working harder to stay profitable. 65% of providers grew revenue in 2025, and 71% say they feel prepared for 2026. But the margin squeeze is real: price competition from below, rising costs from above.

In this context, security isn't just about keeping servers safe. It's about keeping the cost of running those servers under control. Every hour a support engineer spends on a compromised account, a blacklisted IP, or a malware cleanup is an hour that erodes the margin on that customer.

Security and the Move to VPS

VPS and dedicated hosting are the #1 growth opportunity providers identified (26%), ahead of shared hosting (22%) and cloud servers (17%).

Customers move to VPS because they outgrow shared hosting: they need more resources, more performance predictability, or more control. Agencies, e-commerce businesses, and growing companies often start on VPS from day one because their requirements demand it.

For providers, moving into VPS also raises the security stakes. VPS customers tend to be businesses with more at stake: more traffic, more transactions, more to lose from a security incident. And 37% of providers say managing security risks and DDoS attacks is one of their biggest challenges when running VPS and dedicated servers.

Providers who sell managed VPS at healthy margins, rather than competing on price with unmanaged cloud providers, need to deliver on the promise that the environment is taken care of. Security is a core part of that promise. The 34% who say educating customers on the value of managed VPS is a challenge reinforces this: if customers can't see the security and operational value baked into a managed plan, they'll default to the cheaper unmanaged option.

Services and Security Are Closely Linked

Professional services are the top lever for growing ARPU: 50% of providers plan to expand them. Many of these services are security-related by nature: site cleanups, malware removal, patching, and hardening. Security-related services are already sold successfully by 33% of providers.Security work can generate revenue, but it can also overwhelm support teams if the underlying security isn't automated. The difference between a scalable service offering and a margin drain often comes down to whether you're fixing problems reactively or preventing them proactively.

How Security Affects Churn

Price is the leading reason customers leave (56%), followed by migration to SaaS platforms (41%). Security incidents are cited by 19% of providers as a churn factor: lower than price or SaaS migration, but real.Security failures also have knock-on effects. Compromised accounts lead to spam outbreaks and blacklisted IPs, which cause deliverability problems that frustrate customers even when they don't identify the root cause as a security issue.

SaaS platforms like Wix and Shopify increasingly market security as something that's handled automatically. Hosting providers don't need to replicate the SaaS model, but they do need to show customers that security on their platform is proactive, not reactive.

Where Support Time Actually Goes

The report identifies the four biggest drains on support time:

• Email problems: spam, blacklisting, deliverability issues
• CMS and application issues: WordPress, plugin problems
• Performance issues: slow websites
• Security incidents: hacked sites, malware infections

Email problems in particular are often driven by security failures: compromised accounts sending outbound spam, resulting IP blacklisting, and the deliverability problems that follow. While some email issues are purely technical (DNS configuration, authentication setup), a large share trace back to a security event.

CMS/application issues and performance complaints are largely separate from security, though there is overlap when a hacked plugin causes both a security incident and a performance problem.

The takeaway: security-related issues, including most email problems and all direct security incidents, account for a significant share of total support load.

The Security Challenges Creating the Most Risk

The report asked providers which security challenges create the most overhead and risk:

• Outdated or vulnerable software, especially CMS plugins and themes
• Malware and ransomware infections
• DDoS attacks
• Bot traffic consuming resources
• Outbound spam and IP blacklisting

These are the realities of running an open hosting environment where providers manage the infrastructure, but customers control the application code and often don't keep it updated. Effective security tooling needs to account for this: assume that some customer software will be outdated, and protect the environment despite it.

Where AI Fits In

AI is the trend providers expect to have the biggest impact in 2026 (53%). When asked which AI capabilities they value most, security leads the list:

• Automated site security and malware detection
• Predictive server performance monitoring

AI in customer support is already the most common use case (36% of providers use it there today). But the strongest demand is for AI that works in the background: detecting threats before they generate tickets and flagging anomalies before customers notice. Security and compliance is also the #2 technology investment priority for 2026 (43%), just behind performance (44%).

Imunify: Automated Security as Margin Protection

The report makes a clear case: security directly affects support costs, customer retention, and the viability of managed hosting services. When customer sites are compromised, support teams absorb the cost, handling blacklisted IPs, cleaning malware, and running emergency recoveries. That reactive work eats into margins.

Providers who automate security can:

• Reduce security-related ticket volume
• Shorten incident resolution time
• Protect the margins on managed and premium plans

Imunify360, along with Imunify Email and Imunify Patch, provides an automated security layer designed to reduce manual intervention and cut recurring support load. The result is lower operational overhead and more predictable margins.

Get the Imunify360 license here, or apply for the CloudLinux VPS Bundle program to save up to 55% on license costs for VPS servers.

Download the full 2026 Web Hosting Trends Report to explore the complete security findings.