Monarx Reviewed 65 Hosts: 10 of 12 Large Hosting Brands Sell Website Security Add-Ons

Hosting providers are split on whether website security is part of the plan or a product sold on top of it, and many do both. In an August 2026 review of the public pricing, product and support pages of 65 hosting companies, Monarx found that 37 include advanced website protection at no extra cost, 31 sell a separate website-security product and 18 do both.

The figures come from “Pricing for Hosting Security,” a whitepaper Monarx published in September. The company sells server-side malware detection, prevention and automatic remediation to hosting providers. In the paper, it presents protecting every customer and earning security revenue as goals that do not have to compete. It recommends a protection baseline for every account with paid tiers on top, the same model its own platform is built around.

What Counts as Advanced Protection

The whitepaper separates platform security, the controls a provider operates to protect its servers and shared environment, from customer-facing website security, positioned as a visible service for a single site or account. It adds that the distinction is useful for packaging but is not a technical rule, because server-deployed security can still protect each site when it provides account-level detection, remediation and visibility.

The company counted a provider as including advanced website protection when its public pricing, product or support pages indicated that site- or account-level capabilities were included in its core hosting plans at no additional cost. Examples are malware detection, automated remediation, a web application firewall (WAF) and vulnerability protection. Those 37 do not necessarily offer the same set of features, or the full baseline recommended later in the report. The classification describes the published offer, not independently tested effectiveness, as the whitepaper notes.

Of the other 28 providers, 12 offer basic platform controls only, 4 explicitly exclude advanced protection from the core plan and 12 were not classified. All four that exclude it sell a paid security product instead. In the second classification, of separately sold products, 31 providers sell a malware or WAF product and 9 sell only non-malware add-ons: SSL, backup, email or domain privacy. No separate security add-on was found at 4 providers, public information was inconclusive for 2, and 19 were not classified.

Who Includes Security and Who Sells It

Split by segment, the data shows the clearest difference between mass-market brands and managed WordPress hosts.

The paper reads this as segments making different promises to customers, and advises providers to choose the model that fits their market and operating structure. It groups the market into four packaging models and names a risk for each:

• Included platform security: malware and firewall protection across the core range, with security not sold as a separate SKU, so the investment has to be justified through retention, differentiation and lower operating cost.
• Add-on-led security: malware or WAF protection is sold separately, so protection depends on customers seeing and buying the add-on.
• Premium bundled security: a higher base price funds a broader bundle, which is hard to apply to low-cost hosting.
• Baseline plus premium upsell: malware detection and automatic file remediation for all customers, with paid tiers above, which requires clear feature boundaries and billing rules.

In the paper’s examples, hosting.com stands for included platform security and Convesio for premium bundled security. GoDaddy, Bluehost and DreamHost represent add-on-led security, and Rapyd Cloud a baseline plus premium upsell. They show positioning and packaging, not the relative effectiveness of the underlying security technology.

How Add-Ons Are Priced and Branded

Pricing is harder to compare than packaging. The review found a published price for a security add-on at 20 of the 65 providers. Half of those offers were priced per site, monthly and in US dollars, which allowed a direct comparison. The other 10 were SSL-only, priced in other currencies, per server, estimated or billed over an unclear period. Across the 10 comparable offers, entry prices ran from $1.92 to $7.99 per site a month, a range the company calls directional rather than a market median. Of the 20 providers that publish prices, 16 show three or more tiers.

Selling a security add-on does not require building it. Among hosts that sell one for revenue, most put a third-party brand on it, roughly two in three, by the company’s count. The paper links that choice to how much margin the provider keeps and how much of the security story belongs to the host.

What Infections Cost a Host

Part of the company’s case for a baseline is the cost of infected sites, which it describes as often spread across support, cleanup, abuse handling, IP reputation work, suspensions and cancellations. Without those costs, an add-on-only model can look more profitable than it is, according to the paper. It puts the account infection rate among hosting providers whose security came mainly from open-source tools and site-security add-ons at 30%, based on its analysis of customers migrating to Monarx from those solutions.

A second figure comes from a single hosting environment whose only malware protection was a legacy signature-based scanner sold as a paid add-on. At full deployment, Monarx found active infections affecting 30% of hosted users. Around 1,000 accounts were being suspended each month. Between 5% and 10% of accounts suspended after a malware incident went on to cancel, roughly 100 lost accounts a month at the upper end of that range. By the company’s estimate, that attrition placed about $18,000 of annual recurring revenue at risk each month, which over a year adds up to about $216,000 at risk. The whitepaper calls this one deployment, not a market average, and notes that results will vary by account mix, security posture and operating model.

Monarx’s Model: Included Baseline, Two Paid Tiers

For most shared hosting and managed WordPress portfolios, the company recommends the fourth model, a baseline plus premium upsell. The included baseline covers malware detection, automatic file remediation, continuous or near-continuous scanning, malicious process detection and termination, and a customer dashboard with alerts, plus a platform-level WAF where the hosting stack supports provider-managed request filtering. Database scanning and cleanup and proactive application-layer shielding typically belong in a first paid tier, and human expert cleanup with a recovery SLA in a second.

Its worked example for a mid-market host prices the first tier, Proactive Protection, at $5.99 per site a month, and the second, Managed Recovery, at $14.99. Assuming 100,000 eligible accounts and an 80/20 split between the tiers, a 5% attach rate yields annual recurring revenue of about $467,400. At 10% the figure is $934,800, and at 15% about $1.4 million, all before delivery and support costs. It labels these figures examples, not forecasts or market benchmarks. The worksheet in its appendix subtracts technology, remediation, support, payment and refund costs, and adds verified avoided support cost and avoided revenue loss.

To fund the baseline, the whitepaper points to server- or fleet-level licensing, consolidating overlapping tools and vendors, a modest base-plan increase for new plans and at renewal where the market allows it, and counting avoided operational cost.

It also sets limits on how the upsell is sold. Under its guardrails, a host should not hold basic remediation hostage when it is part of the baseline, nor restrict access solely to force a purchase. The paper advises stopping or redesigning a program whose revenue depends on coercive incident messaging, hidden terms or withholding controls required for a safe baseline. It presents the framework, worksheets and scorecard as usable with any security stack.

About the Data

The definition of advanced website protection behind the count of 37 comes from Monarx’s written answer. The counts describe the 65 providers in the company’s August 2026 review.