FAQ: Staging, Backups & Security

Website Pro includes tools to manage site versions, backups, and hosting infrastructure security. This FAQ covers common questions about staging environments, backup alerts, rate limiting, and how the platform protects against denial-of-service (DoS) attacks.

Q: Why is my staging site taking a long time to create?

Staging creation time depends on more than just the site’s file size—it also depends on how large and complex the site’s database is.

Examples:

• A 4.5 GB eCommerce site with 10,000+ products will take significantly longer than a 4.5 GB brochure site with 5 pages and large media files.

• This is because staging involves copying both the file system and performing database writes, which can be slow for content-heavy or highly dynamic sites.

If your staging site is taking longer than expected, give it additional time or reach out to support if it's stalled for an extended period.

Q: Can I activate more than one Website Pro product on the same account?

This FAQ will soon be retired, as Website Multisite will allow users to host multiple websites under one product instance.

Stay tuned for updates on Multisite functionality, which will provide a more scalable way to manage multiple sites from a single dashboard.

Q: Will I receive notifications if a backup fails?

No, not at this time. Website Pro does not currently send failure notifications for daily or manual backups.

We recommend:

• Regularly checking the Backups tab in the Website Pro dashboard

• Reviewing backup history to confirm recent versions are available and secure

• Performing manual backups before major edits or plugin installations

Q: Does Website Pro use server-side rate limiting?

Yes. Website Pro applies IP-based rate limiting to reduce the risk of abuse, bots, and DDoS attacks.

Rate Limit Configuration:

• Limit: 20 requests per second

• Burst buffer: 20 extra requests (i.e., 40 total max in 1 second)

• Requests beyond this are rejected with a 429 Too Many Requests response

Exemptions (not rate-limited):

• Static assets (images, JS, CSS)

• PHP GET requests

• AJAX requests via wp-admin/admin-ajax.php

This ensures that normal traffic is unaffected while malicious requests are filtered.

Q: How does Website Pro protect my sites from DoS attacks?

Website Pro leverages Google Cloud Platform’s infrastructure-level DDoS protection, along with additional platform measures:

• Rate limiting on high-volume requests (see above)

• Protection of the WordPress login system:

  • The default wp-login.php page is not directly accessible

  • Admins must sign in through Vendasta’s secure dashboard

  • This protects against brute-force login attacks and credential stuffing

Together, these safeguards help ensure your sites remain fast, secure, and available—even during high traffic or threat events.