Summary:
Consequently, it was found that GoDaddy, one of the major hosting service providers, had not taken proper security measures to protect the services since 2018. The FTC ordered GoDaddy to increase its security practices. More precisely, GoDaddy had been reported to fail in implementing basic security protections like multi-factor authentication and HTTPS APIs, which gave way to security vulnerabilities that compromised millions of customers. These security failures involved several management issues such as poor management of software updates, absence of threat monitoring schemes, and lack of appropriate safeguards in accessing sensitive information.

The notice on the FTC website states,

”The Federal Trade Commission will require web hosting company GoDaddy to implement a robust information security program to settle charges that the company failed to secure its website-hosting services against attacks that could harm its customers and visitors to the customers’ websites.

The FTC alleges in its complaint that, since 2018, GoDaddy has failed to implement reasonable and appropriate security measures to protect and monitor its website-hosting environments for security threats, and misled customers about the extent of its data security protections on its website hosting services.

In its proposed settlement order, the FTC is requiring GoDaddy to establish a comprehensive data security program that is similar to those in other FTC cases, including the recent settlement with Marriott International.

“Millions of companies, particularly small businesses, rely on web hosting providers like GoDaddy to secure the websites that they and their customers rely on,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is acting today to ensure that companies like GoDaddy bolster their security systems to protect consumers around the globe.”

Arizona-based GoDaddy Inc. and its operating subsidiary GoDaddy[.]com, LLC make up one of the world’s largest web hosting companies, with approximately five million web hosting customers.

GoDaddy’s unreasonable security practices include failing to: inventory and manage assets and software updates; assess risks to its shared hosting services; adequately log and monitor security-related events in the hosting environment; and segment its shared hosting from less-secure environments, according to the FTC’s complaint.

The FTC says that GoDaddy’s data-security failures resulted in several major security breaches between 2019 and 2022 in which bad actors gained unauthorized access to customers’ websites and data. These breaches exposed consumers visiting the websites to risks, including that consumers were redirected to malicious websites.

Additionally, the FTC alleges that GoDaddy misled customers, through claims on its websites and in email and social media ads, by representing that it deployed reasonable security and that it was in compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, which require companies to take reasonable and appropriate measures to protect personal information, (FTC, 2025).”

Security Officer Comments:
These mistakes therefore led to a series of data breaches, including source code theft and the installation of malware in February 2023. In November 2021, the breach affected over 1.2 million Managed WordPress customers, retrieving their login credentials and SSL keys. In the settlement, the FTC ordered GoDaddy to harden security: MFA for all users and employees, independent third-party review of its security program, and the implementation of new security technologies. The order should shine a light on the fact that hosting companies need to raise their defenses against emerging cyber threats to protect consumers and businesses worldwide.

Link(s):
https://www.bleepingcomputer.com/ne...y-to-fix-poor-web-hosting-security-practices/

https://www.ftc.gov/news-events/new...ax-data-security-its-website-hosting-services