Acceptable use policy

This policy applies to every service and to anyone using your account. It exists for two reasons: to keep us on the right side of the law, and to stop one customer ruining the platform for everyone else. It does not exist to give us discretion over lawful speech we happen to disagree with.

Where a rule below is ambiguous, we read it narrowly and ask you before acting. Where it is not ambiguous — child sexual abuse material, live phishing, an ongoing attack — we act immediately and then tell you.

• Child sexual abuse material. Reported to the relevant authority and the account terminated, with no notice and no appeal.
• Content that infringes someone else's copyright or trademark, once a valid notice has been processed.
• Material that is unlawful where you or your audience are — including defamation established by a court, and content that breaches a court order served on us.
• Phishing pages, fake login forms, and sites impersonating a business, bank or government service.
• Malware, exploit kits, ransomware infrastructure, credential-stealer panels, and command-and-control servers.
• Fraudulent commerce: fake storefronts, counterfeit goods, advance-fee schemes, and unlicensed pharmaceutical sales.

• Attack anything you do not own or have written permission to test — port scans at scale, brute-force attempts, denial-of-service traffic, or amplification.
• Send unsolicited bulk email. Every recipient must have opted in, and you must be able to show us when and how.
• Run an open mail relay, an open recursive DNS resolver, or an open proxy.
• Forge headers, spoof source addresses, or misrepresent the origin of traffic.
• Mine cryptocurrency on shared or managed plans. It is allowed on dedicated servers where you pay for the whole machine and its power.
• Circumvent resource limits, evade a suspension with a new account, or share one account across unrelated businesses.

Shared and managed WordPress plans publish their CPU, memory, process, inode and I/O limits on the plan page. Hitting a ceiling occasionally is normal and nothing happens. Sitting on one for days affects your neighbours, and at that point you will get a message from an engineer with the graph attached and a suggestion — usually a bigger plan, sometimes a fix in your code that costs you nothing.

• We do not silently throttle. If we limit something you will know, in writing, with the numbers.
• We do not bill overages on shared plans without asking first.
• Backup storage, outbound bandwidth beyond plan, and mail volume have published fair-use ceilings rather than an undefined "unlimited".

Reports go to abuse@srvdaddy.com and are triaged by a human within one hour, 24/7. Here is the actual process, in order.

• We verify the report ourselves. A complaint is not evidence, and we have refused plenty of them.
• For anything that is not an active attack, we email you with the specifics and give you 48 hours to respond or fix it. First contact is a conversation.
• For an active attack, live phishing, or CSAM, we act first — usually null-routing a single IP or disabling one file rather than the account — and email you immediately with what we did and why.
• You can appeal any action to a senior engineer, and a second person reviews it. Suspensions overturned on appeal get a service credit for the downtime.
• Repeat, deliberate violations end in termination. We will say so explicitly before we do it.

Send notices under the DMCA or equivalent to abuse@srvdaddy.com. A valid notice identifies the work, the exact URL, your contact details, and includes the statutory good-faith statements. We will forward it to you in full and give you the chance to file a counter-notice before content comes down, unless the law requires us to move faster.

We publish a transparency report twice a year: how many notices arrived, how many were valid, how many we refused as abusive or overbroad, and how many government demands we received. Refusing bad notices is part of the job.

• We require lawful process — a subpoena, warrant or court order valid in our jurisdiction. A letterhead request gets a polite explanation of what we need.
• We tell the affected customer before disclosing anything, unless a court has gagged us. If gagged, we challenge the gag where there are grounds.
• We disclose the minimum the order compels, never the whole account because it was easier.
• We publish aggregate numbers in the transparency report and maintain a warrant canary.

Email abuse@srvdaddy.com with the URL or IP address, timestamps in UTC, and any log excerpts you can share. Security researchers should use the same address with "SECURITY" in the subject — we run a paid bounty, we will not threaten you, and we will credit you in the advisory unless you would rather we did not.