Acceptable use policy
What you may and may not host on CWP, how we handle abuse reports, and how fast we act on them.
This is a working draft written by the team, not by a lawyer, and it has not been reviewed by one. It must be before signups open.
Free hosting attracts abuse. Being specific about what is not allowed, and fast about removing it, is what keeps the service working for everyone who is using it properly.
This policy forms part of the terms of service.
Removed immediately, no warning
These get an account terminated the moment they are confirmed. There is no notice period and no grace period.
- Phishing — any page designed to collect credentials, card details or personal data by impersonating another service.
- Malware — hosting, distributing or linking to malicious software, ransomware, or exploit kits.
- Brand impersonation — passing yourself off as a bank, payment provider, government service, delivery company or any other organisation.
- Child sexual abuse material. Reported to the relevant authorities as well as removed.
- Command-and-control infrastructure for botnets or compromised machines.
Our target for confirmed phishing is removal within one hour of the report. Our reputation, and therefore everyone’s ability to have their sites load, depends on that number.
Not allowed
These get a warning and a chance to fix things, unless they are causing active harm.
- Bulk or unsolicited email, including operating a mailing list. SMTP is blocked anyway.
- Proxies, VPNs, tunnels or anything that relays traffic for third parties.
- File dumps — using hosting as storage for files not served by a website. Warez, pirated media, cracked software.
- Cryptocurrency mining, in any form, including in visitors’ browsers.
- Streaming or large media distribution. Shared hosting is the wrong tool and it degrades the server for everyone on it.
- Load testing, scanning, or attacking anything, including your own systems.
- Content that is illegal where you are or where our infrastructure sits.
- Adult content. Not a moral position — it is a payment-processing and upstream-provider constraint.
- Deliberately evading resource limits, including spreading one site across several accounts.
Resource use
Shared hosting means real neighbours. An account that destabilises a server may be suspended even if it is not breaking any rule above.
In practice this almost never means a busy site. It means a runaway script, an infinite loop, or an uncached site under an unexpected traffic spike. If your site is legitimately outgrowing the plan we will tell you, and the fix is usually caching rather than an upgrade.
Reporting abuse
If you find something on our platform that breaches this policy, report it. The current route is on the help page.
Useful reports include the full URL, what you believe the problem is, and a timestamp. Screenshots help. We do not need you to prove anything — we will verify it ourselves.
We act on reports from anyone. You do not need to be a customer, a rights holder, or affected personally.
When we hand information to the authorities
We disclose account information to law enforcement where the law requires it, or where there is a serious and immediate risk to someone’s safety. We do not hand over data on request without a proper legal basis.
Where we are allowed to tell the account holder that we have, we do. Sometimes the law forbids it, and occasionally telling someone would put a person at risk.
Reporting a security problem
Found a flaw in the platform? Report it privately to the contact published on the help page and give us a reasonable chance to fix it before you publish anything.
We will not pursue anyone who reports a flaw in good faith, provided you do not access other people’s data, destroy anything, or degrade the service for other users. There is no bug bounty — free hosting does not fund one — but we will credit you if you want the credit.
Copyright complaints
Send a notice identifying the copyrighted work, the URL of the material, your contact details, and a statement that you believe in good faith the use is not authorised. We remove infringing material promptly on a valid notice.
If your material was removed and you believe that was wrong, send a counter-notice and we will review it.
How we decide
Automated scanning flags most abuse — file signatures, brand strings in new uploads, sudden outbound traffic changes. A person reviews anything before an account is removed, except for the immediate-removal categories above, where speed matters more than process.
If we suspend your account you get an email saying what we found and what happens next. If we made a mistake, reply and say so. We do get it wrong sometimes, and an appeal reaches a human.