Acceptable Use Policy

Last updated: October 27th, 2026

This Acceptable Use Policy (“AUP”) is part of our Terms of Service and applies to everyone who uses a Last Hour Hosting service, and to your own customers and end users. It exists so that one customer cannot degrade or endanger the service for everyone else.

It is written to be specific. Where a rule below has a limit, the limit is a number. Where we can warn you first, we will. Section 12 explains exactly how we enforce this policy and how you can appeal.

1. Use the service lawfully

Do not use the Services for anything illegal or tortious, and do not use them to harm anyone. That includes transmitting, storing, or publishing content that is unlawful where you or your readers are, or that infringes someone else's rights.

Specifically prohibited:

• Child sexual abuse material — zero tolerance. We remove it immediately, terminate the account without notice, preserve the minimum records required by law, and report it to the National Center for Missing & Exploited Children's CyberTipline as 18 U.S.C. § 2258A requires. We also report content that solicits or lures a minor.
• Content that sexualizes minors in any form, including illustrated or generated material.
• Fraud, phishing, pharming, carding, card-testing, advance-fee schemes, Ponzi and pyramid schemes, high-yield investment fraud, and fake storefronts.
• Malware, ransomware, botnet command and control, exploit kits, and droppers.
• Non-consensual intimate imagery, and content posted to harass or stalk a specific person.
• Trafficking, sale of illegal goods, and the sale of stolen data or credentials.
• Unauthorized practice of a regulated profession, and content that gives individualized medical, legal, or financial advice where you are not licensed to give it.

Adult content. We do not host pornography. Legal adult content that is not pornography and not prohibited above may be hosted if it is age-gated, clearly labelled, lawful in the jurisdiction it is served to, and does not involve non-consensual acts. If you are unsure whether your content qualifies, ask us before you upload it: abuse@lasthourhosting.org.

Gambling and lotteries. Prohibited unless you hold the licence required in every jurisdiction you serve and have told us in advance.

2. Keep your account and your software secure

You are responsible for securing what you run. That includes keeping the applications, plugins, themes, and operating-system packages you control up to date, using strong credentials, and not leaving default administrator passwords in place. An outdated plugin that gets compromised and starts sending spam is your responsibility, and it will get your service suspended.

Prohibited:

• accessing or attempting to access any system without authorization, including port scanning, vulnerability probing, and brute-forcing credentials;
• intercepting or monitoring traffic you are not a party to;
• forging packet headers, mail headers, or sender identity;
• operating an open mail relay, open proxy, or open recursive DNS resolver;
• circumventing authentication, rate limits, spend caps, quotas, or other technical controls.

Testing the security of your own service is fine. Testing anyone else's, including ours outside the scope of our Security Policy, is not.

3. Do not attack the network

Prohibited activity includes:

• denial-of-service attacks, and any flooding, amplification, reflection, or mail-bombing technique;
• operating DDoS-for-hire or stresser services, or “booter” services;
• cryptocurrency mining, including CPU and GPU mining, on any shared or VPS service;
• deliberately overloading shared infrastructure, or using automated tools that ignore robots.txt or rate limits;
• misusing the Bring Your Own IP or BGP features, including hijacking, parking unrelated prefixes, or announcing routes disproportionate to the services you actually run with us;
• reselling or subletting IP space, DNS, or any service capacity except under a written reseller agreement.

4. Publishing and platform responsibilities

If you run a platform that lets other people post — a forum, a marketplace, a comment section, a multi-tenant app — you are responsible for moderating it. You must:

• publish your own acceptable-use terms for your users that are at least as protective as this AUP;
• respond to abuse reports about your users, and remove content that breaches this AUP;
• keep a record of repeat infringers and terminate them, as our Copyright Policy describes;
• not knowingly allow your platform to be used to distribute the prohibited content in section 1.

We may hold you responsible for your users' conduct under your Terms of Service, because from our side you are the customer.

5. Email and messaging

All email is subject to the Anti-Spam Policy. In addition:

• Outbound mail limits: 500 recipients per hour and 3,000 per day per domain on shared hosting. Above that, contact us for a sending plan. We do not bill you for going over — we contact you — but sustained sending above the limit without a plan will be throttled.
• Bulk mail requires confirmed opt-in, a working one-click unsubscribe, and a List-Unsubscribe header. Keep bounce and complaint rates below 2% and 0.1% respectively.
• Cold outreach is permitted only where the law allows it in the recipient's jurisdiction, and never with a forged or misleading sender.
• Do not send from a domain you do not control, and do not set a From or Reply-To that does not exist.
• Automated calling and texting (including robocalls and autodialers) is prohibited unless you hold the consents and registrations the TCPA and equivalent laws require, and you tell us in advance.

6. Resource and bandwidth limits

Every plan has published limits. We apply them so that one account cannot degrade another. Our current limits on shared hosting are:

Resource	Shared hosting limit	What happens above it
Bandwidth	1 TB per month (soft)	We contact you about an upgrade. No overage billing.
CPU	2 vCPU sustained; 100% burst for 10 minutes	Processes are throttled, then we contact you.
Memory	1 GB per site	Processes are throttled or restarted.
Disk	20 GB SSD per plan	Writes are refused once full; we never delete your data.
Inodes	200,000 per plan	Writes are refused once full.
Concurrent connections	100 per site	Excess connections are queued or dropped.
Cron jobs	5 concurrent	Additional jobs wait.
Database size	2 GB per database	We contact you about a migration.
Mailboxes	Plan-dependent	Fair use; the per-mailbox quota is shown in your control panel.

VPS plans have the resources stated on the plan page and are not oversubscribed beyond what the plan says. Where a plan is described as unmetered, that means we do not meter it for billing — it does not mean the network is unlimited, and the Fair Use Bandwidth Policy still applies.

We will give you at least 14 days' written notice before reducing a published limit for an existing customer, and the change will not apply to a term you have already paid for.

7. Privacy of others

Do not:

• collect, harvest, scrape, or sell personal information of others without a lawful basis and the consents the law requires;
• publish someone's home address, phone number, or other private information without their consent (doxxing);
• use our services to stalk, monitor, or track another person without their informed consent;
• upload a data set that includes personal information you did not have the right to collect.

If you handle personal data, you must tell people what you collect and why, and honour their rights. If you need a data processing agreement with us, see our Data Processing Addendum.

8. Intellectual property

Do not upload or share material you do not have the right to distribute. Do not falsify author attribution, legal notices, or proprietary notices. Do not mirror or proxy another site to avoid its traffic or licences.

We respond to copyright complaints under the Copyright Policy. We terminate the accounts of repeat infringers.

9. Sanctions and export controls

You may not use the Services if you are on a US, EU, UK, or UN restricted-party list, or if you are located in a comprehensively sanctioned country or territory. You may not use the Services to export or provide technical data in breach of export-control law. We screen accounts and payments, and we will close an account that matches.

10. Regulated data

We do not accept protected health information unless you have a signed Business Associate Agreement covering the service you use. See HIPAA and Business Associate Agreements. If you need to handle cardholder data, GLBA, FERPA, CJIS, or ITAR data, contact us before you sign up so we can tell you whether the service is suitable. If it is not, using it anyway is a breach of this AUP.

11. Reporting abuse

Report abuse to abuse@lasthourhosting.org, or use the form at lasthourhosting.org/contact. For copyright, follow the Copyright Policy, which has the exact elements a valid notice needs. For security vulnerabilities, use the Security Policy.

Include the URL, a timestamp with a time zone, and what you observed. We acknowledge abuse reports within one business day and aim to act on reports involving active harm within four hours. We will tell you the outcome unless you ask us not to, and we will not reveal who reported something.

12. How we enforce this policy

Except in the urgent cases below, we follow a ladder so that an honest mistake does not end your business:

1. Notice and cure. We tell you what the problem is and give you a reasonable time to fix it — normally 72 hours, longer where a cleanup genuinely takes longer (a compromised site, a mailing list to purge).
2. Throttle. If the problem is load, sending volume, or connections, we rate-limit the affected service first, which usually solves it without downtime.
3. Suspend. If the problem continues, we suspend the affected service. Billing pauses while a service is suspended for a violation. We keep your data and you can export it.
4. Terminate. If a violation recurs after a suspension, or is severe, we terminate the affected service or the account.

Urgent cases, where we act immediately without warning: child sexual abuse material; an imminent risk of serious harm to a person; an active attack, phishing campaign, or malware distribution coming from your service; a legal obligation to act immediately (court order, valid DMCA notice, lawful preservation or disclosure demand); or a sanctions or export-control violation.

Reasons and appeals. Every enforcement action carries a machine-readable reason code that you can see in your portal, and an appeal link. An appeal is reviewed by a person who was not involved in the original decision. If we got it wrong we restore the service, we do not charge you for the suspended period, and we say so in writing.

Repeat infringement. We keep a strike record. Two valid copyright notices in 12 months triggers a mandatory review; three triggers termination. See the Copyright Policy.

13. Monitoring, and what we do with what we find

We do not read your content for our own purposes. We do monitor the network for abuse signals — outbound spam volumes, attack traffic, malware signatures, and reports from other networks — and we investigate when a signal points at your service. When we investigate we look at the minimum necessary to confirm or clear the report, and the access is logged.

We may remove or restrict access to content that breaches this AUP. We are not liable to you or your end users for removing content in good faith, or for leaving content up when we did not know about it. We cooperate with law enforcement and report suspected criminal activity as our Privacy Policy describes.

14. Changes to this policy

We may update this AUP. We post the new version here, update the date, and email account holders at least 14 days before a change that would make previously acceptable conduct a violation. Continuing to use the Services after that means you accept the new version.