As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when accessing recently a not-so-unpopular hosting provider based in UK which has the word "secure" mentioned in large on the home page:
The default administrative account is created with a terrible password: five lowercase and digits only characters, no uppercase, no symbols.
The password is displayed in several locations in the administration panel, which is a good sign that it's saved in plain text in the database.
This administrative account is used to access everything: FTP, MySQL and the administration panel itself (including personal information, invoices, etc.).
It is impossible to create additional accounts, which forces the customer to give the same administrative password to any freelancers who work on the project (giving them unlimited access to everything).
The MySQL database can be accessed from anywhere, not just locally. This behavior cannot be changed.
There is no audit.
Nothing helps or invites the customer to do regular backups.
The hosting uses PHP 5.2.4, a version released on August 30th, 2007 and cannot be upgraded to a more recent version. For those who are unfamiliar with PHP, the language has frequent updates due to lots of security issues discovered regularly, and running a website in 2012 even with the version released in 2011 is a very bad idea.
My experience with other well-known hosting companies in UK, USA and France is similar. Some are slightly better, security-wise, but too many are doing everything they can to enforce worst practices. Then, they claim being secure and easy to use, which gives the feeling that the customer can rely on the hosting provider for everything related to security.
What should be the professional response from a developer to the customer regarding such hosting companies?
As a developer who have a duty to inform the less technologically knowledgeable customers about the risks they encounter, what should I do?
Saying shortly that the hosting provider sucks because it's not secure is not a solution: if the hosting provider is not unpopular, the customer will trust the large hosting company, rather than some freelance developer.
Explaining in details every aspect of security and risk management wouldn't help neither, since it would be too long and boring for the customers to read. Spending hours reconfiguring stuff would be frightening for them too.