How to choose web hosting
Hosting decides how quickly your pages load, how your site copes with a busy day and how hard recovery is when something breaks. The right plan depends less on the feature list than on what your site runs and who will look after it.
The main hosting types
Plans differ mainly in how much of a server you get and how much of the upkeep falls on you. A brochure site or blog rarely needs more than good shared or managed hosting, while custom applications and busy online stores are where VPS and cloud plans earn their cost.
- Shared hosting: many sites on one server, cheap and simple, though busy neighbors can slow you down.
- VPS: a virtual private server with reserved resources and root access, maintained by you unless the plan is managed.
- Dedicated server: an entire physical machine, with the most control and the most responsibility.
- Cloud hosting: virtual servers and services billed by usage, which scale quickly but make bills harder to predict.
- Managed WordPress: servers tuned for WordPress, with updates, caching, staging and backups handled by the host.
- Static hosting with a CDN: prebuilt pages served from many locations, fast and inexpensive, with little server software to attack.
Sizing what you really need
Plans advertised as unlimited still cap CPU, memory, simultaneous processes and often the number of files, and an acceptable use policy covers the rest. Find those limits in the plan details rather than the headline.
Start from your current numbers: monthly visitors, the busiest hour, database size and total file size, plus room to grow. A dynamic site’s load depends on how many uncached pages it builds at once, so page caching or a CDN often does more for speed than doubling the plan.
- Which software and versions does the site need?
- How many visitors arrive in the busiest hour?
- How large are the files and database, and how fast are they growing?
- Who will apply updates, watch for problems and restore backups?
A checklist before you pay
Compare hosts on the things that hurt when they go wrong. An uptime commitment of 99.9 percent still allows about 43 minutes of downtime in a 30-day month, and when a host misses its target, the usual remedy is a credit toward future bills rather than compensation for lost business.
- Backups: how often they run, how long they are kept, where they are stored and whether you can restore them yourself.
- TLS certificates: free, automatically renewing certificates such as those from Let’s Encrypt should be standard.
- Runtime versions: current, supported releases of PHP and other languages, with an easy way to switch.
- Support: response times, channels and whether staff can troubleshoot rather than read from a script.
- Data center location: close to your visitors and suited to any data rules you must follow.
- Renewal price: the rate after the introductory term, compared over three years rather than one month.
Why email belongs elsewhere
Most plans include mailboxes, but running email on the same server as your website ties two critical services to one point of failure. If the site is compromised and sends spam, the server’s reputation drops and your everyday business mail can start landing in junk folders or bouncing.
A dedicated email service generally brings better spam filtering, deliverability, storage and security controls, and it lets you change web hosts later without migrating mailboxes. DNS records then send web traffic to one company and mail to another, so each can change independently.
Security questions to ask
On shared servers, your safety depends partly on how well the host keeps accounts apart, so ask how sites are isolated and what happens when a neighbor is infected. The host secures the platform, but your application is still yours to patch. A backup you have never restored is a guess, not a plan.
- A web application firewall that filters common attacks and abusive bots.
- Account isolation, so each site runs under its own user with its own limits.
- Prompt updates to the operating system and server software.
- Two-factor login for the control panel and the billing account.
- Malware scanning and offsite backups you have test-restored.
- Plugins and themes kept current on your side, with unused ones removed.
A migration plan that avoids downtime
Moving a site is low-risk when you work in order and keep notes. Schedule the switch for a quiet period, and don’t cancel the old plan until the new one has proved itself.
- Take a full backup of files, databases and settings, and keep a copy off both hosts.
- Build a staging copy on the new host and preview it through a temporary address or your computer’s hosts file.
- A day or more ahead, lower the TTL on the DNS records you will change.
- Test forms, logins, checkout, scheduled jobs and redirects on the new server.
- Freeze edits, copy the final data and point DNS at the new host.
- Keep the old host running for a week or two, then raise the TTL again.