Hosting is one of those decisions you make in five minutes based on price, and then live with the effects for several years. When the company website goes down in the middle of a campaign, or email starts landing in spam, it turns out the cheapest plan was not the cheapest after all. In this guide I collect what is really worth looking at before you sign.

Start with what you are hosting

Before you compare offers, answer a simple question for yourself: what is going to live there. You choose hosting differently for a business card site, differently for a shop, and differently again for an application with a database.

  • A company website or blog. Stable shared hosting with good support is enough.
  • An online shop. What counts is database performance, an SSL certificate and resilience to peak traffic.
  • An application or internal system. Usually you need a VPS or a dedicated server with full control over the environment.
  • Company email. That is a separate topic where server reputation and correct record configuration are key, which we cover in the article on email deliverability.

The parameters that really matter

Availability and SLA

The advertised 99.9 percent sounds good until you work out that it is still several hours of downtime a year. Check whether the provider even declares an SLA in writing and what happens when they fail to meet it. The absence of any guarantee is a warning sign.

Performance, not just capacity

Offers tempt you with hundreds of gigabytes of space, even though a typical company website takes a fraction of that. More important are the parameters the ads stay silent about:

  • the type of disks (SSD or NVMe rather than old platters),
  • CPU and memory resource limits on a shared account,
  • the versions of PHP and the database, and whether they can be updated,
  • the location of the data centre, because it affects response time.

Backup on the provider’s side

Ask directly: how often do you make copies, how long do you keep them and how long does a restore take. A backup once a day is something different from once a week. And keep in mind the principle of limited trust here. A copy at the provider is convenient, but your own independent backup of critical data is a standard I recommend to everyone.

I have seen a company lose its shop because the hosting provider deleted the account over an overdue invoice, and the only copy was right there. A backup that sits solely with the same provider as the data is, in practice, not a separate backup.

Security and compliance

Hosting stores data, often including customers’ personal data. That means it is subject to GDPR requirements, and the provider becomes a processor.

  1. A data processing agreement. Check whether the provider signs a data processing agreement.
  2. Data location. Servers in the European Union simplify compliance matters.
  3. An SSL certificate. It should be standard, ideally renewed automatically.
  4. Protection against attacks. Ask about DDoS protection and a basic web application firewall.

Technical support, the hidden cost

The price shown in the price list is not everything. The real cost of hosting reveals itself on the day of an outage. Pay attention to:

  • the hours and channels of support (whether there is real contact beyond email),
  • the language of support, because a problem explained in a foreign language takes longer,
  • the response time to a request,
  • whether support will help when the problem lies with the site rather than the server.

In many companies the most sensible model is a combination of stable business hosting with external care of the site itself. Then one partner is responsible for the infrastructure and another for the application working and being kept up to date.

Shared hosting, VPS or dedicated

The choice of hosting type is the most common source of overpaying in both directions. Some take a dedicated server for a simple business card site, others cram a demanding shop onto the cheapest shared account. A simplified map looks like this:

  • Shared hosting. The cheapest, good for company websites and small shops with moderate traffic. You share the server resources with others, so a neighbour generating heavy traffic can slow you down.
  • VPS. Dedicated, guaranteed resources and full control over the environment. A sensible choice for shops, applications and companies that want to grow.
  • A dedicated server. The whole machine is yours. It makes sense with heavy traffic, demanding applications or particular security requirements.

Match the resource to your real needs, not to the most pessimistic scenario that may never happen. It is always easier to migrate to a stronger plan than to explain to the board why we are paying for power we do not use.

The contract and what lies between the lines

Before you sign, read the terms on renewals and limits. A common trap is a low price for the first year and a sharp increase on renewal. Also check whether the limits on traffic, the number of email accounts and databases match how you actually work. The advertising slogan of unlimited usually means a limit described in the small print of the terms.

A simple list of questions before signing

  • What SLA, and what happens if it is not met?
  • What does the backup look like and how long does a restore take?
  • Do you sign a data processing agreement and where do the servers stand?
  • How easy is it to move to you and away from you?
  • What does support look like on the day of an outage?

The last question, about the possibility of migration, is more important than it seems. A provider that makes leaving difficult is usually counting on convenience covering up poor quality. If you are planning to change hosting or are only just choosing your first provider, it is worth going through this list calmly. We will gladly help you pick a solution that fits what you are actually hosting, and move the data without downtime.