Hosting a business website: what to pay for and what to skip

Hosting is the part of a website nobody thinks about until it goes down, gets hacked or slows to a crawl during the one sale that mattered. The cheapest plans look identical to the expensive ones on a pricing page. The differences show up at the worst moment.

What is worth paying for

• Performance where your customers are. A server close to your audience, server-side caching and a CDN for images and assets. Most business sites need a CDN far more than a bigger server.
• Automatic backups you have tested. Daily, kept off the server, with a restore you have actually tried. A backup nobody has restored is a hope.
• Security by default. TLS, a firewall, malware scanning, isolated accounts, and updates applied promptly. Shared hosting where one compromised site can reach yours is a false saving.
• A staging copy. Somewhere to test updates before they reach customers.
• Support that answers. At three in the morning during a campaign, a ticket queue with a 48-hour response is the same as no support.
• Room to grow. Resources you can increase in minutes when traffic spikes, without migrating.

What is mostly marketing

"Unlimited" storage and bandwidth on plans with strict hidden limits; dozens of one-click apps you will never install; free domains that cost more at renewal; and uptime percentages with no compensation behind them. Read the fair-use policy before the feature list.

Managed or self-managed?

Self-managed cloud servers are cheaper per unit of power and need someone who knows how to patch, monitor and recover them. Managed hosting costs more and buys you that person. For most businesses whose website earns money, managed is cheaper once you count the hours — and the outage you avoided. We run STILE's catalogue on managed cloud hosting with an enterprise CDN layer and year-long static asset caching, because a tile catalogue with thousands of products cannot afford slow pages.

Email does not belong on the web server

Put company email on a dedicated provider, not on the same box as the website. If the site is attacked or the server is blacklisted for spam, you do not want your sales team's inbox going down with it. Set up SPF, DKIM and DMARC while you are there; it keeps your messages out of spam folders.

Speed is a hosting decision too

A well-built site on poor hosting is still slow. Page caching, HTTP/2 or HTTP/3, compression, and a sensible cache policy for images and scripts do as much for Core Web Vitals as any code change. Ask your host which of these are switched on, and check.

Data and compliance

Know where your data is stored, who can access the server, and how long backups are kept. If you serve customers in the UK, EU or Canada, those answers belong in your privacy documentation — see the privacy checklist.

A sensible way to decide

1. How much does an hour of downtime cost you? That sets your budget.
2. Where are your customers? That sets the region and whether you need a CDN.
3. Who will patch and monitor it? That decides managed versus self-managed.
4. Can you get your data and site out easily? Avoid hosting you cannot leave.

We set up and run hosting for the sites we build and for some we did not. See cloud and hosting and IT infrastructure, or tell us what you run today.