Website hosting for a small business: what you are paying for.

Domain, hosting and email: three bills

Three separate things sit behind a business website, and each can come from a different company:

• The domain is your address, such as yourbusiness.com. You rent it from a registrar and renew it every year or every few years.
• The hosting is the computer that stores the website and sends it to every visitor, plus the company that keeps that computer running, updated and backed up.
• The email service holds your mailboxes. It can be Google Workspace, Microsoft 365, the mail included with a hosting plan, or another service.

The domain's DNS settings tie them together: one set of records points the address at the hosting, another points your email at the email service. Picture a cleaning company that pays a registrar for the domain, a website builder for the site and Google for its mailboxes. Three bills and three logins, and if the website builder is ever cancelled, the email keeps working.

Sometimes there is a fourth piece: the DNS host, where those records live. It is usually the registrar, but it can be the web host or a service such as Cloudflare. Whoever holds it can point your website and email anywhere, so it belongs in the business's name too.

Buying all three from one company is simpler to pay for and harder to leave. Before you cancel any hosting plan, check whether your mailboxes live on it, because they can go with it.

The kinds of hosting

Hosting comes in a few shapes, and the right one depends on how the site is built:

• A website builder plan, such as Wix, Squarespace or Shopify. Hosting is part of the subscription, and the platform keeps its servers updated. The trade-off is that the site lives on that platform: a Wix site, for example, cannot be moved to another host.
• Shared hosting. Many sites share one server, which keeps the price down. You, or whoever looks after the site, keep WordPress or any other software on it updated.
• Managed WordPress hosting. The host takes on more of the work for sites built on WordPress, typically updates, backups and caching. Ask exactly what managed covers, because it varies from host to host.
• A virtual or cloud server of your own. More control and more work, worth it when a developer needs it for a web app or a busy store.
• Static hosting. The site is plain files with no software running behind it, so there is little to update or attack. Services such as Netlify and Cloudflare Pages host this kind of site. GitHub Pages, another one, says it may not be used as free hosting to run an online business.

Some studios also host their clients' sites on their own account as part of a monthly plan. That works when the contract says what you take with you if you leave.

Which kind fits your site

Start from the site, not from the hosting offer:

• A salon with five pages and a booking button: a website builder plan, or static hosting if a studio builds it. There is nothing for a bigger server to do.
• An accountancy practice that publishes articles every week, with three people editing: WordPress on managed hosting.
• An online store with a few hundred products: Shopify, or WooCommerce on managed hosting with frequent backups.
• A customer portal or a booking system with logins: whatever the developer recommends, usually a server or cloud platform they can manage.

Do not pay for power the site will not use. When a small business site is slow, the usual causes are large images, heavy plugins and widgets from other companies rather than the server, as PageSpeed Insights explained shows.

Backups you can restore

Every host says it takes backups. These questions tell you whether they will help on a bad day:

• How often are copies taken, and how long are they kept?
• Are they stored away from the server they protect?
• Do they include the database as well as the files, and the email if the host runs it?
• Can you restore one yourself, or do you have to ask support, and is there a charge?
• Can you download a full copy to keep somewhere the host does not control? If the account is ever suspended or the host fails, that copy is your website.
• What happens to the backups when you cancel?

Then test one. Restore a backup to a copy of the site once, so you know it works before the day you need it.

Support when something breaks

Find out who answers, how and when, before you need them:

• The channels, such as phone, chat or tickets, and the hours each one is staffed.
• What they will fix. Many hosts look after the server and stop at your own software, so a broken plugin is your problem, or your developer's.
• Whether they help after a hack. Google suggests asking your host whether it offers help cleaning up a hacked site.
• Where they post outages, so you can tell a host problem from a site problem.

A host that answers during your working hours is worth more to a small business than one with more storage. If your site earns money every hour, as a store or a booking site does, test their support with a question before you buy.

Where the data is kept

Even a small site holds personal data: form enquiries, orders, customer accounts and the server's own logs of visitors. In Europe that makes the host your processor under the GDPR, and the GDPR requires a contract with it, usually called a data processing agreement. Check that your host has one, ask for it if you cannot find it, and keep a copy.

Ask where the servers are. Many European businesses choose a host with servers in Europe. If the data is stored outside the European Economic Area, ask the host what legal basis covers the transfer, and ask your adviser whether that is enough for you. The GDPR checklist for small business websites covers the rest of what to check.

Location affects speed a little too, since a server near your customers answers faster, though it matters less than images and plugins.

Security that should come with the plan

• A free certificate for https, renewed automatically. If the host cannot provide one, move. Why your website says not secure explains what goes wrong when renewal fails.
• Current software on the server. WordPress, for example, recommends PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer. Ask what the host runs and how it handles upgrades.
• Separation between accounts on a shared server, so a hacked site next door cannot reach yours.
• Two-step verification on the hosting account.
• A way to give your developer a login of their own, rather than sharing yours.

Firewalls and malware scanning are useful extras for WordPress sites. For a static site with no login, they add little.

The renewal price, and what costs extra

Hosting is often sold with a low price for the first term and a higher one at renewal, especially when you prepay for several years. Read the renewal price before you compare. A long prepaid term also ties you in: if the host disappoints in month three, you have already paid for years you may not use.

Then check what the quoted plan leaves out. These are often extra:

• Backups kept longer than a few days, or restores done by support.
• Email mailboxes.
• A staging copy of the site for testing changes.
• Moving an existing site in.
• More storage, or more visitors than a cheap plan allows.

For what a monthly plan covers line by line, hosting included, see what website maintenance covers.

Whose account it is in

Hosting in your own account means you can give access, take backups and move host without asking anyone. Hosting in a supplier's account can be fine, as long as you know three things in writing: who pays the host, what you receive if you leave, and how quickly you receive it.

Ask before you sign, not after a falling out. If a past supplier holds your hosting and will not hand it over, start with how to get your website back from a web designer.

Our own monthly plans include hosting, updates and backups, and the domain, site and accounts stay yours if you stop, as the prices page says.

When you do not need to choose hosting

Often you never pick a host at all:

• On a website builder, hosting comes with the plan. Comparing hosts would mean comparing something you cannot change.
• When a studio builds and looks after the site, the hosting is usually part of its plan. Your job is to check the backups, the support and what you keep, not the server.
• If all you need for now is a booking page, the booking tool's own page may be enough until you need a site.

So the real choice is usually the platform or the supplier. Wix, Squarespace or WordPress helps with the first. For the second, our websites page sets out how we work, including that hosting and support are agreed as part of the project.

Signs it is time to move host

Moving host takes care, so do it for a reason. Good reasons:

• The host cannot give you a free certificate that renews itself, or current versions of the software your site needs.
• Support does not answer, or answers without fixing anything.
• A backup could not be restored when you needed it.
• Your uptime monitor shows the site going down again and again, and the host's status page shows nothing.
• The account keeps hitting limits on a plan the site has outgrown, such as a store that has grown its catalogue.
• The renewal price has jumped and a like-for-like plan elsewhere covers the same things.

A bad reason is a slow site that is slow because of large photos and plugins. The new host serves the same heavy pages, and nothing changes until the pages do.

Moving to a new host

Plan the move around your email, because that is what customers notice first when it breaks. The order:

• Take a full copy of the site, files and database, and keep it outside both hosts.
• Set the site up at the new host and test it at a temporary address.
• A day before the switch, lower the time to live on the website's DNS records.
• Change only the website records, the A and CNAME records. Leave the MX records and the other email records alone, unless email is moving too.
• Test the site, every form and an email in each direction.
• Keep the old hosting running until everything has worked from the new host, then cancel it.

If your email sits on the old hosting, move the mailboxes to a separate service first, as how to set up a business email address explains. If the domain itself is moving to a new registrar, how to transfer a domain covers that part.

Questions to ask before you pay

• Is the account in my business's name, and can I add my developer as a separate user?
• How often are backups taken, where are they kept, and can I restore and download them myself?
• Who answers when the site is down, how, and at what hours?
• Is a certificate included and renewed automatically?
• Where are the servers, and is there a data processing agreement?
• What does the second year cost, and what is extra?
• What do I receive, and in what form, if I leave?