Web Hosting: A Complete Guide for Buyers

What web hosting actually is and what you're paying for

Web hosting is the business of renting out space on a server that is connected to the internet 24 hours a day. That server is a physical computer, usually running Linux or Windows Server, with its own IP address. When someone types your domain name into a browser, DNS translates that name into the server's IP address, and the server sends back the files that make up your website. Without hosting, your website files sit on your local machine and nobody can reach them.

So what are you actually paying for? At its core, a hosting plan gives you a slice of server resources. Those resources include central processing unit (CPU) time, random-access memory (RAM), disk storage (usually SSD or HDD), and network bandwidth (the amount of data that can be transferred to and from your site each month). The plan also covers the electricity, cooling, physical security, and network connectivity that keep the server running. You are paying for the facility (a data center) and the staff who maintain it.

Beyond raw resources, your payment buys a level of management. Shared hosting providers handle server software, security patches, and basic support. VPS and dedicated plans may give you root access, but you might pay extra for managed services where the provider updates the kernel and installs security updates. You also pay for any bundled software: cPanel or Plesk control panels, automatic backup tools, staging environments, or SSL certificates.

IP addresses matter too. Most shared plans place your site on an IP address used by many other customers. That works fine for most sites, but if a neighbor runs a spammy site, email reputation can suffer. A dedicated IP address (often a paid add-on) fixes that and is required for some SSL certificate types.

Every host allocates resources differently. Overselling is common in shared hosting: the provider counts on the average customer using far less than their plan limit, so they can pack 500 accounts onto one server. That works until a neighbor's traffic spike slows down your site. Understanding these tradeoffs is why reading the fine print on resource limits and overselling policies matters.

Shared hosting: the cheapest tier and its real tradeoffs

Shared hosting is the entry level of web hosting. Your site lives on a server that hosts dozens, sometimes hundreds, of other websites. The provider manages the operating system, web server software (typically Apache or Nginx), and the hardware. You only manage your own files, databases, and email accounts. Prices range from $2 to $10 per month. That low cost is the only reason to choose shared hosting.

The tradeoff is performance. All tenants on a shared server compete for CPU, RAM, disk I/O, and network bandwidth. If one neighbor runs a WordPress site with a poorly optimized plugin that spikes CPU to 100%, your site slows down or times out. Providers mitigate this with resource limits: a typical plan caps you at 1 or 2 CPU cores, 1 to 2 GB of RAM, and 25 to 50 concurrent processes. But these limits are soft. Many hosts oversell aggressively, betting that most customers never use their full allocation.

Security risks you cannot control

On a shared server, a vulnerability in any tenant's application can affect you. If a neighbor's WordPress installation gets compromised, an attacker might escalate privileges and read your files. The provider should enable open_basedir restrictions and disable dangerous PHP functions like exec(), system(), and shell_exec(). But not all hosts do. Check your host's PHP hardening policy before signing up. The safest shared hosts run each account under a separate Unix user with a unique UID and use PHP-FPM with per-pool settings.

What you actually get

A shared hosting plan includes a control panel (cPanel, Plesk, or a proprietary panel), FTP or SFTP access, one or more databases (usually MySQL or MariaDB), and a web-based email system. Disk space is almost always SSD now, but the advertised number (e.g., 50 GB) is often shared across all accounts on that server. Bandwidth limits are similarly soft. Most shared hosts offer a one-click installer for WordPress, Joomla, or Drupal. You also get a free Let's Encrypt SSL certificate, which is essential for HTTPS.

Shared hosting is fine for a personal blog, a small business brochure site with fewer than 5,000 monthly visitors, or a staging environment. It fails when you need predictable performance, custom software, or any kind of isolation. If you run e-commerce with real-time inventory, a membership site with concurrent logins, or any application that processes user data, shared hosting is a bad fit. The cost savings disappear when you factor in lost sales from slow page loads or downtime.

If you do choose shared hosting, pick a provider that publishes its resource limits clearly. Avoid any host that says "unlimited" without listing specific caps on CPU, inodes, or database connections. That phrase usually means the limits are enforced after you complain, not before.

VPS hosting: dedicated slice of a shared machine

A Virtual Private Server (VPS) sits between shared hosting and a dedicated server in both cost and capability. It uses a hypervisor to partition a single physical machine into multiple isolated virtual machines, each running its own operating system. You get a dedicated slice of CPU, RAM, and disk. The hypervisor enforces resource boundaries, so a noisy neighbor who runs an ecommerce flash sale won't starve your Apache processes for memory.

The two dominant virtualization platforms are KVM (kernel-based virtual machine) and OpenVZ (container-based). KVM gives you full hardware virtualization. You can run any OS the kernel supports, load kernel modules, and set custom iptables rules. OpenVZ is lighter weight, sharing the host kernel, but that means you can't run a different kernel version or use filesystems like XFS. For most buyers, KVM is the better choice. Avoid providers who won't tell you which they use.

The practical difference from shared hosting is measurable. On a VPS you control the firewall, the PHP version, the MySQL configuration. You install the stack yourself or let a managed plan handle it. You can set pm.max_children in php-fpm to match your memory budget. A shared plan would boot you for abusive configuration that steals resources from neighbors.

Memory is the real constraint on a VPS. A 1 GB RAM VPS can handle a small WooCommerce store or a mid traffic WordPress blog with caching. A 4 GB RAM VPS runs GitLab, multiple Node services, or a staging environment for development teams. Disk is usually SSD based now, but check whether the provider uses NVMe or SATA SSD. The difference shows in database IOPS.

Unmanaged VPS plans start around $5 per month from providers like Linode, DigitalOcean, Vultr, and Hetzner. Managed plans from companies like Liquid Web or known hosts start around $20 per month and include OS patching, monitoring, and control panel licensing (cPanel or Plesk). The gap reflects labor. You pay for sysadmin hours you don't have.

Scalability is a genuine advantage here. You can resize your VPS from 2 GB to 4 GB RAM with a reboot, sometimes a live resize if the hypervisor supports it. Shared hosting requires a plan migration. Dedicated servers require moving data to new hardware or paying for a rebuild.

Dedicated servers: when bare metal still wins

A dedicated server is exactly what it sounds like: one physical machine, entirely yours. No neighbors. No hypervisor dividing up CPU cores or memory. You get the full hardware stack, from the motherboard to the network interface cards. This matters for workloads that need consistent performance, low latency, or hardware-level access. Think database-heavy applications, high-traffic ecommerce stores, video encoding pipelines, or any scenario where virtualization overhead becomes a measurable drag.

On a VPS, you share the host's CPU caches, memory bandwidth, and I/O channels. Even with a good provider, the hypervisor (KVM, Xen, or VMware) introduces a small but real performance penalty, typically 2 to 10 percent depending on the workload. With a dedicated server, that overhead vanishes. The OS talks directly to the hardware. You can tune kernel parameters, pin processes to specific cores, use huge pages for memory, and install any driver or module without asking permission.

What you actually get

A modern dedicated server often ships with an Intel Xeon Scalable 4th Gen processor (up to 60 cores) or an AMD EPYC 9004 series (up to 128 cores), 64 GB to 2 TB of DDR5 RAM, and NVMe SSDs in RAID. Network connectivity is typically 1 Gbps or 10 Gbps unmetered, with the option to add a second NIC for failover. You also get out-of-band management via IPMI or iLO, which lets you reboot the machine, mount install ISOs, and see the console as if you were sitting in front of it.

Run lscpu on a dedicated box and you see every core, every thread, no steganographic hiding. cat /proc/cpuinfo returns the real CPU model, not a virtualized approximation.

When bare metal beats virtualization

Dedicated servers make sense when your workload is predictable and heavy. If you know you need 32 cores and 128 GB RAM around the clock, a dedicated server will almost always be cheaper than a VPS with the same specs (cloud providers charge a premium for elasticity). You also avoid the noisy neighbor problem: a VPS neighbor hammering disk I/O can tank your own application performance. On bare metal, the only noise is yours.

PCIe passthrough is another differentiator. Want to attach a GPU for machine learning or video transcoding? A dedicated server lets you install a physical card. Virtualization can do GPU passthrough too, but it's fiddly and not always offered by hosting companies. On bare metal, you plug in the card, install the driver, and go.

The tradeoffs

Cost is the obvious one. A decent dedicated server with 32 GB RAM, a mid-range Xeon, and 1 TB storage runs $80 to $150 per month from providers like OVH, Hetzner, or So You Start. At the high end, you can pay $500+ for enterprise-class hardware with 24/7 support and hardware replacement SLAs of 4 hours.

You also have to handle hardware failure yourself. If a disk dies, the provider swaps it, but you live with the downtime unless you've set up RAID and monitoring. IPMI helps, but you still need someone to log in and diagnose. For this reason, dedicated servers are best suited to teams with at least some ops experience, or to businesses that buy managed plans where the provider handles patching and monitoring separately.

Managed vs unmanaged: who patches the kernel

The first question a buyer faces when moving past shared hosting is whether to pick a managed or unmanaged plan. The difference is not feature depth or performance ceiling. It is a division of labor. In unmanaged hosting, you get a blank server. You install the operating system, configure the web server, set up the database, and apply every security patch for the rest of the machine's life. In managed hosting, the provider does all of that. You pay a premium to offload sysadmin work.

The clearest example is the kernel. Linux distributions release kernel updates roughly every month, with critical zero-day fixes sometimes pushed within hours. On an unmanaged server, you are responsible for running apt update && apt upgrade (or yum update) and rebooting. If you skip a kernel update that closes a privilege escalation hole like CVE-2022-0847 (Dirty Pipe), an attacker who gains low-level access can become root. On a managed server, the provider runs those updates, schedules the reboot, and monitors for regressions.

Managed does not mean the provider touches your application code. A managed VPS from providers like Liquid Web or KnownHost includes base OS patching, firewall configuration, and monitoring. They will not fix a broken WordPress plugin. The provider maintains the platform; you maintain the software that runs on it. Fully managed WordPress hosts, covered in a later section, take that further by updating the CMS core and plugins.

Unmanaged hosting is cheaper. A typical unmanaged VPS from DigitalOcean, Linode (now Akamai), or Vultr costs $5 to $12 per month. The equivalent managed VPS from a provider like InMotion, A2 Hosting, or Liquid Web costs $20 to $40 per month. The price difference buys you time. A survey by the Uptime Institute found that 40 percent of data center outages are caused by human error. A managed provider removes most of those errors from your queue.

Who benefits from unmanaged? Developers who already treat servers as cattle. If you use configuration management tools like Ansible or Puppet, you can define your infrastructure as code and spin up new nodes without SSH sessions. You still have to patch the kernel, but you do it programmatically. If you run a single application with one server and you are not a systems administrator, managed is the safer bet. The kernel does not care who applies the update. But the fallout from not applying it is yours either way.

WordPress-specific hosting and why it commands a premium

WordPress powers over 43 percent of all websites, according to W3Techs. That dominance has spawned an entire subcategory of hosting built specifically for it. WordPress hosting is not just shared hosting with a one-click installer. It is a purpose-built stack optimized for the PHP and MySQL workloads that WordPress generates, and it often includes proprietary caching layers, automated updates, and security rules tuned for WordPress vulnerabilities.

The core of WordPress hosting is the caching system. A standard shared server running WordPress without a page cache might serve a single visitor request by executing 20 to 30 PHP queries and multiple database lookups. A WordPress host adds a full-page cache, often at the Nginx or Varnish level, that serves cached HTML to anonymous visitors in milliseconds. Kinsta uses the Google Cloud Platform with a custom Nginx reverse proxy cache. WP Engine runs its own EverCache system. These caches bypass PHP and MySQL entirely for most requests, which lets a single server handle thousands of concurrent visitors without buckling.

WordPress hosts also manage the PHP worker pool. Standard shared hosting often limits PHP workers to a low number, causing timeouts during traffic spikes. Managed WordPress hosts tune the PHP-FPM pool to match the typical WordPress request profile. They also enforce object caching, usually via Redis or Memcached, to reduce database load. A typical Redis hit serves a database query in under 1 millisecond, compared to 10 to 50 milliseconds for a direct MySQL query.

Security is another differentiator. WordPress is the most targeted CMS because of its market share. A managed WordPress host applies WAF rules specific to known WordPress exploits, such as the XML-RPC brute force attacks that peaked in 2014 and the REST API vulnerabilities that followed. Flywheel and Pagely both maintain custom WAF rule sets that block common attack patterns before they reach the application. Automated plugin and core updates are standard, but the better hosts test updates in a staging environment before pushing them live.

You pay for this specialization. A basic managed WordPress plan from WP Engine starts around $20 per month for a single site, compared to $5 to $10 for generic shared hosting. Kinsta starts at $30 per month. The premium covers the engineering time needed to maintain the caching layer, the security monitoring, and the support staff who know WordPress internals. If you run a WooCommerce store or a site that gets more than 10,000 visitors per day, the premium pays for itself in reduced downtime and faster page loads. If you run a single personal blog with 500 monthly visitors, generic shared hosting with a caching plugin like WP Rocket will work fine.

Reseller hosting and how white-label works

Reseller hosting is a business model rather than a distinct technology tier. A reseller buys server resources in bulk from a hosting provider and then sells smaller pieces to end customers. The reseller handles billing, support, and branding. The underlying infrastructure is typically a shared or VPS environment, but the reseller gets a control panel (like WHM/cPanel, Plesk, or DirectAdmin) that allows them to create cPanel accounts for each client. Reseller accounts usually include a fixed number of cPanel accounts, allocated disk space, and bandwidth.

White-label hosting means the reseller can rebrand the control panel, nameservers, and even technical support to their own brand. The end customer never sees the upstream provider. For example, a web design agency might offer hosting to its clients under the agency's name. The reseller sets their own prices, which often includes a large markup over the wholesale cost. Reseller plans from companies like InMotion Hosting ($15.99/month, 60 GB storage, 600 GB bandwidth as of late 2023) or HostGator ($19.95/month, unmetered storage/bandwidth) illustrate typical pricing.

The key distinction from standard shared hosting is control. Resellers are responsible for server resource allocation among their clients. If one client uses too many resources, it can affect others. Some reseller plans limit total CPU or memory to prevent overselling. Overselling, common in entry-level reseller accounts, means the provider sells more resources than the server physically has, betting not everyone uses their full limit. This works until it doesn't.

White-label features vary. Some providers let you change the brand of the control panel login page and client area. Others support custom nameservers (ns1.yourdomain.com) so clients don't see the parent company's domain. Advanced reseller plans include API access for automation, SSL certificate provisioning, and Windows or Linux options. Linux is far more common due to cost.

Who buys reseller hosting? Mostly freelancers, small agencies, and developers who want to offer hosting as a value-add service without managing servers themselves. It's not for beginners: you still need to handle customer support and basic server administration tasks like MySQL database management and email DNS records. If you want zero infrastructure work, consider managed WordPress hosting instead.

Reading hosting plans: bandwidth, storage, and overselling

Hosting plans use a handful of metrics to differentiate tiers. The three you see most often are disk space (storage), monthly data transfer (bandwidth), and the number of hosted domains or sites. Beneath those numbers lies a practice that catches many buyers off guard: overselling.

Bandwidth: the 95th percentile and the burst trap

Most shared and VPS providers quote bandwidth in gigabytes or terabytes per month. On a shared plan, 1 TB of transfer per month is common. But the provider cares less about your total bytes and more about your peak usage. Large operators measure bandwidth at the 95th percentile. They sample your port speed every five minutes, discard the top 5% of samples, and bill you on the next highest value. If you burst to 100 Mbps for a few minutes but average 1 Mbps, the 95th percentile figure stays low. If your site holds a steady 50 Mbps during a sale event, you pay for that sustained rate. Many plans call this unmetered bandwidth. Read the fine print. Unmetered means you get a fixed port speed (often 10 Mbps, 100 Mbps, or 1 Gbps) and you can use it as much as you like up to that ceiling. It is not unlimited. A provider that advertises unlimited bandwidth with a 1 Gbps port on shared hosting is almost certainly overselling the port among hundreds of accounts.

Storage: spindle vs. SSD and the inode limit

Disk space on budget hosting is rated in gigabytes. A plan might include 50 GB of SSD storage. But a second limit, often hidden, is the inode count. Inodes are filesystem metadata entries. Each file, directory, and symlink consumes one inode. A typical cPanel host limits accounts to 50,000 or 100,000 inodes. A CMS with 5,000 posts and plugins can hit 80,000 inodes easily. Exceed the limit and writes fail, even if you still have free gigabytes. Check both the GB allocation and the inode limit in your control panel before migrating a large site. Storage type matters: NVMe drives deliver 3-5x the IOPS of SATA SSDs. Avoid any plan that still uses spinning HDDs for the primary data store. Those drives belong in backup arrays, not active web serving.

Overselling: how hosts make shared plans look huge

Overselling is the practice of selling more total resources than a server physically has. A single server might have 1 TB of SSD and 32 GB of RAM. The host sells 50 accounts, each promising 100 GB of storage and 4 GB of RAM. That adds up to 5 TB of storage and 200 GB of RAM, both impossible simultaneously. The host relies on the fact that most accounts use very little: a WordPress site with 200 MB of data and 128 MB of peak RAM. Only a few accounts ever hit their limit at the same time. This works until it doesn't. A single noisy neighbor who stores 80 GB of videos or runs a vulnerable script that spikes CPU can degrade the whole server. Good hosts monitor aggregate usage and move offenders to isolated nodes. Bad hosts do nothing and your site slows down for everyone. To avoid overselling pain, look for hosts that publish a resource usage policy. If a host says "unlimited everything" on a $2.99 plan, they are overselling hard. You are better off with a host that sets modest but honest limits and enforces them.

SLAs and uptime: what 99.9% really means

Almost every hosting plan advertises an uptime guarantee. The most common number is 99.9 percent, often called "three nines." It sounds reliable. But the difference between 99.9 percent and 99.99 percent is more than just an extra digit. It translates to real downtime measured in hours per year.

Here is what each tier actually allows in a calendar year, assuming the SLA is measured monthly:

• 99.9% (three nines): Up to 8 hours and 46 minutes of downtime per year. That is roughly 43 minutes per month.
• 99.99% (four nines): Up to 52 minutes and 36 seconds per year. Under 5 minutes per month.
• 99.999% (five nines): About 5 minutes and 15 seconds per year. This is enterprise carrier-grade availability.

The 99.9 percent number is a marketing floor. Many budget shared hosts quote it, but their actual performance rarely meets it. A proper SLA is a contractual promise with a remedy if the host fails to meet the guarantee. The typical remedy is a service credit, often 5 to 10 percent of your monthly bill per 30 minutes of downtime over the threshold. Some hosts cap credits at 100 percent of one month. That means if your site is down for a full day, you might get one month free. For a critical ecommerce site, one month of free hosting is a poor trade for a day of lost sales.

The SLA wording matters. Look for the following specifics in the contract:

• Measurement window. Some hosts calculate uptime over a calendar month. Others use a rolling 30-day period. A monthly calculation can hide an outage that falls near the month boundary.
• Excluded events. Most SLAs exclude scheduled maintenance. They also exclude outages caused by your own code, DDoS attacks, or upstream network failures beyond the host's direct control. If the host defines maintenance as "reasonable notice" and notice is a tweet, your uptime guarantee is weaker than it appears.
• Credit request process. Many providers require you to file a support ticket within 7 days of the outage. If you miss the window, you get nothing. Automatic credits are rare outside enterprise plans.

Monitoring your own uptime is essential. A host's status page shows what they want you to see. A third-party monitor like Pingdom, UptimeRobot, or Checkly will give you an independent record. You should monitor from at least two geographic locations so a single network issue does not skew your data.

How to compare what the guarantee is worth

If you run a site that earns $10,000 per day, one hour of downtime costs about $417 in lost revenue. A 99.9 percent SLA allows nearly 9 hours of downtime a year, which could cost you $3,750. Paying an extra $50 per month for a 99.95 percent SLA (about 4.4 hours of allowed downtime per year) reduces that potential loss significantly. The math only works if the host actually pays out credits, but the higher tier usually comes with better infrastructure and less need to claim credits at all.

A host that refuses to publish a specific SLA or that uses weasel words like "best effort" is selling you a hope, not a guarantee. If your business depends on the site being up, read the SLA before you hand over payment details.

How to evaluate a hosting provider before you buy

By this point you know the difference between shared, VPS, dedicated, and managed hosting. You understand what those bandwidth and storage numbers actually mean, and you know that 99.9% uptime is a floor, not a guarantee. The next step is putting a prospective provider through a real evaluation. The wrong host costs you time, money, and the goodwill of your visitors. Here is how to vet one before you hand over your credit card.

Check the support channels before you need them

Open a ticket before you sign up. Ask a pre-sales question about a specific feature, like whether their VPS plans support custom kernel modules or if they allow mod_evasive on shared hosting. Note how long they take to respond. Many providers offer 24/7 live chat, but during a real outage you will not wait six minutes for a bot. Call their phone line if they have one. If you cannot get a knowledgeable human during the sales process, expect worse when you are down at 3 a.m.

Test the performance yourself

Many hosts offer a 7-day or 30-day money back guarantee. Use that window to run real tests. Deploy a simple WordPress or static site and measure time to first byte (TTFB) from multiple geographic locations using tools like webpagetest.org or curl with timing details:

curl -o /dev/null -s -w 'Connect: %{time_connect}s
TTFB: %{time_starttransfer}s
Total: %{time_total}s\n' https://yoursite.com

Run this from a server in a different region or from a friend's machine. If TTFB is consistently over 500 ms for a basic page, the host is oversubscribed or using slow storage.

Read the acceptable use policy (AUP) and terms of service

The AUP tells you what they consider abuse. Some hosts prohibit running cron jobs more often than every 5 minutes. Others ban certain open source tools like FFmpeg or ImageMagick on shared plans. A provider that charges $2.99 per month likely has very strict resource limits. If your site uses background workers or heavy media processing, get written confirmation that your specific use case is allowed.

Look at the control panel and migration tools

cPanel and Plesk are the most common, but some budget hosts build their own custom dashboards that lock you out of important settings (like DNS zone editing or PHP version switching). If you plan to migrate an existing site, ask if they offer free automated migration. Several reputable hosts, including DreamHost and SiteGround, provide free cPanel-to-cPanel migrations. If they charge per site or refuse, that is a cost you should factor in.

Check their data center locations and peering

Your visitors are in a specific country or region. A host that only runs a single data center in Kansas is not the right choice if your customers are in Japan. Look for providers that let you choose a server location at checkout. For content-heavy sites, a CDN like Cloudflare (which many hosts include) can help, but origin latency still matters. Ask if they have direct peering with major ISPs or if they rely on expensive transit that introduces hop latency.

Evaluate the backup policy

Do not assume backups are included. Many shared hosts provide daily backups as a checkbox, but they may only retain them for 7 days and restore them for a fee. VPS and dedicated plans often treat backups as an add on. Ask these specific questions: How often are backups taken? Are they stored off-site? Can I trigger a manual backup from the control panel? Is the restore automated or does it require a support ticket?

Red flags in reviews and social media

A few bad reviews are normal. A pattern of reviews mentioning the same issue, like "billing continues after cancellation" or "support ignored our ticket for three days" is a warning. Cross check complaints on sites like WebHostingTalk or the lowendtalk forum. Look at their response style. A host that argues publicly with customers rather than offering to help is unlikely to treat you better in private.