Web Hosting Explained for Business Owners

What hosting is

MDN, Mozilla's developer documentation, explains in What is a web server? that a web server is a computer that stores a website's files and connects to the internet, running software that sends those files to visitors' browsers. Hosting is renting space and running time on such a computer, plus the network, power and care around it.

MDN also separates two kinds of site, and the difference matters when you choose hosting:

• Static sites are files sent as they are. They need little from the server and are easy to host.
• Dynamic sites add an application server and a database that build each page as it is requested. WordPress, online shops and web apps are dynamic, and they need more memory, processing power and maintenance.

The main types of hosting

Hosting companies name their plans differently, but most fall into these groups.

Shared hosting

Many websites share one server and its resources. It is the simplest and cheapest way to start, and the host looks after the server itself. The trade-off is that a busy or compromised neighbour can slow your site down, and you have limited control over server settings.

VPS (virtual private server)

One physical server is split into several virtual servers, each with its own guaranteed share of memory and processing power and its own operating system. You get more control and more predictable performance. On an unmanaged VPS, though, you or your developer are responsible for security updates, the firewall, backups and monitoring.

Dedicated server

A whole physical server for you. It gives the most control and capacity, and the most responsibility. It is usually only worth it for heavy or specialised workloads.

Managed hosting

"Managed" describes who does the work, not the type of server. A managed plan can run on shared, VPS or dedicated hardware, and the provider (or your agency) handles server updates, security, backups and monitoring. Managed WordPress hosting often also covers WordPress-specific caching and updates. Ask exactly what is included, because the word means different things at different companies.

Cloud hosting

The US standards body NIST, in its definition of cloud computing (SP 800-145), describes cloud as on-demand access to a shared pool of computing resources that can be provisioned and released quickly with minimal management effort. Among its essential characteristics are on-demand self-service, rapid elasticity (scaling up and down with demand) and measured service (you pay for what you use).

NIST describes three service models. With infrastructure as a service, you rent virtual servers, storage and networks and manage the operating system and software yourself. With platform as a service, you deploy your application and the provider runs everything underneath. With software as a service, you use the provider's application, as you would with a hosted shop or website builder. Cloud suits sites with traffic that rises and falls sharply or apps that need to scale. Pay-as-you-go pricing can be harder to predict than a fixed monthly plan.

Which type fits your site

• A small static or brochure site: good shared hosting, or a static hosting service, is usually enough.
• A business WordPress site or small shop: managed hosting, on shared or VPS hardware, gives you updates and backups without needing your own server skills.
• A busy shop, membership site or web app: a managed VPS or cloud setup, sized to the traffic and with monitoring.
• Anything handling sensitive data: choose based on security, where the data is stored, and who is responsible for what, not on headline price.

Be wary of "unlimited" plans. MDN's guide to the costs of a website notes that there is no such thing as unlimited bandwidth, and that what counts as "reasonable" use is defined differently by each provider. Read the fair-use terms.

Your domain is separate from your hosting

Your domain name (yourbusiness.com) is registered through a registrar, which may or may not also be your host. Keep the domain registered in your business's name, on an account you control, so you can move host without losing it. ICANN's page on registrants' benefits and responsibilities says you are entitled to review your registration agreement and to clear information on how to register, manage, transfer, renew and restore your domain. It also says you must keep your contact details accurate and respond to your registrar's enquiries within 15 days. A forgotten email address on the domain account is a common way businesses lose their domain.

Backups

A host's backups protect you from its own failures. They may not protect you from a mistake, a hack, or the host itself going away. CISA's paper Data Backup Options recommends the 3-2-1 rule: keep three copies of important files (one primary and two backups), on two different types of storage, with one copy offsite.

For a website, that means automatic backups of both the files and the database, at least one copy stored away from the hosting server, enough history to go back to before a problem started, and a restore that someone has actually tested. Our website security guide covers testing backups in more detail.

SSL certificates and HTTPS

An SSL (strictly, TLS) certificate lets your site load over HTTPS, so data between the browser and your site is encrypted and visitors see a secure connection. Every site needs one, not only shops. Free certificates are widely available: Let's Encrypt issues them automatically to a server that proves it controls the domain. Its FAQ says its default certificates are valid for 90 days and recommends renewing every 60, so renewal has to be automatic. Ask your host whether certificates are included and renewed for you.

Email on your domain

Many hosting plans include email (you@yourbusiness.com), but hosting email and hosting a website are different jobs. Whichever you use, the domain needs correct authentication records, or your messages can land in spam. Google's email sender guidelines say that since February 2024 everyone sending to Gmail accounts must set up SPF or DKIM authentication for their sending domain and use a TLS connection. Senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC.

That applies to your website too: contact forms and shop order emails should send through a properly authenticated service, not an unconfigured server. If you move host, check where email is handled before you change DNS records, so mail is not cut off.

Questions to ask a host

1. Who is responsible for server updates, security and monitoring: you or me?
2. How often are backups taken, where are they stored, how long are they kept, and how do I restore one?
3. Are SSL certificates included and renewed automatically?
4. What resources do I actually get, and what are the fair-use limits?
5. Is email included, and does it support SPF, DKIM and DMARC?
6. Where are the servers located, which matters for speed and data protection?
7. How do I get support, how fast, and is there status information when something is down?
8. How do I leave? Can I download a full copy of my site and database at any time?

Moving a live site? Our website launch checklist covers DNS, HTTPS, redirects and backups for the switchover.

Frequently asked questions

What is the difference between hosting and a domain?

The domain is your address (yourbusiness.com), registered through a registrar. Hosting is the server that stores and serves your site. They can come from the same company, but they are separate, and you should control both accounts.

Is shared hosting good enough for a small business?

For a small, mostly static site, often yes. For a WordPress site or shop that matters to your business, managed hosting is usually worth it, because updates, security and backups are handled for you.

Do I need to pay for an SSL certificate?

Usually not. Free certificates such as those from Let's Encrypt are trusted by browsers. What matters is that the certificate covers your domain and renews automatically.

Are my host's backups enough?

Not on their own. Follow the 3-2-1 rule CISA recommends: three copies, on two types of storage, with one offsite. Keep at least one copy away from the hosting server and test a restore.

Can I move my website to another host?

Usually, yes, if you can get a full copy of the files and database and you control the domain. Plan the move so DNS, HTTPS and email keep working during the switch.

Want someone else to look after the server? See what our website maintenance and care covers, or email info@creahive.com with your site address and current host.