How to choose the best WordPress web hosting provider – Security Boulevard

You’re searching the web for information on how to choose the best WordPress web hosting service, right? You’re determined that your website host will help search engines prioritize your website above other slower, less reliable and less secure websites. But, how do you decide?

This blog post defines the four main types of WordPress web hosting – with easy to digest merits and limitations for each. It also sets out the important, optional extras offered by the higher ranking WordPress web hosting providers. After reading our analysis, you’ll be in a great position to decide on which type of web host to select.

Table of contents

Let’s consider the main WordPress web hosting types

There are many factors to consider when looking for the best WordPress web hosting service for your WordPress website or multisite network. The first is to determine which type of WordPress web host you need. There are four main options:

  • Shared hosting
  • VPS hosting
  • Managed hosting (specific to WordPress)
  • Dedicated hosting

Shared hosting

Experienced WordPress website developers will recognize shared server hosting as the ground-floor solution. This allows the creators of fledgling websites to have a website running in minutes. But, is it the best WordPress web hosting service to go for?

This diagram illustrates a shared hosting setup.

WordPress shared hosting diagram

As its name suggests, the same web server hosts several other websites. Each sharing all the server’s resources, such as memory and CPU. The only resource that’s not shared with others is the hard disk space where your WordPress website files are stored.

Merits of shared hosting

  1. Extremely low cost.
  2. There is a low barrier to entry, because many web hosts use wizards to help you set up WordPress in seconds.
  3. The maintenance burden on website owners is similarly minimal.

Limitations of sharing hosting

While the merits are compelling, particularly for the inexperienced, the limitations are considerable:

  1. The severely limited functionality available on shared hosting accounts means you don’t have access to useful features, such as caching.
  2. The setup can host one website per account. While it’s technically possible to run multiple websites, this complicates the setup and slows down the server.
  3. On a related point, this setup works best for small websites with low traffic and few resource-sapping connected databases or plugins.
  4. The web server and installed software are managed by the web host. Which means that you have no flexibility to add additional software or functionality.
  5. Since the server’s resources are shared among all the websites hosted on it, resources are not dedicated to you. If another website hogs the CPU, your website’s performance will be affected.
  6. While many offer decent backup services, they’re often painful to restore.
  7. Scalability is not built in. Should your website traffic suddenly increase, you can’t simply upgrade the package but will have to migrate to a different solution.
  8. The low cost, expertise and maintenance naturally attracts beginners and others who make poor coding, architecture and design choices. Their websites could hog the shared bandwidth and other resources, making your website less reliable.

What about security?

In a shared hosting environment, security is completely outside your control. Your website is as secure – or insecure – as the least secure website on the same server. Unfortunately, WordPress firewalls and security plugins are impotent in the face of such WordPress security risks, since they only protect your website from attacks that originate from the internet. That said, a WordPress activity log plugin would be useful in such a setup because it would at least alert you to file changes on your WordPress website, which might prompt you to investigate further.

Here’s the kicker. If another WordPress website hosted on the same shared server is hacked, attackers can gain access to your website’s files and infect them with malware.

Time to decide

In the case of shared WordPress hosting, particularly if you have a large website, you must decide whether the ease of setup beats the likely intermittent loss of performance and the riskier possibility of getting hacked.

Virtual private server (VPS) hosting

VPS hosting for WordPress has grown in popularity and has the edge over shared hosting because it offers both flexibility and affordability. The concept is very similar to shared hosting, but instead of having access to a limited hard disk space and shared server resources you have access to a complete virtual machine with its own operating system and user accounts. It’s a hybrid of shared hosting and dedicated server hosting.

We used to host this website on a managed VPS. We also have a number of VPS on DigitalOcean, used as a test environment for our WordPress activity log plugin.

This diagram illustrates the architecture of VPS hosting.

WordPress VPS hosting diagram

VPS hosting provides you with a set up similar to a virtual dedicated server. With VPS hosting, you pay for a virtual machine (VM) on a ‘host machine’ – a physical server that runs hypervisor software, which splits the server’s resources into multiple VMs – each with their own dedicated RAM, HDD space and CPU power.

Managed and unmanaged VPS hosting

  1. With unmanaged VPS servers, you will have total control of the operating system, including root access.
  2. With a managed VPS server, in most cases you won’t have root access. But you can still access the shell and conduct generic administrative tasks.

Merits of VPS hosting

If you opt for VPS hosting for your WordPress website, there are many advantages over shared hosting:

  1. While VPS hosting definitely costs more than shared hosting, it may be the best WordPress web hosting service for those who prize value for money, as it’s much more affordable than purchasing a dedicated server (if you want to own a server).
  2. VPS plans are customizable, so you pay only for what you need. You can configure the processing power, RAM and HDD space when choosing a server.
  3. In another significant advantage over shared hosting, with (unmanaged) VPS hosting, you get root access on the virtual machine, giving you total control of the server.
  4. There is flexibility to install any software you want. So it’s easy to add functionality and customization, for example by installing additional Apache modules.
  5. It is a scalable solution, as it is very easy to add more RAM, processing power and HDD space, meaning traffic spikes don’t crash the server. You can add (or reduce) resources as required with no need to migrate to a new solution or even contact the web host.
  6. With a non-managed VPS account, you can run as many WordPress websites as you want on the same account.
  7. Despite all the flexibility offered by this configurability, it does not increase complexity unnecessarily. VPS hosting can be a semi or fully managed solution, so even though you have your own server, there is no need for you to maintain it.

Limitations of VPS hosting

  1. VPS hosting is still a shared environment. Although you have allocated resources, sometimes web hosts may not allocate their resources appropriately (too many VMs on a server, for example). In the event that a number of VPSs use their resources at peak level, this might negatively affect the performance of your VPS and website.
  2. VPS web hosts often limit their support to VPS and network issues. They will not assist you with WordPress specific issues – something you may not realize until you need to acquire it in a hurry.
  3. Unlike with shared hosting, VPS hosting can come with a heavy maintenance burden. With an unmanaged VPS, you must manage everything yourself. This includes installing security patches, configuring the web server, backups and everything else involved in running a web server.

What about security?

In a VPS hosting environment, security is all in your hands. If you are using an unmanaged service, it is your responsibility to keep all your software up to date and configure the firewalls, web servers and permissions.

Another consideration is the number of websites you’re running on the same VPS server. The overall server security is only as strong as your least secure WordPress website.

Even if you are using partially or fully managed VPS hosting, you’ll still need to manage some of those items yourself. Unless you have the technical expertise or time to do so, it may be better to opt for hosting that takes care of all the elements that contribute toward security.

Time to decide

With VPS hosting, you have much more flexibility and the option to decide your own configuration. The question in this setup becomes more of a choice between that and your capability to commit to the additional setup and maintenance time it brings with it.

Managed hosting

Managed server hosting offers busy website developers an attractive management-free solution for WordPress websites. There’s a current drift toward cloud-based hosting with user-friendly UIs. In its most basic form, this type of hosting solution provides a WordPress website master template that gives you access to the WordPress dashboard, though you won’t be able to install or uninstall WordPress. Meanwhile, your managed host provider takes care of keeping your WordPress version up-to-date, and (though you still have access to adding and removing themes and plugins) you can hand over the responsibility of processing and resolving irritating notifications about updated or no longer supported plugins and themes.

Yes, this convenience incurs more expense than shared or VPS hosting, but many businesses value their liberation from mundane administrative website chores. That means they can dedicate their full attention to their websites’ content and design.

Merits of managed hosting

  1. Managed hosting is specifically designed for WordPress with all the attendant page load speed and customization benefits.
  2. Packages typically offer a persuasive bundle of perks. Such as caching systems, CDNs, WordPress automatic updates, straightforward rollbacks and backups, and security features. Many also offer out-of-the-box support for staging websites. This will allow you to preview website changes before publishing them to the live environment.
  3. As long as the web host knows how many visitors your website gets, and you’re prepared to pay for it, you need not be concerned with running out of hardware resources.
  4. In most cases, the web host can increase your allocated resources as your requirements evolve, removing yet another common resource concern and the usual need to migrate at this point.
  5. Managed WordPress web hosts also benefit from a favorable reputation for specialized WordPress support. Even if the issue is not a complicated web hosting one, they can investigate and help you resolve it quickly.

Limitations of managed hosting

  1. Depending on the vendor, it can be restrictive at times, especially if you have large or complex WordPress customizations or integrations with other software.
  2. In some cases, you might not be allowed to install certain plugins and have to find an alternative.
  3. There’s no denying that it’s more expensive when compared to other alternatives with similar resources.

What about security?

WordPress security is the major edge that managed hosting has over other types. In addition, if you opt for a cloud-based managed hosting provider, your website will be stored in its own container (which means it operates in the same way as a separate, dedicated server as discussed below). The risks posed by the lack of security of other websites on the same server simply disappear.

Time to decide

Billed as a management-free solution, with some of the caveats mentioned above, your greatest determining factor may be whether the convenience – particularly for those running multiple websites – is worth the additional, recurring and multiplied expense.

Dedicated server hosting

Dedicated server hosting (sometimes referred to as ‘self-managed’) is both the most compelling set up, not least because it’s also the simplest.

For those who prefer to visualize what they’ve bought, this solution buys you an actual server of your own. You install, set up and maintain everything. This is perfect for server teams with systems engineers in larger organizations that need complex installations.

Merits of dedicated server hosting

  1. Since you manage everything yourself, from the OS onwards, you have freedom to set up the servers as you require and configure them to your exact specifications. This is very attractive for those with ‘web farms’.
  2. All the servers’ resources are allocated to you and not shared with anyone else. So, speed concerns and all the problems of an intermittent lack of access to other resources are removed.
  3. You can run as many websites as you like on the same server as long as the resources are available.

Limitations of dedicated server hosting

  1. The flexibility of this route is accompanied by a huge setup and maintenance burden on your server engineers. Everything from the OS, MySQL database, mail server, FTP, SSH and all other services.
  2. Naturally, this in turn brings expense. This is one of the most expensive WordPress hosting solutions.
  3. Despite the high cost, this does not mean you will have specialized WordPress support. You must install, update and maintain the server’s hardening and security. The web host will generally only assist if you encounter server (hardware) and web hosting issues – not with your precise configuration.
  4. Similarly, there are no out-of-the-box WordPress perks such as backup or staging websites, for example. You must set all these extras up yourself.
  5. Unfortunately, the high cost associated with this setup does not future-proof it. It’s not scalable, because even if you initially buy a capacious server that you hope will last a few years, as soon as you need more resources or the hardware becomes too old, you’ll have to migrate the website(s) to a new server.

What about security?

As with the server setup and configuration, security is all your responsibility in dedicated server hosting solutions – from the server’s operating system to all network services such as web servers and SMTP servers. Users must be familiar with all related configuration and maintenance.

Time to decide

In this case, the main decision appears to be centered around whether having all the necessary resources all to yourself is worth the massive input required to both set up and manage the ongoing maintenance. It is best suited to experienced users or larger businesses with their own server team.

Other optional extras and criteria that may sway your decision

Once you’ve decided on the best WordPress web hosting type, it’s time to move to the next decision: which of the optional extras provided by vendors and other criteria can you not do without?
Depending on the hosting type selected, vendors may offer some of the following bolt-ons. It could be that one of these bolt-ons will help you decide which vendor to pick.

Web hosting provider performance & uptime

Everyone knows your website’s page load speed affects your SEO, number of visitors and bounce rate. You can test this using free tools such as Pingdom or GTmetrix.

Check the services level agreement of the website hosts you’re considering. Do they guarantee 99% uptime, for example? It’s a sign of a confident and superior website host if they provide a status page on their website, where you can view the network’s status, connections and server health.


Since many websites no longer operate as mere billboards, but offer an interactive web application experience, designing and maintaining secure WordPress websites by design is essential. Does the web host you’re considering offer any security protections?

There’s hardly a WordPress hosting provider that does not supply a free TLS certificate, so make sure you select one who does. They allow you to run your WordPress website safely on HTTPS (a requirement as explained in the definitive guide to WordPress HTTPS, SSL and TLS).

It’s also worth checking whether the particular web host has ever made the news for reasons other than great reviews. Have they ever suffered a data breach or any other security disaster that was, by default, also endured by their clients?

Web host pricing

So, how much does everything cost, does a larger fee mean you get the best WordPress web hosting service, and are there any freebies?

  • Some vendors will offer consultancy to enable you to select the most appropriate package for your needs
  • A shared and managed hosting service costs from $5-10 per month
  • Managed hosting costs from $25-50 per month
  • Dedicated server hosting costs vary crazily, starting around $70-150 per month
  • Some hosts waive setup fees, and some offer free domains and even site migration services

Like many other online services, if you pay upfront for a year’s service, you’ll usually get a discount (around 20%).

Web hosting support

While all web hosts may offer support, some offer WordPress-specific support as a compelling differentiator. Remember, unless you select dedicated hosting, you’re relying on the datacenter and the individual (shared) server on which your website is hosted – and you’ve access to neither. In these scenarios, when something goes wrong, a website host vendor that knows WordPress, and is independently rated highly for rapid response times, may become your deciding factor. When an internal server error arises, for example, you want to rest easy knowing your host has your back.

And, what happens if you get hacked? Will your intended website host roll up their sleeves?

Ask for a free trial, so you can test not only the performance of your website with the host but also the usefulness of their support documentation, the validity of their 24/7 support sales pitch and the quality of their support.


It’s best to segregate your backups from your hosting provider. We recommend BlogVault as a WordPress online backup service. If your hosting service has backups included, use that too. There is no downside to having a couple of backups.

Staging website

A staging website is a copy of your live website that is accessible only to you. This allows you to preview website changes before publishing them. Even if you opt for a non-managed WordPress hosting service, you can still manually create your own staging website. But having it available at a click of a button is more convenient.

Caching solution

You can implement your own caching solution with a plugin, or use a Content Delivery Network (CDN). However, many web hosts, especially those that specialize in WordPress, will include a customized WordPress caching solution.

How WP White Security did it

We’ve used various hosting setups and vendors. If you’d like to find out more about our experience navigating the hosting types and bolt-ons, click a link.

Let’s recap on the key questions on how to choose the best WordPress web hosting service

  1. Do you have the in-house expertise required to set up your server, configure it, make it and all its components secure and maintain this secure setup over a long period of time? Poorly established server setups are going to cause your problems immediately. So, think carefully.
  2. How large a setup do you need? If you require a web host for running multiple, large or complex websites, this will help eliminate the less flexible options. And, what happens if your memory and power requirements later exceed the capacity of the setup you’ve purchased – in other words, will it scale?
  3. How willing are you to share resources and run the risk of occasional downtime?
  4. Do you need root access or access to optional extras? Would you like to be able to install your own software? How important is each one of these items to you?
  5. What level of support do you require? Might this change as time goes on?
  6. What does your budget tell you? For some, this will be the most important factor.

Conclusion & useful security tips

We recommend that you invest time now thinking about the answers. Once you’re able to do so, and prioritize them according to your needs, you’ll be in a better position to be able to decide on the type of hosting you go for. If you then factor in the optional extras you can’t do without, that will help you select a company that offers the hosting type, configuration flexibility, security offering and support level that helps you host your websites securely.

Apart from what we mentioned, the security of your WordPress website also depends on the systems and best practices you put in place. To better protect and harden its security, you can add a number of on-site security hardening techniques that web hosts do not provide. For example:

  • Two-factor authentication (2FA) – it adds an extra layer of security to your WordPress authentication / login page, making it significantly harder for an attacker to gain access to your WordPress dashboard should an attacker manage to uncover a user’s password,
  • Strong password policies – ensure your team, customers & subscribers use strong passwords by enforcing strong password policies with a plugin,
  • WordPress activity log – keep a log of what happens on your website to ease troubleshooting, spot suspicious behavior and improve user accountability.

We wish you well as you research to find the best WordPress web hosting service for your needs, one with a secure, customized package that helps you meet your website hosting goals.

The post How to choose the best WordPress web hosting provider appeared first on WP White Security.

*** This is a Security Bloggers Network syndicated blog from WP White Security authored by Dawn Baird. Read the original post at: