Questions to Ask Web Hosting Support Before You Buy

Ask hosting support about backups, resource limits, incident handling and cancellation before you pay. Keep links to the written policies alongside the answers so you can check whether the plan covers the work you need.

What the Uptime Commitment Actually Means#

Uptime percentages are easy to quote and easy to misread. The difference between a 99.9 percent commitment and a 99.99 percent one is not a rounding error; each additional nine represents an order of magnitude less permitted downtime over a billing period. More important than the headline figure is what surrounds it.

Ask how the measurement is defined — whose monitoring counts, from where, and over what window. Ask whether planned maintenance is excluded, and what evidence you must provide to make a claim. Then ask what remedy exists if the commitment is missed: account credit, a partial refund, or the right to leave without penalty. A guarantee with no defined remedy is a target rather than a promise.

What Support Covers, and What It Does Not#

Most hosting support covers the server and its infrastructure. What it frequently does not cover is your application: a fatal plugin conflict, a broken theme update, a crashed database table, or a misconfigured setting inside your CMS. Knowing where that line sits before you buy prevents the unhappy discovery that the problem you are having is, by the provider's definition, yours.

Ask about channels and hours. Is there a ticket system, live chat, and phone, and are all of them staffed around the clock or only during business hours in one time zone? Ask how escalation works — how many tiers sit between the person who answers and someone who can act, and whether there is a route to a senior engineer when the first answer is not adequate.

How Security Incidents Are Handled#

Security questions reveal how a provider behaves under pressure. Ask whether automated malware scanning is included and what happens when something is found: notification, quarantine, removal, or a notice that the account will be suspended. Ask about DDoS mitigation and at what point protection engages, and how you would be told if your site was affected.

Ask about patching cadence for the server-side software you cannot update yourself, and what the host considers its responsibility during a suspected compromise versus yours. The CISA small business cybersecurity materials are a useful yardstick for what reasonable answers sound like, and for the questions a provider should answer without hesitation.

Migration In, and Migration Out#

Ask about moving in, and then ask the same questions about moving out. Inbound migration is often a selling point; outbound migration tells you more. Ask what transfer formats the provider works with — a control panel move, a raw SQL dump with an archive of files, or a container image — and whether staff will perform the transfer or only document it.

Then ask whether anything in the stack is proprietary in a way that makes leaving awkward: a custom control panel, a backup format only their tooling reads, or bundled services that cannot be exported. The FTC's material on warranties and service agreements is a reminder that the terms you accept at signup govern the exit, and the exit is when you have the least leverage.

How to Judge the Answers#

Favour specifics over reassurance. A precise answer about escalation tiers or claim procedures tells you the process exists and has been used. Ask for anything important in writing — a link to the policy rather than a summary in chat — and compare the published terms with what you were told. ICANN's registrant education materials make a similar point for domain services: the published policy is what applies, not the impression left by a sales conversation.

Red Flags Worth Noting#

Some answers tell you more than the policy itself. A support team that cannot describe its escalation path, or that answers a question about uptime remedies by restating the uptime percentage, is telling you the process has not been thought through. A provider with no published position on malware incidents, or whose cancellation instructions cannot be located without a conversation, is showing you what the relationship will feel like after payment.