A Practical Web Hosting Checklist for Small Businesses

Before paying for hosting, confirm software compatibility, backups, resource limits and support responsibilities. Keep the answers with the checkout terms so you have a record to use at renewal or during an incident.

Start With What Your Site Actually Runs#

Before comparing plans, write down what your website is built on. Most small business sites use a content management system such as WordPress, and these platforms publish server requirements that any host must satisfy. The WordPress requirements, checked September 8, 2026, recommend PHP 8.3 or greater and MariaDB 10.11 or greater or MySQL 8.0 or greater. Confirming this before you buy prevents a familiar frustration: discovering after signup that an older PHP build or an unsupported database version breaks a plugin, a theme, or a checkout flow.

A short compatibility list is enough to start: the CMS and its version, the ecommerce or booking tools you depend on, the PHP extensions they require, and the database engine they expect. Ask each candidate host to confirm these points in writing, and ask how PHP upgrades are handled. A host that lets you pin a PHP version, and that gives notice before scheduled upgrades, lets you test changes on your own schedule rather than react to them on someone else's.

Make Encryption Non-Negotiable#

Every plan you consider should support HTTPS — an encrypted connection between your visitors and your server — without extra cost or negotiation. Transport Layer Security, the protocol behind HTTPS, protects the integrity and privacy of data in transit and blocks attempts to alter pages or intercept form submissions along the way. Google's Search Central documentation also treats HTTPS as a ranking consideration, so encryption is both a security measure and a visibility one.

Three questions settle it. Are TLS certificates included, and do they renew automatically? Does the host redirect plain HTTP requests to HTTPS by default? Are outdated protocol versions disabled at the server? A host that answers these clearly is also showing you how its support team communicates, which is useful information in its own right.

Check Backups, Uptime, and Resource Limits#

Operational details decide whether a plan fits a business. Look for automated backups on a stated schedule, retention long enough to cover a problem that goes unnoticed for weeks, and a documented restoration process. Backups matter most when something has already gone wrong, so ask who performs the restore, roughly how long it takes, and whether restoration carries a fee.

Resource caps deserve equal attention. Plans describe disk space, bandwidth, and compute in broad terms, but the practical question is what happens when you approach a limit: throttling, suspension, or a conversation about upgrading. Ask how you will be told. Pair this with the host's uptime commitment — what the target is, how downtime is measured, and whether scheduled maintenance is excluded from the calculation.

Written answers are worth more than a feature list. A provider that can state its backup schedule, its overage policy, and its uptime measurement method in plain language has already done the work of making those policies real.

Keep Your Domain and Hosting Separate#

Registering your domain with the company that hosts your site is convenient, and bundles often encourage it. It also creates a single point of administrative failure. If a billing dispute, an account suspension, or a provider closure affects your hosting account, the domain can be caught in the same net — and without the domain, you cannot point traffic anywhere else.

Keeping registration and hosting with separate providers means the address your customers know stays under your control no matter what happens to the server. At minimum, confirm that you own the registration outright, that you can transfer it elsewhere without a penalty, and that you can edit DNS records yourself. Mozilla's MDN Web Docs on publishing a website explain how domains, DNS, and hosting fit together, and that background makes every later decision easier.

Protect the Account Itself#

Hosting security is not only the provider's job. Enable multi-factor authentication on every administrative account: the hosting control panel, the CMS dashboard, and the domain registrar. The FTC's cybersecurity guidance for small business emphasizes fundamentals like this because they blunt the opportunistic account takeovers that are far more common than exotic attacks.

Also worth clarifying: who patches the server software you cannot reach, whether malware scanning is included or sold separately, and what the first steps are if a compromise is suspected.

A Checklist to Bring to Every Conversation#

• Confirmed support for your CMS, PHP version, and database engine
• TLS and HTTPS included, with automatic certificate renewal
• Automated backups with a stated schedule, retention period, and restore process
• Multi-factor authentication available on all administrative accounts
• Written resource limits and a clear policy for approaching them
• An uptime commitment with a defined measurement method
• A domain you can move, with DNS records under your control
• A named contact or escalation path for security incidents

Choosing a host is partly a bet on how a company behaves when something breaks. The answers gathered now, in writing and before payment, become the reference point for every later conversation with that provider. A business that documents this once and revisits it at each renewal avoids most of the avoidable hosting problems.