Choosing Website Hosting for a Small Business

This guide is for small-business owners who need a website. It explains your choices before you pay for anything. You'll learn how a domain differs from hosting, which kind of hosting fits your site, what it really costs after the first year, and how to avoid getting locked in. You don't need technical staff to follow it. It ends with recommended setups and a setup checklist.

Hosting decisions are easy to get wrong in both directions: a business-critical site on a bargain plan nobody maintains, or a five-page brochure site paying for infrastructure it will never use.

Domain, DNS, hosting, and email are four different things#

Most confusion about hosting comes from treating these as one purchase. They're separate services, and they can (and often should) come from different companies:

Keeping them separate means you can change one without breaking the others. Moving web hosts, for example, shouldn't touch your email at all.

The kinds of hosting#

Shared hosting#

Many websites share one server's CPU, memory, and storage, managed by the host. It's inexpensive and easy, usually with a control panel and one-click WordPress installation.

Good for: brochure sites, new businesses, and low to moderate traffic. Limitations: performance can vary with your neighbors' activity, resource limits can bite as you grow, and you're usually responsible for keeping WordPress, themes, and plugins updated, although many hosts offer tools that automate some updates.

Managed WordPress hosting#

Hosting built only for WordPress, where the provider handles server tuning, caching, platform security, automatic backups, and usually staging sites (a private copy for testing changes) and WordPress-aware support.

Good for: sites where downtime or a broken update costs money, and owners who'd rather not tune servers. Limitations: more expensive than shared hosting; WordPress only; some providers restrict certain plugins; email is often not included. Plugin and theme updates usually remain your responsibility unless the plan or an add-on says it handles them.

VPS (virtual private server)#

Your own virtual server, with a set amount of CPU, memory, and storage allocated to you. Unmanaged VPS means you run the operating system, web server, security updates, firewall, and backups yourself.

Good for: developers and technical owners with specific needs. Limitations: you're the system administrator. An unpatched VPS is a liability, and nobody restores it for you if it breaks.

Managed cloud hosting#

A middle ground: the provider sets up and manages servers on a major cloud platform (such as DigitalOcean, AWS, or Google Cloud), and you choose the size and location. You get dedicated resources without managing the operating system.

Good for: agencies, growing sites, and businesses running several sites. Limitations: more decisions to make (provider, server size, add-ons), usage-based bills that vary month to month, and you still manage the applications themselves.

Static site hosting#

The site is pre-built into plain files (HTML, CSS, images) and served from a global network. With no database or server software of your own to attack or patch, static sites remove most server-side risks, and they're fast and cheap or free to run. Services include Cloudflare Pages, Netlify, and Vercel.

Good for: brochure sites that change a few times a year. Limitations: editing usually needs a developer or a content tool set up for you; contact forms, bookings, and stores need third-party services. Security risks don't disappear: the hosting, code-repository, registrar, and DNS accounts, any third-party scripts or form services, and the build process all still need protecting.

Hosting for React and Next.js websites#

Custom sites built with React frameworks such as Next.js are usually hosted on platforms designed for them (Vercel, Netlify, Cloudflare). They combine static hosting with small server functions for things like forms, and they deploy automatically when the developer pushes code.

Two things to understand before choosing one:

• Free tiers have rules. Vercel's Hobby plan, for example, is described in its own pricing FAQ as "for personal, non-commercial use," so a business site belongs on a paid plan.
• Paid plans mix a monthly fee with usage. Vercel Pro and Netlify's paid plans include an allowance and then charge for extra bandwidth, requests, or compute. Whether a site stays within the allowance depends on its traffic and features, so check the usage dashboard after launch, and set a spending limit so a traffic spike or a bot can't produce a surprise bill.

A React site on one of these platforms also means you depend on a developer for changes. That's fine if you have one; it's a poor fit if you want to edit pages yourself.

Hosted website and store builders#

Squarespace, Wix, and Shopify (for stores) include hosting, security, and updates, and you edit visually. Good for: owners who want to manage the site themselves without plugins or servers. Limitations: less flexibility, and moving to another platform later usually means rebuilding the site.

A decision framework#

Answer these in order. The first answer that clearly applies usually decides the hosting type:

Then check the details in the next section before you buy.

What to check besides price#

Domain registration#

Your domain name is the most important asset in this whole setup. Register it in the business's name, in an account the business controls, even if a developer manages it. The rights described in ICANN's registrant rights belong to the registrant of record: the person or business listed as the domain's registered name holder. Make sure that's you.

Registrars often offer to hide your contact details from public lookups, and there are two different kinds of service, as ICANN explains:

• With a privacy service, you stay the registrant of record; only the contact details shown publicly are replaced.
• With a proxy service, the proxy company becomes the registrant of record and lets you use the domain under its terms of service, so your control over the domain depends on that agreement.

If you want your details hidden, check which kind your registrar's option is (its terms of service say) and confirm who is listed as the registrant. Also:

• Turn on auto-renew and keep the payment card current. An expired domain takes down your website and your email.
• Turn on registrar lock (transfer lock) and two-factor authentication on the registrar account.
• Many hosts include a "free domain" for the first year. That's fine, but know the renewal price and how to transfer it out.

DNS and nameservers#

DNS translates your domain into the addresses of your website and email servers. The authoritative nameservers are the ones that hold the definitive records for your domain (Cloudflare's DNS concepts explains the terms). Your registrar records which nameservers are in charge of your domain's DNS; whoever runs those nameservers controls every record. A host that asks you to "point your nameservers to us" is taking over your entire DNS, including email records, not just the website.

What matters:

• Who controls DNS and who has the login. Moving hosting is easy when you control DNS; it's painful when an old provider does.
• Record types you'll touch: A/AAAA (website address), CNAME (an alias), MX (where email goes), and TXT (verification and email security records such as SPF and DMARC, explained under Email).

example.com.        3600  IN  A      203.0.113.10
www.example.com.    3600  IN  CNAME  example.com.
example.com.        3600  IN  MX     0 example-com.mail.protection.outlook.com.
example.com.        3600  IN  TXT    "v=spf1 include:spf.protection.outlook.com -all"
_dmarc.example.com. 3600  IN  TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

TLS certificates (the padlock)#

TLS (Transport Layer Security) is the technology behind HTTPS and the padlock in the browser: it encrypts the connection between your visitors and your site. It relies on a TLS certificate (often still called an SSL certificate) that proves the site really belongs to your domain.

Every site should load over HTTPS. Most hosts and platforms now provide free automatic certificates (often from Let's Encrypt) that renew themselves. Confirm the host includes automatic renewal, and redirect http:// to https://.

Backups#

Ask how often the host backs up, how long backups are kept, how you restore (self-service or a support ticket), and whether restoring or off-site copies cost extra. Then keep your own copy too, outside the hosting account; a host's backups won't help if the account is closed or compromised. The 3-2-1 Backup Guide explains why.

For static and React sites, source control (for example a GitHub repository) holds the site's code and its history, but it's only one part of a backup strategy. Keep a copy outside the Git host, and back up what isn't in the repository: form submissions, content in a CMS, uploaded images, DNS records, and the platform's environment settings.

Email: usually separate from the website#

Some hosting plans include email mailboxes, sometimes only for the first year; others include none. For a business, a dedicated email service such as Microsoft 365 or Google Workspace is usually the better choice: better spam filtering, mobile apps, shared calendars, multi-factor authentication, and your email keeps working when you change web hosts.

Whichever you use, set up three DNS records that prove your email is really from you, so it's less likely to be marked as spam or spoofed:

• SPF (Sender Policy Framework) lists which services are allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so the receiving server can check that it came from your domain and wasn't changed on the way.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do with messages that fail those checks (deliver them, send them to spam, or reject them) and can send you reports about it.

Your email provider gives you the exact values to add. Google's sender guidelines require SPF or DKIM from every sender, and all three from bulk senders. Setting up all three is worthwhile for any business.

Security and updates#

The host secures the server; you're usually responsible for the application. For WordPress:

• Keep WordPress core, themes, and plugins updated, and remove ones you don't use.
• Use strong, unique passwords and two-factor authentication for every admin account.
• Give each person their own account with the lowest role they need.
• Follow the official WordPress hardening guide.

Ask whether the host includes a web application firewall, malware scanning, and cleanup if the site is hacked, and whether cleanup costs extra. Static sites remove the plugin and server-patching part of this work, but their accounts, third-party scripts, and form services still need the same care.

Performance and uptime#

For most small-business sites, performance comes down to server location near your customers, caching, image sizes, and not overloading WordPress with plugins. A content delivery network (CDN) helps if customers are spread out. Test your own site with free tools such as Google's PageSpeed Insights before and after any move.

For uptime, look for a written service level agreement (SLA) rather than marketing claims, and read what it actually promises; SLAs commonly offer service credits rather than compensation for lost sales. On the pricing pages checked for this guide, stated uptime guarantees varied by host and plan: some standard plans state 99.9%, and some enterprise or custom tiers state up to 99.99%. Either way, read what the SLA covers for the plan you're buying. A free uptime monitor that emails you when the site goes down is worth setting up whatever you choose.

Support quality#

Find out how support works before you need it: chat, tickets, or phone; hours; and whether the team helps with WordPress itself or only the server. Read the provider's documentation: clear, current docs are a good sign of how problems get handled.

Vendor lock-in#

Ask how hard it would be to leave:

• Domain and DNS in your own accounts keep you portable no matter where the site is hosted.
• WordPress sites can usually move between hosts with a full export of the files and database, though host-specific caching, security plugins, or features may need to be replaced or reconfigured.
• Hosted builders usually can't be migrated directly. Some content can often be exported, but the design and layout typically have to be rebuilt elsewhere.
• Platform-specific features (a host's own page builder, form service, or serverless functions) tie you to that host. Use them knowingly.

Ease of maintenance#

Ask who will apply updates, renew the domain, check backups, and fix things when a plugin update breaks the site. If the answer is "nobody," choose managed hosting or a hosted builder, or arrange a maintenance plan.

Comparing popular options#

Transparent cost comparison#

Hosting is priced in three common ways, and each needs a different check:

• Introductory multi-year pricing (common with shared hosting): the advertised monthly price usually requires paying for several years up front, and the plan renews at a higher price. Compare the renewal price.
• Flat monthly or annual pricing (common with managed WordPress): predictable, with limits on visits, bandwidth, or storage. Check what happens when you exceed them.
• Usage-based pricing (managed cloud and React platforms): a base fee plus charges for resources used. Set a budget or spending alert.

Then compare total yearly cost at renewal, not the first-year sticker price:

Moving to a new host#

1. Lower the DNS TTL (time to live) on the records you'll change to a few minutes, at least one full current TTL ahead (often a day), so the switch spreads faster. A lower TTL shortens how long resolvers keep the old answer, but it doesn't make the change instant everywhere: some networks can hold the old record a while longer, so for a short time some visitors may still reach the old host.
2. Take a full backup of files and database, and export your DNS records.
3. Copy the site to the new host. Many hosts offer free migration, or use a migration plugin.
4. Test on the new host using a temporary URL or a hosts-file override before changing DNS.
5. Switch DNS (A/CNAME records). Don't touch MX records unless you're also moving email.
6. Confirm HTTPS works, forms send, and email still arrives.
7. Keep the old hosting for a while before cancelling, typically a week or two, until you've confirmed visitors, forms, and email have all moved. It isn't a strict rule, but it gives you a fallback if something was missed.

Careful planning keeps any interruption short, but no checklist can guarantee a move with zero downtime; schedule the switch for a quiet time for your business.

Recommended setups#

Whichever you choose: own your domain, keep email separate, check your backups, and know who's responsible for updates.

Setup checklist#

1. Register the domain in the business's own account

   Turn on auto-renew, registrar lock, and two-factor authentication. Note the renewal date.

2. Decide who runs DNS

   Keep DNS at your registrar or a DNS provider you control. Export the current records before any change.

3. Set up business email separately

   Microsoft 365 or Google Workspace, with SPF, DKIM, and DMARC records in place.

4. Choose the hosting type with the decision framework

   Then compare renewal prices, backups, support, and how hard it would be to leave.

5. Turn on HTTPS and redirects

   Confirm the certificate renews automatically and that http:// and www redirect to one address.

6. Arrange backups you control

   Host backups plus your own off-site copy. For static and React sites, back up the repository outside the Git host and everything not stored in it (forms, CMS content, settings). Test a restore once.

7. Secure every account

   Unique passwords and two-factor authentication on the registrar, DNS, host, email, and website admin.

8. Write down who does what

   List every account, who has the login, and who handles updates, renewals, and fixes.

9. Add monitoring

   A free uptime monitor, and a calendar reminder to check backups and renewal dates.

Next steps#

• Make a list of every account involved (registrar, DNS, hosting, email) and who has the login.
• Check your domain's renewal date and turn on auto-renew today.
• Secure those accounts with the Small Business Cybersecurity Checklist.
• Plan your backups with the 3-2-1 Backup Guide.