# Choosing Website Hosting for a Small Business

This is a plain-text copy of a guide published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/small-business-website-hosting-guide

- Source (authoritative web version): https://jeremiahellington.com/resources/small-business-website-hosting-guide
- Author: Jeremiah Ellington
- Published: 2026-10-24
- Last updated: 2026-10-24
- Last reviewed: 2026-10-24
- Next scheduled review: 2027-04-30
- Applies to: Provider plans and documentation as published on 2026-10-24; WordPress 6.x for WordPress-specific notes
- Who it's for: Small-business owners choosing hosting for a new website, or deciding whether to move an existing one, with or without technical staff.
- Level: Beginner
- Before you start: Know what the site needs to do: a brochure site, bookings, a store, a blog; Know who will edit and maintain it (you, staff, or a developer)

Domains, DNS, security certificates (TLS), and every kind of hosting explained in plain terms (shared, managed WordPress, VPS, managed cloud, static, and React/Next.js platforms), with a decision framework, honest cost and lock-in notes, and recommended setups for common small-business situations.

---

This guide is for small-business owners who need a website. It explains your choices before you pay for anything. You'll learn how a domain differs from hosting, which kind of hosting fits your site, what it really costs after the first year, and how to avoid getting locked in. You don't need technical staff to follow it. It ends with recommended setups and a setup checklist.

Hosting decisions are easy to get wrong in both directions: a business-critical site on a bargain plan nobody maintains, or a five-page brochure site paying for infrastructure it will never use.

> **Note:**
> Prices and plan details change often, and **introductory prices can be much lower than renewal prices**, especially for shared hosting. This guide describes plans as each provider published them on the review date and doesn't list prices. Always check the renewal price before you commit to a multi-year term.

## Domain, DNS, hosting, and email are four different things

Most confusion about hosting comes from treating these as one purchase. They're separate services, and they can (and often should) come from different companies:

| Piece | What it is | Typical provider |
|---|---|---|
| **Domain registration** | Your right to use a name such as `example.com`, renewed yearly | A registrar (Cloudflare, Namecheap, GoDaddy, Squarespace Domains, and many others) |
| **DNS** | The directory that says where your website and email live | Your registrar, your web host, or a DNS provider such as Cloudflare |
| **Web hosting** | The computers that serve your website's pages | A web host or platform (this guide's main subject) |
| **Email** | Mailboxes for `you@example.com` | Microsoft 365, Google Workspace, or (less ideal) a web host's bundled mail |

*Diagram: The registrar points to your authoritative nameservers; the records there send website traffic to your host and email to your email provider.* (Image description: Diagram: the registrar records the domain and which nameservers are authoritative for it. The authoritative DNS nameservers hold the domain's records: A, AAAA, or CNAME records point website visitors to the web host, and MX records point incoming email to the email provider, such as Microsoft 365 or Google Workspace. Browsers and sending mail servers look up these records, then connect to the host or email provider directly.)

Keeping them separate means you can change one without breaking the others. Moving web hosts, for example, shouldn't touch your email at all.

## The kinds of hosting

### Shared hosting

Many websites share one server's CPU, memory, and storage, managed by the host. It's inexpensive and easy, usually with a control panel and one-click WordPress installation.

**Good for:** brochure sites, new businesses, and low to moderate traffic. **Limitations:** performance can vary with your neighbors' activity, resource limits can bite as you grow, and you're usually responsible for keeping WordPress, themes, and plugins updated, although many hosts offer tools that automate some updates.

### Managed WordPress hosting

Hosting built only for WordPress, where the provider handles server tuning, caching, platform security, automatic backups, and usually staging sites (a private copy for testing changes) and WordPress-aware support.

**Good for:** sites where downtime or a broken update costs money, and owners who'd rather not tune servers. **Limitations:** more expensive than shared hosting; WordPress only; some providers restrict certain plugins; email is often not included. Plugin and theme updates usually remain your responsibility unless the plan or an add-on says it handles them.

### VPS (virtual private server)

Your own virtual server, with a set amount of CPU, memory, and storage allocated to you. **Unmanaged** VPS means you run the operating system, web server, security updates, firewall, and backups yourself.

**Good for:** developers and technical owners with specific needs. **Limitations:** you're the system administrator. An unpatched VPS is a liability, and nobody restores it for you if it breaks.

### Managed cloud hosting

A middle ground: the provider sets up and manages servers on a major cloud platform (such as DigitalOcean, AWS, or Google Cloud), and you choose the size and location. You get dedicated resources without managing the operating system.

**Good for:** agencies, growing sites, and businesses running several sites. **Limitations:** more decisions to make (provider, server size, add-ons), usage-based bills that vary month to month, and you still manage the applications themselves.

### Static site hosting

The site is pre-built into plain files (HTML, CSS, images) and served from a global network. With no database or server software of your own to attack or patch, static sites remove most **server-side** risks, and they're fast and cheap or free to run. Services include Cloudflare Pages, Netlify, and Vercel.

**Good for:** brochure sites that change a few times a year. **Limitations:** editing usually needs a developer or a content tool set up for you; contact forms, bookings, and stores need third-party services. Security risks don't disappear: the hosting, code-repository, registrar, and DNS accounts, any third-party scripts or form services, and the build process all still need protecting.

### Hosting for React and Next.js websites

Custom sites built with React frameworks such as Next.js are usually hosted on platforms designed for them (Vercel, Netlify, Cloudflare). They combine static hosting with small server functions for things like forms, and they deploy automatically when the developer pushes code.

Two things to understand before choosing one:

- **Free tiers have rules.** Vercel's Hobby plan, for example, is described in its own pricing FAQ as "for personal, non-commercial use," so a business site belongs on a paid plan.
- **Paid plans mix a monthly fee with usage.** Vercel Pro and Netlify's paid plans include an allowance and then charge for extra bandwidth, requests, or compute. Whether a site stays within the allowance depends on its traffic and features, so check the usage dashboard after launch, and set a spending limit so a traffic spike or a bot can't produce a surprise bill.

A React site on one of these platforms also means you depend on a developer for changes. That's fine if you have one; it's a poor fit if you want to edit pages yourself.

### Hosted website and store builders

Squarespace, Wix, and Shopify (for stores) include hosting, security, and updates, and you edit visually. **Good for:** owners who want to manage the site themselves without plugins or servers. **Limitations:** less flexibility, and moving to another platform later usually means rebuilding the site.

## A decision framework

Answer these in order. The first answer that clearly applies usually decides the hosting type:

| Question | If yes | Hosting type to look at |
|---|---|---|
| Do you want to edit the site yourself, with no developer? | You value ease over flexibility | **Hosted builder**, or managed WordPress if you already know WordPress |
| Is it mainly an online store? | Payments, inventory, and uptime matter most | **Shopify** for most small stores; managed WordPress (WooCommerce) if you need full control |
| Is it WordPress, and does the site bring in real business? | A broken update costs money | **Managed WordPress** |
| Is it a simple WordPress site on a tight budget? | You accept doing updates yourself | **Shared hosting** |
| Does it rarely change, with a developer available? | Speed and fewer server-side risks, with little server upkeep | **Static hosting** |
| Is it a custom React/Next.js site? | Built and maintained by a developer | **A React-focused platform** on a business (paid) plan |
| Several sites, or traffic outgrowing shared hosting? | You need dedicated resources | **Managed cloud** |
| Do you need custom server software? | You (or staff) can run Linux securely | **VPS** |

Then check the details in the next section before you buy.

## What to check besides price

### Domain registration

Your domain name is the most important asset in this whole setup. **Register it in the business's name, in an account the business controls**, even if a developer manages it. The rights described in [ICANN's registrant rights](https://www.icann.org/resources/pages/benefits-2013-09-16-en) belong to the **registrant of record**: the person or business listed as the domain's registered name holder. Make sure that's you.

Registrars often offer to hide your contact details from public lookups, and there are two different kinds of service, as [ICANN explains](https://www.icann.org/en/resources/compliance/complaints/whois/privacy-proxy):

- With a **privacy service**, you stay the registrant of record; only the contact details shown publicly are replaced.
- With a **proxy service**, the proxy company becomes the registrant of record and lets you use the domain under its terms of service, so your control over the domain depends on that agreement.

If you want your details hidden, check which kind your registrar's option is (its terms of service say) and confirm who is listed as the registrant. Also:

- Turn on auto-renew and keep the payment card current. An expired domain takes down your website **and** your email.
- Turn on **registrar lock** (transfer lock) and two-factor authentication on the registrar account.
- Many hosts include a "free domain" for the first year. That's fine, but know the renewal price and how to transfer it out.

### DNS and nameservers

DNS translates your domain into the addresses of your website and email servers. The **authoritative** nameservers are the ones that hold the definitive records for your domain ([Cloudflare's DNS concepts](https://developers.cloudflare.com/dns/concepts/) explains the terms). Your registrar records which **nameservers** are in charge of your domain's DNS; whoever runs those nameservers controls every record. A host that asks you to "point your nameservers to us" is taking over your entire DNS, including email records, not just the website.

What matters:

- **Who controls DNS and who has the login.** Moving hosting is easy when you control DNS; it's painful when an old provider does.
- **Record types you'll touch:** `A`/`AAAA` (website address), `CNAME` (an alias), `MX` (where email goes), and `TXT` (verification and email security records such as SPF and DMARC, explained under [Email](https://jeremiahellington.com/resources/small-business-website-hosting-guide#email-usually-separate-from-the-website)).

*Example records for a site and Microsoft 365 email (values are placeholders)*

```dns
example.com.        3600  IN  A      203.0.113.10
www.example.com.    3600  IN  CNAME  example.com.
example.com.        3600  IN  MX     0 example-com.mail.protection.outlook.com.
example.com.        3600  IN  TXT    "v=spf1 include:spf.protection.outlook.com -all"
_dmarc.example.com. 3600  IN  TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
```

> **Important:**
> These records are **illustrative only**. The Microsoft 365 `MX` target above shows the usual format, but the exact value is specific to each domain: copy the `MX`, SPF, and any other records from your own tenant (Microsoft 365 admin center: **Settings > Domains**, select your domain, then **DNS records**), as [Microsoft's DNS guide](https://learn.microsoft.com/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider) describes, never from an example. Google Workspace and other providers likewise give you the exact values to use.

> **Warning:**
> Changing nameservers, `MX`, or email-related `TXT` records incorrectly can stop email from arriving. Before changing DNS, export or screenshot the current records so you can put them back.

### TLS certificates (the padlock)

TLS (Transport Layer Security) is the technology behind HTTPS and the padlock in the browser: it encrypts the connection between your visitors and your site. It relies on a TLS certificate (often still called an SSL certificate) that proves the site really belongs to your domain.

Every site should load over HTTPS. Most hosts and platforms now provide free automatic certificates (often from [Let's Encrypt](https://letsencrypt.org/how-it-works/)) that renew themselves. Confirm the host includes automatic renewal, and redirect `http://` to `https://`.

### Backups

Ask how often the host backs up, how long backups are kept, how you restore (self-service or a support ticket), and whether restoring or off-site copies cost extra. Then **keep your own copy too**, outside the hosting account; a host's backups won't help if the account is closed or compromised. The [3-2-1 Backup Guide](https://jeremiahellington.com/resources/3-2-1-backup-guide) explains why.

For static and React sites, source control (for example a GitHub repository) holds the site's code and its history, but it's only one part of a backup strategy. Keep a copy outside the Git host, and back up what isn't in the repository: form submissions, content in a CMS, uploaded images, DNS records, and the platform's environment settings.

### Email: usually separate from the website

Some hosting plans include email mailboxes, sometimes only for the first year; others include none. For a business, a dedicated email service such as **Microsoft 365** or **Google Workspace** is usually the better choice: better spam filtering, mobile apps, shared calendars, multi-factor authentication, and your email keeps working when you change web hosts.

Whichever you use, set up three DNS records that prove your email is really from you, so it's less likely to be marked as spam or spoofed:

- **SPF** (Sender Policy Framework) lists which services are allowed to send email for your domain.
- **DKIM** (DomainKeys Identified Mail) adds a digital signature to each message, so the receiving server can check that it came from your domain and wasn't changed on the way.
- **DMARC** (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do with messages that fail those checks (deliver them, send them to spam, or reject them) and can send you reports about it.

Your email provider gives you the exact values to add. Google's [sender guidelines](https://support.google.com/mail/answer/81126) require SPF or DKIM from every sender, and all three from bulk senders. Setting up all three is worthwhile for any business.

### Security and updates

The host secures the server; you're usually responsible for the application. For WordPress:

- Keep WordPress core, themes, and plugins updated, and remove ones you don't use.
- Use strong, unique passwords and two-factor authentication for every admin account.
- Give each person their own account with the lowest role they need.
- Follow the official [WordPress hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/).

Ask whether the host includes a web application firewall, malware scanning, and cleanup if the site is hacked, and whether cleanup costs extra. Static sites remove the plugin and server-patching part of this work, but their accounts, third-party scripts, and form services still need the same care.

### Performance and uptime

For most small-business sites, performance comes down to server location near your customers, caching, image sizes, and not overloading WordPress with plugins. A content delivery network (CDN) helps if customers are spread out. Test your own site with free tools such as Google's PageSpeed Insights before and after any move.

For uptime, look for a written **service level agreement (SLA)** rather than marketing claims, and read what it actually promises; SLAs commonly offer service credits rather than compensation for lost sales. On the pricing pages checked for this guide, stated uptime guarantees varied by host and plan: some standard plans state 99.9%, and some enterprise or custom tiers state up to 99.99%. Either way, read what the SLA covers for the plan you're buying. A free uptime monitor that emails you when the site goes down is worth setting up whatever you choose.

### Support quality

Find out how support works before you need it: chat, tickets, or phone; hours; and whether the team helps with WordPress itself or only the server. Read the provider's documentation: clear, current docs are a good sign of how problems get handled.

### Vendor lock-in

Ask how hard it would be to leave:

- **Domain and DNS** in your own accounts keep you portable no matter where the site is hosted.
- **WordPress** sites can usually move between hosts with a full export of the files and database, though host-specific caching, security plugins, or features may need to be replaced or reconfigured.
- **Hosted builders** usually can't be migrated directly. Some content can often be exported, but the design and layout typically have to be rebuilt elsewhere.
- **Platform-specific features** (a host's own page builder, form service, or serverless functions) tie you to that host. Use them knowingly.

### Ease of maintenance

Ask who will apply updates, renew the domain, check backups, and fix things when a plugin update breaks the site. If the answer is "nobody," choose managed hosting or a hosted builder, or arrange a maintenance plan.

## Comparing popular options

**Kinsta vs. Hostinger vs. Cloudways (plus non-affiliate alternatives)**

How this comparison was made: These options cover the main kinds of hosting a small business is likely to consider: budget shared hosting, premium managed WordPress, managed cloud servers, and three non-affiliate alternatives that are a better fit for some sites. Each was compared on what matters to an owner without a developer on staff: what kind of hosting it is, who handles maintenance, backups, whether email is included, how much technical skill it takes, and how it's priced. Information comes from each provider's published plan and documentation pages on the review date. No speed or uptime benchmarks were run for this comparison, so none are claimed. Three of these companies have affiliate programs; that wasn't a ranking factor, and the "best for" row is about fit, not commission.

| Criterion | Hostinger (Shared, WordPress, cloud & VPS) | Kinsta (Managed WordPress) | Cloudways (Managed cloud servers (Flexible)) | Vercel (Non-affiliate alternative (React/Next.js)) | Static site hosting (for example Cloudflare Pages) (Non-affiliate alternative) | Hosted site builder (for example Squarespace) (Non-affiliate alternative) |
|---|---|---|---|---|---|---|
| Type of hosting | Shared and WordPress hosting on its own control panel (hPanel); cloud and VPS plans also available | Managed WordPress hosting (WordPress only) | Cloudways Flexible: managed servers on the cloud provider you pick (DigitalOcean, Vultr, Linode, AWS, Google Cloud). Cloudways also sells Autonomous, autoscaling WordPress hosting where you don't pick a provider or server size | Platform for static and React/Next.js sites, with serverless functions | Static files served from a global network, with no server or database | All-in-one website builder with hosting included |
| Who handles server upkeep | Hostinger manages the server; WordPress, theme, and plugin updates are usually yours, with some automation tools available | Kinsta manages the server, platform security, and performance; WordPress content, themes, and plugins remain your responsibility unless an add-on covers updates | Cloudways manages the server stack; on Flexible you choose and size the server, and you manage the apps | Vercel runs the platform; your developer maintains the code | No server software to patch; accounts, build settings, and any third-party services still need care | The platform handles hosting, security, and updates |
| Backups | Weekly on the entry web hosting plan; daily on higher tiers (per the plan page) | Automatic daily backups on all plans, kept 14 days on most plans | Automated backups available; off-site backup storage billed per GB. Check what your plan includes | No site backups as such; your code repository plus a separate copy, and backups of data stored elsewhere (forms, CMS) | Source files in Git plus a separate copy; back up anything not in the repository | Platform-managed; limited export options |
| Email mailboxes | Mailboxes included, free for the first year | Mailboxes not included; Kinsta's docs recommend a separate provider such as Google Workspace, Microsoft 365, or Zoho Mail | Not included; mailboxes are a paid per-mailbox add-on | No | No | Via a separate email provider (often offered as an integration) |
| Skill needed | Low | Low to medium | Medium | High (needs a developer) | Medium (needs a static site generator or a developer) | Low |
| Pricing pattern | Advertised prices require paying for a multi-year term up front; plans renew at a noticeably higher monthly price | Fixed monthly or annual plans sized by number of sites and monthly visits or bandwidth | Flexible: billed hourly by server size and provider, invoiced monthly, with extra bandwidth per GB. Autonomous: fixed monthly plans, with autoscaling beyond the baseline billed hourly | Free Hobby plan is for personal, non-commercial use; business sites need Pro (per developer seat plus usage beyond an included allowance) | Free tier with build and file limits; paid tiers for higher usage | Monthly or annual subscription |
| Best for | Brochure sites, new small businesses, tight budgets | Business-critical WordPress sites where support, staging, and backups matter | Agencies and growing sites that want cloud servers without running Linux themselves | Custom React/Next.js sites built and maintained by a developer | Simple brochure sites that rarely change and need to be fast and secure | Owners who want to edit the site themselves without plugins or servers |
| Watch out for | Shared resources; compare renewal pricing and which extras (domain, email) end after year one | Costs more than shared hosting; WordPress only; check the visit or bandwidth limit for your traffic | On Flexible, more decisions to make (provider, server size, add-ons) and bills that vary with usage; you're responsible for app-level updates | Set a spending limit; changes depend on a developer | No built-in editor; forms and e-commerce need third-party services | Hard to move to another platform later; fewer customization options |
| Website | Link on the web page | Link on the web page | Link on the web page | https://vercel.com/ | https://www.cloudflare.com/products/pages/ | https://www.squarespace.com/ |

Last reviewed 2026-10-24. Plans, prices, and features change often; confirm on each provider's site.

## Transparent cost comparison

Hosting is priced in three common ways, and each needs a different check:

- **Introductory multi-year pricing** (common with shared hosting): the advertised monthly price usually requires paying for several years up front, and the plan renews at a higher price. Compare the **renewal** price.
- **Flat monthly or annual pricing** (common with managed WordPress): predictable, with limits on visits, bandwidth, or storage. Check what happens when you exceed them.
- **Usage-based pricing** (managed cloud and React platforms): a base fee plus charges for resources used. Set a budget or spending alert.

Then compare **total yearly cost at renewal**, not the first-year sticker price:

| Cost | Questions to ask |
|---|---|
| Hosting plan | What's the renewal price? Does the low price require a 2–4 year prepayment? |
| Domain | Is it free only for year one? What's the renewal and transfer price? |
| Email | Included, and for how long? How many mailboxes? Or a separate per-user subscription? |
| Backups | Daily backups included? Off-site or more frequent backups as a paid add-on? |
| Security | Is malware cleanup included? Firewall? |
| Usage | Any bandwidth, visit, or compute overage charges? |
| Premium plugins or theme | Annual licenses for forms, SEO, or backups add up |
| Your time or a developer's | Updates, fixes, and changes: who does them, and at what cost? |

## Moving to a new host

1. **Lower the DNS TTL** (time to live) on the records you'll change to a few minutes, at least one full current TTL ahead (often a day), so the switch spreads faster. A lower TTL shortens how long resolvers keep the old answer, but it doesn't make the change instant everywhere: some networks can hold the old record a while longer, so for a short time some visitors may still reach the old host.
2. **Take a full backup** of files and database, and export your DNS records.
3. **Copy the site to the new host.** Many hosts offer free migration, or use a migration plugin.
4. **Test on the new host** using a temporary URL or a `hosts`-file override before changing DNS.
5. **Switch DNS** (`A`/`CNAME` records). **Don't touch `MX` records** unless you're also moving email.
6. **Confirm HTTPS works**, forms send, and email still arrives.
7. **Keep the old hosting for a while before cancelling**, typically a week or two, until you've confirmed visitors, forms, and email have all moved. It isn't a strict rule, but it gives you a fallback if something was missed.

Careful planning keeps any interruption short, but no checklist can guarantee a move with zero downtime; schedule the switch for a quiet time for your business.

> **Caution:**
> Many hosting plans include the domain or email. Before cancelling an old plan, make sure the domain is transferred (or registered elsewhere) and email has moved. Cancelling first can take both offline.

## Recommended setups

| Situation | A good starting setup | Why |
|---|---|---|
| **Simple informational site** for a new business | A hosted builder you edit yourself, **or** static hosting if someone builds it for you; domain in your own registrar account; email on Microsoft 365 or Google Workspace | Low cost and almost no maintenance; easy to move later because you own the domain and email separately |
| **WordPress site for a service business** that brings in leads | Managed WordPress hosting with daily backups and staging, plus your own off-site backup | Less risk from updates and plugins; WordPress-aware support when something breaks |
| **Small online store** | Shopify for most small stores; managed WordPress with WooCommerce if you need full control | Payments, security, and uptime matter more than saving a few dollars |
| **Custom React or Next.js site** | A React-focused platform on a paid business plan, with a spending limit set, and the code in a repository you own | Built for these frameworks; owning the repository makes a later move easier, though platform-specific features may need rework |
| **Growing business with more traffic** or several sites | Managed cloud hosting, or a higher managed-WordPress tier | Dedicated resources without running servers yourself |
| **Owner with no technical staff** | A hosted builder or managed WordPress, plus a maintenance plan with someone you trust | Someone is clearly responsible for updates, backups, and fixes |

Whichever you choose: own your domain, keep email separate, check your backups, and know who's responsible for updates.

## Setup checklist

1. **Register the domain in the business's own account**

   Turn on auto-renew, registrar lock, and two-factor authentication. Note the renewal date.

2. **Decide who runs DNS**

   Keep DNS at your registrar or a DNS provider you control. Export the current records before any change.

3. **Set up business email separately**

   Microsoft 365 or Google Workspace, with SPF, DKIM, and DMARC records in place.

4. **Choose the hosting type with the decision framework**

   Then compare renewal prices, backups, support, and how hard it would be to leave.

5. **Turn on HTTPS and redirects**

   Confirm the certificate renews automatically and that `http://` and `www` redirect to one address.

6. **Arrange backups you control**

   Host backups plus your own off-site copy. For static and React sites, back up the repository outside the Git host and everything not stored in it (forms, CMS content, settings). Test a restore once.

7. **Secure every account**

   Unique passwords and two-factor authentication on the registrar, DNS, host, email, and website admin.

8. **Write down who does what**

   List every account, who has the login, and who handles updates, renewals, and fixes.

9. **Add monitoring**

   A free uptime monitor, and a calendar reminder to check backups and renewal dates.

## Next steps

- Make a list of every account involved (registrar, DNS, hosting, email) and who has the login.
- Check your domain's renewal date and turn on auto-renew today.
- Secure those accounts with the [Small Business Cybersecurity Checklist](https://jeremiahellington.com/resources/small-business-cybersecurity-checklist).
- Plan your backups with the [3-2-1 Backup Guide](https://jeremiahellington.com/resources/3-2-1-backup-guide).

---

## Sources and official documentation

- [ICANN: Registrant rights and responsibilities](https://www.icann.org/resources/pages/benefits-2013-09-16-en)
- [MDN: What is a domain name?](https://developer.mozilla.org/en-US/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_domain_name)
- [ICANN: About privacy/proxy registration services](https://www.icann.org/en/resources/compliance/complaints/whois/privacy-proxy)
- [Cloudflare docs: DNS concepts (authoritative DNS, nameservers, records)](https://developers.cloudflare.com/dns/concepts/)
- [Let's Encrypt: How it works](https://letsencrypt.org/how-it-works/)
- [WordPress.org: Hosting requirements](https://wordpress.org/about/requirements/)
- [WordPress Developer Resources: Hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/)
- [Microsoft Learn: Connect your domain by adding DNS records (Microsoft 365)](https://learn.microsoft.com/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider)
- [Google: Email sender guidelines (SPF, DKIM, DMARC)](https://support.google.com/mail/answer/81126)
- [Kinsta: plans and pricing (checked 2026-10-24)](https://kinsta.com/pricing/)
- [Kinsta docs: Email (Kinsta doesn't host mailboxes; checked 2026-10-24)](https://kinsta.com/docs/wordpress-hosting/mykinsta-tools/email/)
- [Hostinger: web hosting plans (checked 2026-10-24)](https://www.hostinger.com/web-hosting)
- [Cloudways: pricing (checked 2026-10-24)](https://www.cloudways.com/en/pricing.php)
- [Vercel: pricing and plan FAQ (checked 2026-10-24)](https://vercel.com/pricing)
- [Netlify: pricing (checked 2026-10-24)](https://www.netlify.com/pricing/)
- [Cloudflare Pages: limits (checked 2026-10-24)](https://developers.cloudflare.com/pages/platform/limits/)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-24
- Editorial review: Jeremiah Ellington, 2026-10-24