Web hosting: what really matters

Web hosting is the first line in the budget to get cut. That is understandable: it is a recurring cost for something invisible, and the difference between €15 and €60 a year looks like an easy saving. Until the site answers in three seconds instead of one, or until something breaks and you discover the last backup is four months old.

This article explains what you are actually buying when you pay for hosting, the seven criteria that matter for a business website, why email should not live with the same provider, and how a site gets moved without visitors noticing.

Why cheap hosting costs you more
Types of hosting, in business terms
How much space and what resources a business website needs
The seven criteria that matter
Backups: who makes them and how to check
Email on your own domain
Signs that you need to change host
How to test your own server
Security: what is the host’s job and what is not
How a site is moved without downtime

Why cheap hosting costs you more

Very cheap hosting is not cheap because the provider is generous. It is cheap because there are a great many sites on the same server.

The consequences, in the order they show up:

Slow response times. The server is handling requests for hundreds of sites. Yours waits its turn.
Troublesome neighbours. A site on the same server that eats resources takes them from everyone else.
No real backups. “Backup included” often means a weekly copy on the same disk — useless in exactly the situation where you need it.
Slow support. At a few euros a month there is no economic model for competent support.

The cost you do not see

A server response time of 800 milliseconds instead of 200 means every page starts half a second down. It adds to everything else and can push you out of the loading threshold Google considers good. Details in Core Web Vitals explained for business owners.

The annual difference between poor hosting and good hosting for a business website is usually under €100. The difference in outcome is disproportionately larger.

Types of hosting, in business terms

Type	Analogy	Who it is for	Relative cost
Shared	a flat in a block	business website, blog	small
VPS	a flat with its own meter	online store, medium traffic	medium
Dedicated	a house	applications, heavy traffic	large
Cloud	a hotel room, you pay for the nights	unpredictable traffic	variable
Static / CDN	a shop window on the high street	a site with no database	very small

For a business website

Good-quality shared hosting is enough in the overwhelming majority of cases. A business website does not need a server of its own; it needs a well-administered shared one.

It is also worth knowing that a site built as static files — no database, no code executed on every request — has minimal hosting requirements and is immune to a whole class of security problems. The subject is covered in WordPress or a static site.

How much space and what resources a business website needs

An ordinary business website, with 10–20 pages and optimised images, takes up under 1 GB of space and uses minimal resources. In practice, any hosting plan on the market is enough on space. What matters is not how much space you get, but how fast the server answers, how often backups are made, and how quickly you get help when something goes wrong.

Which is why advertisements offering “unlimited space” are a sales point with nothing behind them: nobody with a business website has ever run out of space.

The seven criteria that matter

1. Where the server is

A server in Romania answers Romanian visitors faster. The difference against a server in western Europe is tens of milliseconds — not enormous, but free if your audience is local.

2. Response time

The best indicator of real quality. It is measured as TTFB — time to first byte — and shows how long it takes the server to start answering. Under 200 milliseconds is good, over 600 is a problem.

You can test it with the public page speed tools: the value appears in the detailed report.

3. SSL certificate

Mandatory, not optional. A site without https gets a security warning in the browser. Free automatic certificates are perfectly adequate for a business website — do not pay for a commercial one without a specific reason.

4. Backups

See the dedicated section below. It is the criterion fewest people check and the one that matters most.

5. The PHP version and the control panel

If the site runs on a platform that needs PHP, check which versions are available. A provider offering only versions that are out of support is a warning sign — old versions no longer get security fixes.

6. Support

Test it before you buy. Send a simple technical question and time the reply. An answer within two hours from someone who understood the question is worth more than any specification.

7. The migration policy

Check from the outset how easily you can take your site and leave. A good provider gives full access to files and databases. One that makes exporting difficult is telling you something about how the relationship will go.

Backups: who makes them and how to check

The three questions

How often is it made? Daily is the reasonable standard for a site that changes. Weekly is acceptable for a static one.
Where is it stored? On another server, in another physical location. A copy on the same disk does not help when the disk fails.
How long is it kept? Seven days minimum, ideally 30. Some problems are discovered weeks later.

The test nobody does

Ask for a restore. Once, at the beginning. A backup you have never restored is an assumption, not a safeguard.

We have seen plenty of cases where backups existed and were unusable: truncated files, incomplete databases, corrupt archives. You find out on exactly the day you need them.

The 3-2-1 rule, simplified

Three copies, on two types of medium, one of them somewhere else. For a business website, in practice: the provider’s copy, an automatic copy to an external service, and an archive downloaded locally and refreshed periodically.

Email on your own domain

An @company.ro address is a matter of basic credibility. A free webmail address on a company business card says something you do not want to say.

Why not with the same provider as the site

The counter-intuitive but practical recommendation:

If the hosting server has a problem, you lose both the site and the email — including the ability to communicate about the problem.
Deliverability is better with a specialist email provider. Shared servers frequently end up on block lists because of other sites on the same IP address.
Moving the site becomes simple: you change only the site’s records, and the email stays untouched.

The cost of a dedicated email service for a few mailboxes is small. It is worth it.

What has to be configured

Three records in the DNS zone — SPF, DKIM and DMARC — which demonstrate that emails sent from your domain are legitimate. Without them, your messages land in spam systematically, and your domain can be used by someone else to send messages in your company’s name.

It is an hour’s configuration, done once, and one many people skip.

Signs that you need to change host

The site is visibly slow, especially on first load, and the tools show a TTFB over 600 ms.
You have had more than one unexplained outage in recent months.
Support replies in more than 24 hours, or replies with boilerplate.
You cannot choose the PHP version.
There are no automatic backups, or you cannot restore one yourself.
The renewal price is far above the first year, with no improvement.
You want to migrate and are told it may not be possible.

One point on its own is not necessarily a reason to change. Three are.

How to test your own server

Three checks you can run without technical knowledge, in ten minutes.

1. Server response time

Open a public page speed tool, enter your address, and look in the detailed report for the TTFB value — time to first byte, sometimes labelled “initial server response”.

Value	Interpretation
under 200 ms	good
200–600 ms	acceptable
over 600 ms	the server is the problem

What matters to understand: TTFB is the time before the browser receives anything. It adds to absolutely everything else. A server that answers in 900 ms uses up a third of your 2.5-second loading budget before a single image has started to download.

2. Availability

Why it is worth it: most short outages go unnoticed. If the site goes down three times a month for ten minutes, you never find out — but Google, which checks the site several times a day, does.

After a month of monitoring you have a factual answer to “is my hosting any good?”.

3. Compression and caching

Open your browser’s developer tools (F12), go to the network section, reload the page, and look at the response headers for the stylesheet and script files:

content-encoding has to be there. Its absence means files sent uncompressed — several times larger than they should be.
cache-control has to be there on static resources. Without it, a returning visitor downloads everything again.

Both are configured on the server, once. Their absence is the quickest sign that nobody has ever looked at the configuration.

Security: what is the host’s job and what is not

A distinction that avoids arguments after an incident.

What is the provider’s responsibility

Physical and network security.
Updates to the operating system and the web server.
Isolation between accounts on the same shared server.
Basic filtering of volumetric attacks.
The availability of backups.

What is your responsibility

Updating the platform and its extensions.
Passwords and two-factor authentication.
Who has access and at what level.
What code you upload to the server.
Checking that restoring from a backup works.

Where incidents actually happen

Almost always in the second list. A well-administered server with an un-updated platform gets compromised; a mediocre server with a static site and no admin panel, almost never.

The consequence: if you want to reduce security risk with a single step, reduce the attack surface. A site that does not execute code on every visit and has no admin panel has nothing to break into. See WordPress or a static site.

The four measures with the best effort-to-result ratio

Two-factor authentication on the hosting account and on the registrar account.
Unique, generated passwords, in a password manager.
Separate accounts for each person, with the minimum level needed. Not one administrator account used by four people.
One tested restore. So that you know it can be done.

How a site is moved without downtime

The procedure, in order. Followed properly, visitors notice nothing.

48 hours before

Reduce the TTL on the DNS records to 300 seconds. TTL tells servers around the world how long to remember your current address. With a high value, the change propagates over days; with a low one, over minutes. This has to be done in advance, because the TTL change itself propagates at the old speed.

Moving day

Copy everything to the new server: files, databases, configurations.
Test on the new server without changing DNS — through the local hosts file or a temporary subdomain. Check every page and every form.
Issue the SSL certificate on the new server, before switching.
Freeze changes on the old site for a few hours, so no content gets created and then lost.
Switch the DNS.
Leave the old server running for at least 72 hours. Traffic migrates gradually; switched off too early, some visitors reach nothing.
Check the email. If it is with the same provider, this is the part with the greatest risk of lost messages.

Afterwards

Put the TTL back to a normal value, check the forms again from a real device, and watch the errors in Search Console for a few days.

We host both the projects we build ourselves and sites developed by other agencies, on servers in Romania. See what the web hosting service includes, or write to us if you want an opinion on your current set-up.