Your 10-Point Web Hosting Checklist – Leave No Box Unticked!

First published in 2014, rewritten in 2026 so the advice holds today.

Choosing hosting used to mean comparing shared, VPS and dedicated packages from a handful of providers. For most online stores today, the decision starts earlier: which platform are you on, and does that platform even give you a hosting choice? Shopify and BigCommerce bundle hosting in. WooCommerce, Adobe Commerce (Magento) and headless builds still need you to pick infrastructure. Either way, the checklist below still holds, with a few updates for how things actually work now.

The checklist

• Cost. Still not the whole story. A bargain-basement plan for a transactional site that takes payments is a false economy: if it goes down during a sale, the loss dwarfs anything you saved. Work out what similar businesses typically pay for your traffic and stock level, and treat anything wildly cheaper as a warning sign, not a win.
• Fit for purpose. Some providers specialise in brochure sites and hobby blogs, others in serious e-commerce. Ask what they already host at your kind of order volume. If you're on Shopify or BigCommerce this is largely handled for you; if you're self-hosting WooCommerce or Magento, it matters a great deal.
• Technical capacity. RAM, CPU and storage questions haven't gone away, but cloud hosting has changed the economics: many providers now let you scale resources up automatically during peak trading (Black Friday, a viral product) and pay for what you use, rather than provisioning for the worst day of the year all year round. Ask specifically how traffic spikes are handled.
• Support. A ticket queue with a multi-day wait is still unacceptable for a live store. Expect 24/7 phone or live chat with a human able to escalate properly, not just a chatbot reading a script. Chatbots are fine as a first line; check what happens when the issue is genuinely urgent.
• Uptime guarantees. 99.99% remains the sensible baseline, and it's worth asking what actually happens if they miss it: service credits, an apology, or nothing. A published, historical status page is more useful than a promise on a sales page.
• Room to grow. Can you add resources, storage or extra environments without a renegotiation or a big bill? Cloud-based plans usually make this straightforward; older-style fixed shared packages often don't. Ask about the cost of scaling up, and of scaling back down.
• Independent feedback. Testimonials on the provider's own site tell you what they want you to hear. Check Trustpilot, independent review sites and forums for their category of hosting specifically, not just the brand name generally.
• Security and compliance. This one has moved on the most since 2014. SSL/TLS certificates are now standard and often free (Let's Encrypt), so that's no longer a differentiator on its own. What matters now is PCI DSS compliance if you're handling card data directly, clear data residency (UK or EU hosting, relevant since GDPR), and a straightforward answer on how they patch and monitor for vulnerabilities.
• The management interface. cPanel and Plesk are still widely used for traditional hosting. If you're on a managed e-commerce platform, this question largely disappears, replaced by "how good is the platform's own admin and app ecosystem". Either way, you'll live in this interface daily, so try it before you commit.
• Guarantees in writing. Support response times, uptime, low-price promises, exit terms: anything a provider says out loud should also appear in the contract or SLA. If it's only a claim on the marketing page, it isn't a guarantee.

What's changed since the original checklist

A few points from the 2014 version are worth retiring outright rather than updating:

• Treating an SSL certificate as a premium extra worth asking about. It's now a basic requirement, free in most cases, and Google has flagged non-HTTPS sites as "not secure" in Chrome since 2018.
• Assuming a single physical or virtual server is the only option. Cloud hosting with auto-scaling is now mainstream and often cheaper in practice for stores with seasonal spikes, because you're not paying for peak capacity all year.
• Judging speed on server specs alone. Since 2021, Google's Core Web Vitals have been a ranking factor, so page loading performance for the actual customer, not just server benchmarks, is worth testing directly.

Questions worth asking before you sign

1. What happens to my site during a genuine traffic spike, and what does that cost?
2. Where is my data physically hosted, and does that satisfy our GDPR obligations?
3. What's your PCI DSS position if we're storing or processing card data?
4. Can we leave without penalty if the service doesn't meet the SLA?
5. What's your backup frequency and how quickly can you restore?

The fundamentals from 2014 still stand: don't buy on price alone, don't trust "unlimited" without reading the small print, and check support and uptime promises are backed by something in writing. What's changed is where the real decision now sits. For a lot of UK online stores, the harder choice isn't which hosting company to pick, it's which platform to build on in the first place, because that choice often makes the hosting question for you.