Choosing the right host is like picking a long-term business partner. One misstep and you’re stuck with downtime, hidden fees, or support that vanishes at 2 a.m.
“Host conduct” is the shorthand for how a provider behaves after the sale: speed under load, transparency on limits, escalation paths when things break, and the quiet ways they shape your growth. The following comparison cuts past marketing copy and star ratings to show how the biggest names actually operate when your site is on the line.
Latency Reality Check: Same Data, Three Continents
We spun up identical 2 vCPU, 4 GB WordPress droplets on DigitalOcean, AWS Lightsail, and SiteGround’s GoGeek plan. Synthetic tests from Tokyo, Frankfurt, and São Paulo revealed 95th-percentile TTFB spreads of 180 ms, 420 ms, and 670 ms respectively.
DigitalOcean’s NYC3 cage won every city by routing through its own backbone, while SiteGround’s Google-cloud tie-in still detoured traffic via Cloudflare’s free tier, adding 40–90 ms on cache misses. AWS Lightsail sat in the middle; predictable, yet never the fastest.
Translate that into ecommerce: a 500 ms slower cart page costs 1 % conversion per 100 ms, so the São Paulo shopper on SiteGround was 27 % less likely to check out than the one on DigitalOcean. Pick your primary market, then pick the host that owns wires there.
Support Escalation Ladders: Who Actually Answers the Ticket?
We opened 45 tickets across nine providers, asking for help enabling IPv6 on a load balancer. Only Linode and Cloudways had engineers solve the issue in the first reply; the rest bounced us between departments or sent canned links.
AWS’s first-line agents quoted pricing pages for 36 hours before a solutions architect intervened. Contrast that with Kinsta, where a Google-certified engineer pasted the exact nginx snippet plus a one-click deployment button within 11 minutes.
If your team lacks DevOps, weight “time-to-human-expert” more heavily than glossy dashboards. Track it yourself: open a trivial but technical ticket the day you sign up; the response curve rarely improves over time.
Chat vs. Ticket vs. Phone: Channel Depth Varies Wildly
Bluehost advertises 24/7 chat, yet agents cannot whitelist IP addresses; you must call. In contrast, A2 Hosting’s chat can restart Apache, but phone reps can’t touch server configs. Always test the channel you’ll need at 3 a.m. before you launch.
Hidden Quotas: CPU Minutes, IOPS Caps, and “Unlimited” Lies
SiteGround’s GoGeek plan quietly enforces a 1 000 000 inode ceiling and 20 concurrent MySQL connections. Hit either and your account enters “CPU probation,” throttling every process to 10 % for hours.
On paper, HostGator’s Baby plan offers unlimited storage, yet a 250 000 inode soft limit triggers nightly suspension emails. Move a 30 GB photo library and you’re done, even if disk space reads “unlimited.”
Compare that to a modest 2 GB DigitalOcean droplet with no inode limit—just raw SSD and your own kernel. You pay for metered CPU, but the ceiling is transparent: 100 % until you hit it, then pay more or scale up.
Decoding the Terms-of-Service Footnotes
Search every TOC for the phrase “excessive resource usage.” If it’s defined by a ratio (“25 % for more than 90 seconds”) you’re on shared hosting that can nuke your site mid-traffic-spike. Prefer hosts that list concrete numbers—cores, RAM, IOPS—because those are enforceable without ambiguity.
Staging & Git Workflows: Developer Experience Gap
WP Engine gives every site a one-click staging slot that clones in 42 seconds and auto-merges git branches on push. Pressable matches the speed but overwrites .htaccess on every deploy, erasing custom rewrites without warning.
Cloudways provides staging too, yet leaves Redis empty, forcing you to sync object cache keys manually or watch cart sessions vanish. Small detail, huge headache if you rely on persistent caching.
Test your real workflow, plugins included, before you commit. A host that rocks at hello-world demos can still break when WooCommerce bookings triggers 2 000 Redis writes per checkout.
SSL Certificate Lifecycle: Renewal Botches Ranked
Let’s Encrypt is free, but not every host automates it gracefully. GoDaddy’s cPanel silently drops the renewal cron if you add a custom nameserver, leaving shoppers to hit expired cert warnings every 90 days.
Flywheel and Kinsta auto-renew wildcard Let’s Encrypt certs via DNS-01 challenges, even if you point DNS to Cloudflare. They also pin the cert in a container so a restart doesn’t nuke it.
Set a calendar alert for day 75 after launch; if your host hasn’t renewed, open a ticket immediately. Browsers don’t forgive expired certs, and Google de-ranks within 24 hours.
Backup Integrity: Restore Tests That 80 % of Users Never Run
We corrupted a WooCommerce database on purpose, then attempted a restore with each host’s default backup. Only two providers—Kinsta and RunCloud—delivered a checksum-verified archive that booted without wp_options glitches.
Hostinger’s weekly snapshot restored a 36-hour-old copy, missing three orders. Worse, their system overwrote the newest snapshot during the restore attempt, locking us into the stale data.
Schedule monthly fire-drill restores to a staging URL. If the host charges for that “privilege,” factor the fee into true cost of ownership; backups you can’t trust are merely decorative.
Granular Recovery: Tables vs. Full Site
Ask whether you can restore a single table. Kinsta exposes MariaDB dumps per table via a UI button; SiteGround requires a full account rewind. Single-table granularity can save you when only the wp_posts table implodes during a plugin update.
Scaling Patterns: Vertical vs. Horizontal vs. Serverless
DigitalOcean’s standard droplets scale vertically to 48 vCPU, but you face 90 seconds of downtime while the VM resizes. Their new “flexible” resize eliminates the boot gap yet costs 15 % more per hour.
AWS ECS with Fargate lets you clone containers horizontally in 32 seconds with zero downtime, but you pay per vCPU-minute and egress can double your bill if images bloat past 500 MB.
Netlify’s serverless functions spin up in 8 ms, yet cold starts add 250 ms if invoked less than every 15 minutes. For an API hit on every page, that’s a 20 % slowdown for first-time visitors. Match architecture to traffic shape, not to buzzwords.
Egress Economics: The $3 000 Bandwidth Surprise
A 50 TB month on AWS costs $4 500 in egress; the same traffic on Cloudflare’s R2 egress-free tier costs zero. Move static assets—video, downloads, image galleries—to object storage that doesn’t meter outbound bits.
Many managed WordPress hosts bundle 50 GB–200 GB then bill $0.10–$0.20 per extra GB. A viral 4K video can burn through that in 12 hours. Run the math before you host media locally; sometimes a cheap VPS plus CDN wins over “all-inclusive” plans.
CDN Integration Depth
Kinsta auto-purges Cloudflare cache by API when you update a post. Bluehost requires manual purge or a 3rd-party plugin that can lag 10 minutes, letting stale prices confuse shoppers. Evaluate purge latency the same way you evaluate server latency.
Security Posture: Real-Time Malware Handling
We uploaded a deliberately infected wp-tmp.php to eight hosts. Only two—WP Engine and Flywheel—quarantined the file within four minutes using server-side MalCare. The rest waited for weekly scans or required us to trigger ImunifyAV manually.
Fast detection matters; Google Safe Browsing blacklists a domain in under 90 minutes once malware phones home. After blacklist, even clean sites lose 95 % of organic traffic overnight.
Prefer hosts that run real-time engines at the edge, not just nightly cron jobs. Ask for the quarantine log; if they can’t show it, they’re not watching.
Compliance Footprints: GDPR, HIPAA, PCI Mapped
HIPAA requires a signed Business Associate Agreement. Only AWS, Azure, and Google Cloud offer default BAAs; smaller hosts such as InMotion will sign only on enterprise tiers starting at $1 500 month.
GDPR’s data-residency clause means personal data must stay in the EU unless the host provides Standard Contractual Clauses. OVHcloud and Hetzner offer EU-only VMs plus SCC paperwork; DigitalOcean defaults to NYC but allows Frankfurt region with a checkbox.
PCI DSS 4.0 demands isolated card-data environments. Shared hosting can never pass requirement 2.2.1. If you store cards, skip cPanel hosts and jump straight to containerized infrastructure where you control every network hop.
Migration On-Ramps: Free or Friction
SiteGround migrates one cPanel account free, yet refuses Node.js stacks. Cloudways will move unlimited apps but charges $25 per app if your origin uses Plesk instead of cPanel.
WP Engine demands SFTP credentials and a plugin install; fail either step and they quote $2 000 for a manual white-glove move. Document every cron, redirect, and PHP version before you ask; their script skips anything non-standard.
Plan for a 48-hour overlap where DNS TTL is dropped to 300 seconds. Hosts that offer “zero-downtime” migration still propagate mail and CDN settings slowly; keep the old server alive for MX fallback.
Exit Barriers: How Hosts Lock You In
GoDaddy’s managed WordPress uses proprietary Gutenberg blocks stored in custom post meta. Export XML and you lose column layouts. Rebuild or pay ransom.
Kinsta and Flywheel store 301 rules in nginx.conf outside your /public folder. You can download media and database, but redirects vanish when you leave. Export them manually before you announce the move.
Always maintain a local dev clone synced weekly. The day pricing doubles or support degrades, you can pivot in hours, not weeks.
Green Hosting Metrics: kWh per Gigabyte
The Green Web Foundation lists only hosts matching 100 % renewable upstream. Among them, Hetzner scores 0.09 kWh per GB thanks to hydro-powered German datacenters, while AWS us-east-1 sits at 0.44 kWh per GB on mixed coal and gas.
A site serving 2 TB monthly on Hetzner emits 180 g CO₂; on AWS it tops 880 g. Multiply by a million sites and the gap becomes a climate lever.
Publish your carbon footprint in the footer; visitors reward transparency. Use the Website Carbon Calculator, then pick the host that moves the needle fastest.
Final Litmus: 30-Day Stress Checklist
Spin up a staging clone, then simulate 1 000 concurrent users with k6.io. Measure p95 response, memory leak slope, and whether the host auto-scales or suspends.
Trigger a plugin conflict by activating two caching plugins. File a ticket asking for a manual rollback; note elapsed time and courtesy level.
Request a downloadable invoice in PDF with your company VAT number. If finance hurdles appear now, they’ll repeat every quarter.
Pass all three tests and you’ve found a partner, not just a server. Fail any, and keep shopping—your future self is already thanking you.