Web Hosting Services: What’s Included, What Costs Extra, and What to Ask

If you search for “web hosting services”, you’ll see everything from “$2.99/mo hosting” to “fully managed infrastructure.” The problem is that the phrase hosting services is vague: one provider may only rent you server space, while another will actively monitor, patch, back up, and help fix issues when something breaks.

This guide breaks hosting into common service tiers, lists what you should expect to be included (and what often costs extra), highlights red flags, and gives you 10 questions to ask before switching providers.

What “web hosting services” usually includes (at a minimum)

Regardless of tier, most providers include:

• A place to run your site (storage + compute)
• Networking (IP connectivity)
• Some level of server-side maintenance (varies a lot)
• A support channel (quality varies even more)

The difference is where responsibility starts and ends: who patches what, who monitors what, and who helps when you’re stuck.

Common hosting service tiers (and what you should expect in each)

Below is a practical “tier map” you can use when comparing providers.

1) Bare server / cloud instance (IaaS VPS)

Best for: dev teams who want full control.

• You manage: operating system, web stack, database, app, backups (in most IaaS setups).
• Host manages: datacenter, physical hardware, core cloud infrastructure.
• Watch-outs: it’s easy to underestimate patching + monitoring work.

(Reference: AWS Shared Responsibility Model — see Sources)

2) Unmanaged VPS / Dedicated

Best for: sysadmins and teams that want a custom stack but can run it themselves.

• You manage: OS + everything above it.
• Host manages: hardware/network uptime (and sometimes basic replacement/remote hands).
• Watch-outs: patching, monitoring, and incident response become your job.

3) Standard shared hosting

Best for: small business sites, blogs, brochure sites, and early-stage stores.

• You manage: your app (WordPress/plugins/themes), content, and day-to-day site changes.
• Host manages: server stack, platform maintenance, baseline security hardening.
• Watch-outs: resource limits (CPU/RAM/IO/concurrency/inodes) can throttle performance if they’re unclear.

(Reference: CloudLinux LVE limits — see Sources)

4) Managed WordPress hosting

Best for: WordPress sites that need speed + help without running servers.

• You manage: mostly content + plugins (depending on provider policy).
• Host manages: WordPress-focused performance tuning, backups, staging, update tooling, expert support.
• Watch-outs: some managed hosts restrict certain plugins; check first.

(Reference: WP Engine managed hosting overview — see Sources)

5) Semi-dedicated / high-resource shared

Best for: busy sites, WooCommerce, and agencies that need more headroom than typical shared hosting.

• You manage: similar to shared (your site/app and content).
• Host manages: tuned stack + higher resource allocation/isolation.
• Watch-outs: “semi-dedicated” means different things—ask for the actual resource caps.

6) Fully managed VPS / Dedicated

Best for: businesses that want dedicated resources without sysadmin workload.

• You manage: primarily your site/app.
• Host manages: OS patching, stack tuning, monitoring, backups, and security response (scope varies).
• Watch-outs: confirm whether “managed” is OS-only or includes application help (e.g., WordPress debugging).

7) Enterprise / mission-critical

Best for: larger orgs, regulated workloads, and strict uptime requirements.

• You manage: depends on contract and architecture.
• Provider manages: SLA-backed operations, incident response, compliance options.
• Watch-outs: SLAs often include exclusions and remedies are usually service credits.

(Reference: Google Cloud Compute Engine SLA — see Sources)

What’s typically included vs. what often costs extra

Every host bundles features differently, but these are common patterns.

Usually included in a solid hosting plan

• SSL/TLS certificates (many providers use Let’s Encrypt)
• Basic monitoring (uptime checks and internal alerts)
• Routine platform maintenance (scope varies by tier)
• Some form of backups (details matter — see below)
• Support access (ticket/chat/phone depending on provider)

Common paid add-ons (or “included, but only on higher tiers”)

• Migrations (especially white-glove or complex)
• Malware cleanup / incident response (often billed per incident)
• Extended backup retention (30–90+ days), offsite replication, or immutable backups
• Premium support SLAs (priority queues, guaranteed response times)
• WAF and advanced security controls
• DDoS protection
• Control panels (cPanel/Plesk licensing can materially affect VPS/dedicated pricing)
• Staging environments and developer tooling (common on managed WordPress)
• Dedicated IPs (sometimes needed for special email setups or legacy apps)
• Performance layers (CDN, image optimization, advanced caching)

Tip: Don’t compare hosts on the headline price. Compare on the total monthly cost to run your site the way you actually need to run it.

Backups: the feature everyone claims… but rarely defines

Backups are where “included” can become meaningless. Ask for specifics:

• Frequency: daily? hourly? continuous?
• Retention: 7 days? 30 days? longer?
• Storage location: same server (risky), same datacenter, or offsite/geo-redundant?
• Restore method: self-serve restores vs. paid “restore service”
• Restore speed: minutes vs. days (especially for large sites)

If you want to be precise, use two disaster-recovery metrics:

• RPO (Recovery Point Objective): how much data loss is acceptable (e.g., “up to 4 hours of data”)
• RTO (Recovery Time Objective): how much downtime is acceptable before you’re back online

(Reference: Microsoft Learn on RPO/RTO — see Sources)

Uptime promises: “99.9%” can still be a lot of downtime

Many hosts advertise uptime numbers, but an uptime percentage isn’t the same as a business guarantee.

• 99.9% uptime allows about 43 minutes 50 seconds of downtime per month.
• Over a year, 99.9% allows about 8 hours 45 minutes of downtime.

Also, a formal SLA often comes with:

• Conditions (configuration requirements, exclusions, maintenance windows)
• Remedies that are usually service credits, not refunds

(References: Uptime calculator + Google Cloud SLA — see Sources)

Red flags when evaluating web hosting services

Watch out for these common patterns:

• Unclear resource limits: CPU, RAM, IO, concurrent processes/entry processes, inodes
• Vague “uptime guarantees” without clear measurement and remedies
• Backups mentioned, but no retention/offsite/restore details
• “Unlimited” claims with no published fair-use policy or technical caps
• Support that’s only scripted (no escalation path to real engineers)
• Cheap intro pricing + huge renewals, or critical features gated behind add-ons
• No clear migration plan, especially if you run email + site + DNS together
• Security sold as a buzzword without specifics (patching scope, WAF, DDoS, cleanup options)

The 10 questions to ask before you switch hosting providers

Use this exact list on sales chats. If a provider answers clearly, that’s a good sign.

1. What’s included in the base plan—monitoring, patching, backups, migrations, hands-on help?
2. What are the hard limits on my plan? (CPU, RAM, IO, concurrency/entry processes, disk/inodes)
3. Who patches what? (host OS, web stack, database, WordPress core/plugins/themes)
4. What’s your backup policy—frequency, retention, offsite location, restore steps, and is restore self-serve?
5. What are your restore targets (RPO/RTO), or at least “how much data could I lose” and “how long to get back online?”
6. How does migration work—what’s included, what’s excluded, and what downtime should I expect?
7. What’s your security scope—WAF/DDoS mitigation, malware scanning, and cleanup options?
8. How do you handle performance—caching layers, supported versions, database tuning, CDN support?
9. What does support look like—hours, channels, escalation path, and who actually answers?
10. What will my bill look like in 12 months—renewal pricing, add-ons, and the upgrade path?

Why shared hosting services are still a great fit for most small businesses

Shared hosting gets dismissed because the cheapest shared plans in the market are often oversold. But high-quality shared hosting can be an excellent solution when it’s engineered well:

• Resource isolation to prevent “noisy neighbors” problems
• Modern stack tuning (OPcache, HTTP/2/3 where available, tuned DB settings)
• Real backups with restore points
• Fast, competent support

If your site is a typical small business site, blog, portfolio, or service business—shared hosting is often the best price-to-performance choice.

Where Maiahost fits (and why it’s a smart shared-hosting choice)

Maiahost is built around a simple idea: hosting should come with real help—not long wait times or outsourced scripts.

Our most popular option is Managed WordPress Hosting on shared infrastructure designed for reliability and consistent performance:

• Maia Single: for 1 website
• Maia Multiple: for up to 6 websites on one account
• Semi-Dedicated: for bigger sites, WooCommerce, and agencies that need more headroom
• Plus custom VPS/Cloud/Dedicated options when you truly need a special environment

What makes our shared hosting services different:

• Experienced developers on the support side
• A reliability-first approach (no “race to the bottom” overselling)
• Clear guidance on the right tier so you don’t overpay—or outgrow your plan unexpectedly

If you’re comparing providers, use the 10 questions above. If you want a straight answer for your specific site, talk to an expert and we’ll map your needs to the right plan.

Sources (plain list, no footnotes)

• AWS: Shared Responsibility Model — https://aws.amazon.com/compliance/shared-responsibility-model/
• Let’s Encrypt (ISRG): About Let’s Encrypt — https://letsencrypt.org/
• Uptime.is: SLA/Uptime calculator — https://uptime.is/
• Google Cloud: Compute Engine Service Level Agreement (SLA) — https://cloud.google.com/compute/sla
• Microsoft Learn: RPO and RTO (business continuity concepts) — https://learn.microsoft.com/en-us/azure/reliability/concept-business-continuity-high-availability-disaster-recovery
• CloudLinux Docs: Resource limits / LVE — https://docs.cloudlinux.com/cloudlinuxos/limits/
• Namecheap KB: Resource limits (LVE) explainer — https://www.namecheap.com/support/knowledgebase/article.aspx/1127/103/a-handy-guide-to-resource-limits-or-what-is-lve/
• Cloudflare: DDoS protection overview — https://developers.cloudflare.com/ddos-protection/
• Cloudflare Learning: What is a WAF? — https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/
• WP Engine: Managed WordPress hosting overview — https://wpengine.com/managed-wordpress-hosting/
• cPanel: Pricing & licensing — https://www.cpanel.net/pricing/