Website hosting vs. website management: what are you really paying for?
Your host keeps the server running. That's a real job, and it isn't the same job as looking after your website. Many of the surprises owners run into after an outage live in the space between the two.
Website hosting keeps the server your site runs on working. Website management looks after the website itself: updates and testing, backups you can restore, security inside the site, forms, and fixes when something breaks. They're different jobs, often done by different companies.
A lot of business owners assume that because they pay for hosting, someone is looking after their website. Then an update breaks the checkout, or the contact form stops sending, and the host's support team explains, politely, that the website itself isn't something they manage.
They're usually right, and sometimes nobody is doing the second job at all.
What hosting covers
Hosting is the infrastructure your website runs on: the servers, the storage, the network connection, and the software on the server that runs your site. A good host keeps that equipment working, secure, patched and fast, and it's genuinely skilled work.
Large cloud providers describe this with a model they call shared responsibility: the provider secures the infrastructure, and the customer is responsible for what they put on it. WordPress's own security documentation says the same about web hosts: they're often responsible for the infrastructure your site sits on, but not for the application you install on it. Whatever runs on the server, the website, its software and its data, is yours unless your plan clearly says otherwise.
What management covers
Website management, or maintenance, is the website itself. That means keeping WordPress, the theme and the plugins up to date and checking that the site still works after each update. It means backups of your site that someone has actually restored, security work inside the site, forms and notification emails that still arrive, small changes when your business changes, and someone to fix things when they break.
None of that is the server's job. A server can be perfectly healthy while the website on it is broken, hacked or quietly failing to send email.
Who usually does what
Every provider draws the lines a little differently, so treat this as the typical arrangement rather than a rule:
| Job | Usually the host | Usually you, or whoever manages the site |
|---|---|---|
| Server hardware, network and power | Yes | No |
| Server software and security patches | Usually, on managed plans | Only on an unmanaged server |
| Keeping the server online | Yes | No |
| WordPress, theme and plugin updates | Sometimes WordPress itself, rarely plugins | Yes |
| Checking the site works after updates | No | Yes |
| Backups | Often of the server, with limits | Your own copies, tested by restoring |
| Cleaning up a hacked site | Varies: included on some managed plans, an add-on on others, and some hosts suspend the account first | Usually |
| Forms and notification emails | No | Yes |
| Domain renewal and DNS | Only if the same company holds them | Whoever controls the registrar account |
| Content changes and small fixes | No | Yes |
Where the gaps show up
The trouble rarely shows up in the middle of either job. It shows up at the edges, where a problem is caused by one side and only visible on the other.
We had a small example of that on our own site in September. After a move to a new server, the notification emails from our forms stopped going out on time. The server was healthy and the forms looked fine. The emails had depended on the server making a request back to itself, which the new environment didn't allow, so they only went out when a scheduled job ran later. We caught it because testing the forms is part of checking any move, and fixed it by changing how the emails were sent.
A host checking server health wouldn't have seen that. A website check would. It's the same pattern behind many "the host says it's fine" conversations: an update that breaks a page, a backup that turns out to be missing the database, a security certificate that stopped renewing after a DNS change. Each one sits between the two jobs.
"Managed WordPress hosting" is somewhere in between
Many hosts sell managed WordPress plans that take on part of the website side: automatic WordPress updates, caching, daily backups, a staging copy you can use for testing, sometimes malware scanning. Those are real benefits, and for a lot of sites they're worth the extra cost.
What they usually don't include is judgment about your particular site. A host can update a plugin; it generally won't check that your quote form still sends or that your booking calendar still shows the right dates. Read the plan for words like "we update" versus "we test", and for what happens when an update breaks something.
How to find out what you're actually paying for
WordPress's backup documentation makes a useful point here: most hosts back up the whole server, but getting your site back out of those backups takes time, and it's not the same as having your own. So ask your host three questions:
- Are your backups of my site guaranteed, how long are they kept, and can I restore my site myself?
- If my site is hacked, what do you do, and what do you leave to me?
- Do you update WordPress and plugins, and if an update breaks something, who fixes it?
Then ask whoever looks after the website the other side of the same questions. If nobody claims a job, that's your gap. Write the answers down on one page, with the name of the person or company responsible for each, and keep it somewhere you'll find it during an outage.
If your web designer bills you for hosting
Plenty of small businesses pay their web designer for hosting, and it can work well: one bill, and one team that knows the site. The questions to ask are the same either way. Whose account does the site actually live in? What does the price cover beyond the server itself? And what happens to the site, the domain and the email if you stop paying or move on?
One company or two?
Using one company for hosting and another for management works well when both are good and the line between them is written down. It goes wrong when each assumes the other is watching.
The alternative is one team responsible for both, which is how our Website Care works: we host your site and look after it every month, so there's nobody to point at but us. Whichever setup you choose, the useful test is the same. When something breaks at 9 p.m., you should already know who to contact, and they should already know it's their job.