Website hosting, explained in plain words

Hosting is the computer your website lives on: a server that stays on day and night and sends your pages to anyone who types your address or taps your link. Your domain is the address, and the hosting is the building at that address. You can rent hosting yourself and do the upkeep, or pay someone to manage it. The real difference between the two is who notices when something breaks, and who fixes it.

Domain, hosting, website and email

These get lumped together in conversation, and often on one bill, but they're separate things:

• The domain is your name on the internet, like the one painted on your truck. You register it through a registrar and renew it. See who should own your domain.
• The hosting is the server space where the site's files live.
• The website is the files themselves: the pages, the photos, the code, and for some sites a database and software like WordPress.
• Email at your domain is often a separate service again.

ICANN, the organization that coordinates domain names, makes the same point in its registrant FAQ: your registrar and your host can be different companies, and a domain name "is like a street address for getting postal mail: there must still be a building or post office box to receive letters or packages."

This matters on the day the site goes down. You need to know which company to call and which login to use. Write it down now: the registrar, the host, the email provider, and who has access to each.

What a host does

At minimum, a host keeps the server running and connected to the internet, and sends your pages out quickly. A good host, or the person managing your hosting, also:

• sets up and renews the SSL certificate
• keeps the server software patched
• makes backups
• answers when something goes wrong

Which of these come with your plan, and which are left to you, depends entirely on what you're paying for. That's the whole managed vs. do-it-yourself question.

SSL: the padlock and the "https"

SSL is what encrypts the connection between your site and a visitor's phone. Most people still call it SSL. The technology in use today is called TLS, and that's the term the FTC uses in its cybersecurity guide for small businesses: "When TLS is correctly implemented, your URL will begin with https://." The FTC adds that this matters most when you ask customers for sensitive information. For a local business, that includes the quote form where someone types in their home address and phone number.

Browsers point it out when it's missing. Google's Chrome help page explains that a "Not secure" label means the site doesn't use a private connection, and that to fix it, "the site owner must secure the site and your data with HTTPS." When the certificate itself breaks or expires, visitors can get a full-page "Your connection is not private" error, which Chrome says can mean a problem with the site.

Certificates expire and have to be renewed. On a well-run setup that happens automatically and nobody thinks about it. Ask whether yours does.

Managed or do-it-yourself

Do-it-yourself hosting

You rent space on a hosting plan, put the site on it, and look after it. The monthly bill is usually small. In return, you or someone you hire handles:

• software updates for the site and any plugins
• making sure the SSL certificate renews
• setting up backups, and knowing how to restore one
• working out what's wrong when the site is slow or down

This suits an owner who enjoys it, or a business with someone technical on staff. For a roofing company in the middle of storm season, it's one more thing that quietly gets skipped.

Managed hosting or a care plan

Someone else does the upkeep, usually for a monthly fee, sometimes bundled with small changes like new prices or photos. You don't have to remember to update anything. The FTC's advice is to "clarify from the beginning who will manage your website after it's built," and it notes that if a web host is managing your site, "you may have to go through that provider to make changes." Know that before you sign, and make sure the domain and the hosting account are still in your name.

Hosting inside a site builder

On Wix or Squarespace, hosting is part of the subscription, and the platform handles the server side for you. The trade-off is that the site can't move to another host. Wix vs. Squarespace vs. a custom website goes into what that means.

Backups

A backup is a copy of your site you can go back to when something breaks: a bad update, a hacked plugin, a page someone deleted by accident. The FTC's basic advice for any business is to "make it a habit to back up important files regularly." For a website, ask three things:

• How often? A restaurant that changes its menu every week needs more frequent backups than a contractor site that changes twice a year.
• Where are they kept? A backup stored only on the same server can disappear along with it.
• Who restores it? Ask whether anyone has actually restored one, and how long it took.

Updates

The software under a website gets security fixes, and someone has to apply them. The FTC again: "As with any software, it's essential that you use the latest versions with up-to-date security patches." A WordPress site with a theme and a dozen plugins has a lot of parts to keep current, and an update can break the layout, so someone should look at the site afterward. A simple site with no plugins and no login page has far fewer parts to look after. Either way, ask who does it and how often.

What "the site keeps working" means

When someone says your site will keep working, this is what that should cover:

• The address loads, with and without "www."
• The padlock shows, with no security warnings.
• Pages load quickly on a phone, on mobile data.
• The phone number taps to call.
• The contact or quote form sends, and the messages land in your inbox, not in spam.
• The domain renews on time.
• Google can still find and read the pages.

Several of these fail without any warning. A form can stop delivering and the only sign is that the phone got quiet. Once a month, open your site on your phone, tap the number, and send yourself a test message through the form.

Questions to ask any host or web company

• Is SSL included, and does it renew automatically?
• How often are backups made, where are they kept, and who restores them?
• Who applies updates, and who checks the site after?
• Who do I contact when the site is down, and how?
• Whose name is the hosting account in, and do I have a login?
• If I leave, can I get a copy of the site?

The FTC's own list of questions for a web host overlaps a lot with this one and is worth reading before you sign up anywhere.

How we handle it

Our care plan is monthly and optional. It covers hosting and SSL, updates and backups, and changes when you need them, and you talk to the people who built the site. Without it, the site is still yours and keeps working.

To see where your current site stands, run it through our free website checker. It uses Google's own mobile speed test plus checks for trust and security, phone fit and getting calls, so you'll know what's working before you change anything.