The Ultimate Web Hosting Checklist 2026

1 10 Questions to Ask Before Choosing a Host

Ask your potential host these questions before signing up. The answers separate serious providers from resellers.

What is the actual renewal price? Most hosts advertise an introductory price that doubles or triples on renewal. Ask for the year-2 price upfront.
What is the money-back guarantee period? 30 days is standard. Avoid hosts offering less than 7 days — you need time to test.
What type of support is available 24/7? Live chat, phone, or ticket-only? Test their response time before buying by asking a pre-sales question.
What server-level caching is included? Built-in caching (Varnish, Redis, LiteSpeed Cache) dramatically improves page speed. Don't rely on plugins alone.
Where are the data centers located? Server location impacts latency. Choose a host with data centers near your target audience.
Is SSL certificate included? Free SSL (Let's Encrypt, Cloudflare) should be standard. If they charge extra for SSL in 2026, walk away.
What is the uptime SLA? Look for 99.9% uptime guarantee with compensation if they fall short. Avoid hosts without a published SLA.
Does the hosting scale with your traffic? Can you easily upgrade from shared to VPS to dedicated without migrating providers?
What backup policy is in place? Daily automated backups with one-click restore. Ask how long backups are retained (7+ days is ideal).
Are there hidden fees? Ask about migration fees, domain privacy costs, and cancellation fees. Reputable hosts are transparent about pricing.

💡 Pro Tip: Ask all 10 questions in a single pre-sales support ticket. How they handle the questions tells you as much as the answers themselves.

2 Pricing Comparison Cheat Sheet

Side-by-side pricing of the four most popular web hosts. Prices are approximate as of mid-2026.

Feature	Bluehost	Hostinger	Kinsta	WP Engine
Starting Price*	$2.95/mo	$2.49/mo	$35/mo	$20/mo
Renewal Price	$10.99/mo	$7.99/mo	$35/mo	$20/mo
Renewal Jump	~3.7x	~3.2x	None (fixed)	None (fixed)
Hosting Type	Shared	Shared / Cloud	Managed WP	Managed WP
Free Domain	✅ Yes (1 year)	❌ No	❌ No	❌ No
Free SSL	✅ Yes	✅ Yes	✅ Yes	✅ Yes
Free Migration	✅ Yes	✅ Yes	✅ Yes	✅ Yes
Data Centers	1 (US)	10+ global	25+ global	20+ global
Uptime SLA	99.9%	99.9%	99.99%	99.95%
Support	24/7 Chat	24/7 Chat	24/7 Chat & Phone	24/7 Chat & Phone
Best For	Beginners	Budget / Value	High-Traffic WP	Business WP

* Introductory pricing requires multi-year commitment. Renewal prices apply after the initial term.

💰 Quick Verdict: Budget pick — Hostinger. Best value shared hosting with global data centers. Premium managed WP — Kinsta. Best performance and support for serious sites.

3 Speed Test Checklist

Run these tests before and after committing to a host. A slow host costs you visitors and conversions.

⏱️

TTFB (Time to First Byte)

Aim for < 200ms from your target region. Run at webpagetest.org or Google PageSpeed Insights. TTFB > 500ms means the server is slow.

📊

LCP (Largest Contentful Paint)

Google's Core Web Vitals target: < 2.5s. Test with a plain WordPress install (no caching plugin) to measure raw host performance.

🌍

Global Latency Test

Test from 3+ global regions using Dotcom-Tools or Pingdom. Your host's CDN should bring all regions under 1s load time.

📈

Load Test Under Traffic

Simulate 50 concurrent visitors using Loader.io (free tier). If response time doubles, the host can't handle traffic spikes.

⚡

Caching Effectiveness

Check if the host uses LiteSpeed Cache, Varnish, Redis, or Nginx FastCGI cache. Hit rate should be > 85% on repeat visits.

🔬

PHP Workers & Concurrency

Shared hosting typically limits PHP workers to 10–25. Test with a concurrent request script — if requests queue up, the host is overselling.

⚠️ Red Flag: If a host blocks load testing or rate-limits your speed test requests, they're likely overselling resources. Reputable hosts welcome transparency.

4 Security Features to Look For

Security isn't optional in 2026. Verify your host provides these protections.

Free SSL Certificate — Auto-renewing Let's Encrypt or Cloudflare SSL. All traffic should be encrypted by default.
Web Application Firewall (WAF) — Blocks SQL injection, XSS, and other common attacks before they reach your site.
DDoS Protection — Built-in mitigation at the network level. Without this, a small DDoS can take your site down.
Malware Scanning & Removal — Automated daily scans with free cleanup. Some hosts charge $100+ per malware removal — avoid them.
Two-Factor Authentication (2FA) — For your hosting control panel. A must-have to prevent account takeover.
SSH Access with Key Authentication — Password-based SSH is risky. Your host must support SSH key pairs.
Automatic Daily Backups — Stored off-server with at least 7-day retention. Test the restore process on a staging site.
PHP Version Control — You should be able to switch between PHP versions. Outdated PHP is one of the most common attack vectors.
IP Blocking / Allowlisting — Ability to block entire countries or IP ranges at the server level (via .htaccess or control panel).
Security Headers — The host should support Content-Security-Policy, X-Frame-Options, and HSTS headers either natively or via configuration.

🔒 Quick Check: Use securityheaders.com and SSL Labs to verify your host's default security posture on a test site.

5 Migration Checklist

Moving hosts? Follow these steps to ensure a smooth, data-loss-free transition.

1

Backup Everything

Create a full backup: all files (via FTP/SFTP or cPanel Backup Wizard), database export (phpMyAdmin or mysqldump), and email accounts.

2

Set Up on New Host First

Don't cancel the old host yet. Configure your site on the new host in parallel: create database, upload files, import database, update wp-config.php.

3

Test Everything on the New Host

Use a temporary URL or hosts file to preview the site on the new host before switching DNS. Check all pages, forms, images, and links.

4

Reduce DNS TTL

24 hours before migration, lower your DNS TTL to 300 seconds (5 minutes). This minimizes propagation delay when you switch.

5

Switch DNS Nameservers

Update your domain's nameservers to point to the new host. Propagation typically takes 5–30 minutes (thanks to the lowered TTL).

6

Verify & Fix Post-Migration

After propagation, test the live site thoroughly. Check mixed content warnings (HTTPS), broken links, email delivery, and form submissions.

7

Keep Old Host for 2 Weeks

Don't cancel the old hosting for 14 days. Keep it as a fallback in case of issues. Redirect traffic gracefully if needed.

8

Final Cleanup

After confirming stability: cancel old hosting, update any remaining DNS records (MX, SPF, DKIM), and submit a new sitemap to Google Search Console.

🚀 Pro Tip: Many hosts offer free migration services. Bluehost, Hostinger, Kinsta, and WP Engine all migrate your site for free. Let them do the heavy lifting.

📊 Hosting Provider Scorecard

At-a-glance ratings across all five checklist categories.

Provider	Questions	Value	Speed	Security	Migration	Overall
Bluehost	8/10	7/10	6/10	7/10	9/10	7.4/10
Hostinger	9/10	9/10	8/10	8/10	9/10	8.6/10
Kinsta	10/10	6/10	10/10	9/10	10/10	9.0/10
WP Engine	9/10	7/10	9/10	9/10	10/10	8.8/10

Scores based on objective benchmarks and CMZ Reviews' independent testing. Updated May 2026.