If you are looking for a secure WordPress hosting provider that meets the following 17 requirements, read on. I used them for over six years for all of my websites from early 2015 to early 2021. I moved for various reasons.
Not all secure WordPress hosting providers meets each and every one of these 17 requirements. As already mentioned, I no longer use this hosting provider.
The secure WordPress hosting provider that actually meets each and every one of these 17 requirements was the secure WordPress hosting provider I used myself between January 2015 and March 2021.
These days if you find yourself asking the following question, “What is a secure WordPress hosting provider?” you should know that I asked myself this question earlier. I also asked myself the question, “What should a secure WordPress hosting provider provide?” because these two questions go hand in hand.
In this article, I reveal my list of requirements for a good secure WordPress hosting provider to provide.
This list was created in 2019. By 2021, other hosts improved their offerings while Wealthy Affiliate didn’t. In March 2021 I had moved to another host, who provide me with different hosting at about one fifth of the cost.
To be fair, Wealthy Affiliate have a huge number of “extras included” which I don’t use and don’t need and which my new host does not provide. Wealthy Affiliate’s 24/7 website technical support is very good and usually sorts technical issues very prompty.
This is a detailed article. My introduction outlines why I think it is important to have a list of requirements, along with what secure WordPress hosting is.
Heads Up: This list is now out of date. I no longer use this list of requirements.
The concept of the list is still good. However the list of requirements is now changed. This list may act as a starting point for you. Feel free to add and subtract from it in order to build up your list of requirements.
I decided to write this article to help you focus on what I think is important when looking at a secure WordPress hosting provider. There is some technical information here which I hope is easily understood and I hope does not cause you overwhelm. 🙂 🙂
This article covers a quick introduction about why looking at secure WordPress hosting solutions is a good idea in the first place and then jumps straight into discussing the items on my checklist.
Why it’s important to focus on requirements
A lot of secure WordPress hosting solutions talk about heaps of different technical specifications and heaps of features which can overwhelm you if you are not careful. This overwhelm is time consuming at best. You simply do not need to know all these things that you are simply not going to use. Ever. So learning about all these things ends up being a waste of your most important resource: heaps of your time.
In this day and age, a good percentage of websites use WordPress as their website content management system. A secure WordPress hosting solution is a host that manages WordPress, manages security and manages a range of time consuming technical tasks for you so that you do not do these time consuming technical tasks yourself.
This frees up your time to focus on the important stuff rather than spending your time doing those time consuming tasks. I read somewhere that it can take somewhere between 100 hours and 150 hours just to learn about how to manage WordPress, not including the time to actually manage WordPress. So it makes a lot of sense to let your host do this.
It is important to mention that you may from time to time need to do some hosting tasks but these in the main are usually taken care of by the secure WordPress hosting provider.
Everyone is different and everyone would have their own list of requirements. I also reasonably expect this list to change in the coming months and years as secure WordPress Hosting providers “up their game” with new technologies, newer hardware, newer software and with their own innovations. This is exactly what happened. This list was written in 2019. In March 2021 I moved my hosting to another web host who have a different offering at about one fifth of the cost. 🙂 🙂
These days there are many options when it comes to hosting websites. A good percentage of websites use WordPress as their website content management system. Using a content management system makes a lot of sense and using WordPress makes a lot of sense.
I recommend that a Secure WordPress Hosting Provider be used if you are looking at hosting websites. A good one will take care of the technology behind the scenes which frees you to focus on your actual business. Below I reveal my list of requirements of what good secure WordPress hosting providers provide.
This is my list of requirements, you may have a different one. 🙂
If you don’t yet have a list of requirements, you might use my list of requirements as your starting point. 🙂
What is secure WordPress hosting?
In order not to compare apples with oranges, it is important to define what is meant by secure WordPress Hosting.
Secure WordPress Hosting is way more than normal website hosting. In normal website hosting, the customer typically has access to a web hosting control panel where there are loads of options available to manage your web hosting.
You have to be quite a technical genius to navigate through these options and most of them you may never actually use however you may consume time and effort in educating yourself about them. This may not be the best use of your limited time.
After all there are 24 hours in every day and most of these hours are already earmarked for certain activities, including sleeping and eating.
Back to the large range of options typically available on a web hosting control panel, these may include options to manage associated options available with your web hosting. These typically include a web server, a DNS server, a mail server, a FTP server, a database server or more likely database servers, a file manager, a system monitor, web log analysis software and firewall.
So in normal hosting, if you want to use WordPress, you have to install, configure and implement WordPress for each of the websites where you want to use WordPress. Hosts typically have made this process easier over time.
By March 2021 this process was very streamlined compared to even a few years ago. In March 2021 this revised process worked so well for me in a cPanel environment I was left wondering why would anyone want to get managed WordPress hosting.
However you still have to do it yourself and if there are any issues, you have to troubleshoot them yourself in getting it to work, even if you just open a helpdesk ticket for the host helpdesk to help you.
Each website running WordPress requires its own separate WordPress database. So you have to create, set up, configure and manage a separate database instance for each of those websites. If the database instance is not running correctly the associated WordPress website is not able to get required data and so that website is not operating efficiently until you do the necessary to get all the pieces up and running again. This can be time consuming. Years ago for me this was time consuming. In March 2021, the process my new host used meant that it just worked first time with no issues. Happy days. 🙂 🙂
In managed WordPress hosting, the host typically takes care of these things. You are not exposed to these things. You do not have to install, configure and implement WordPress for each of your websites. The host does this as you have managed WordPress hosting. You do not have to create, set up, configure and manage a separate database instance for each of those websites. The host does this as you have managed WordPress hosting.
I expect in managed WordPress hosting that only WordPress sites are on that server. That server is set up and configured in such a way to be as effective and efficient as possible for WordPress and what WordPress sites require.
That server typically would not have unnecessary software installed, configured and running on it. Unnecessary software would be for instance other content management systems which if installed and running on that server would most likely lead to “performance leaks” along with possible conflicts.
I also expect in managed WordPress hosting that the host manages that server including managing WordPress. There is “behind the scenes” technical work that a managed WordPress host does which frees you up to focus on your business, not on managing your web hosting.
The word Secure in Secure WordPress Hosting means that the host in this case includes additional offerings to help make the website more secure. These are usually more than the traditional managed WordPress hosting provider. This may be at the web server level and/or at the website level depending on the host.
What is a secure WordPress hosting provider?
This is a provider of secure WordPress hosting. A secure WordPress hosting provider should take care of the following:-
- The Website technology behind the scenes
- Ensure that WordPress is up and running smoothly
- Ensure that the applicable WordPress databases are up and running smoothly
- Ensure that the webservers are running well and fast
- Ensure that websites are protected and so on
By them doing that, that frees up their customers to focus more on their actual businesses.
Here’s my 17 requirements
Here’s my secure WordPress hosting provider list of requirements along with my answers for the secure WordPress hosting provider that I use. These are not in any particular order.
Requirement 1 – Is the hosting platform robust and powerful?
The website platform must be robust and powerful. You just want your WordPress site to be fast and not be concerned about the technical details to make that happen as you have other things to do.
Requirement 2 – Can you host multiple websites?
I think where possible and if the cost is not much extra consider getting a hosting package that allows you to use multiple websites. You might need one or two as test websites.
WordPress itself is updated on a regular basis. Technically and to be on the safe side, you should test out a WordPress update before you update your production sites with it. WordPress themes and WordPress plugins are also updated on a regular basis. In an ideal world, webmasters should test the updates before implementing the updates in their production sites. Many don’t. At the very least you should do a backup which you can use if you have to.
Having the ability to host multiple website potentially gives you a lot of flexibility to have a number of test websites where you are testing various things. You might for instance like to test out the latest version of WordPress without the potential of damaging your existing WordPress sites. You very quickly and very efficiently build a website and update it to the latest version of WordPress to see how you like it. This same concept also applies to different WordPress themes, updating your existing WordPress theme to the latest version, WordPress plugins and updating your existing WordPress plugins to the latest version.
I prefer to make a backup of the existing site and do the updates without doing these things. So far, I have been lucky in that those updates always worked for me and I am able to work successfully with the latest version of WordPress, WordPress themes and WordPress plugins.
Having the ability to host multiple websites will usually mean that you can “spin up” another website in an effective manner. It also means in a lot of cases that there is no hold up on this process. No need to get a purchase order or credit card authorisation. If you had to do these other non primary tasks first, this will at best hold up the process or at worst prevent the process from continuing. That could have prevented you from “spinning” up a new website that could have had loads of potential. We just don’t know. 🙂 🙂
Requirement 3 – Is there excellent sitespeed rating?
There are at least two very important potential concerns here:
One, if a website is slow, people may not wait for it to load and display your content. They have already left and are now looking elsewhere. You do not want that.
And two, the search engines take speed into consideration when ranking content. The search engines know that if they send people to slow websites and those people don’t wait to see the content, the search engines consider that a bad experience for those people.
All things being equal except for speed, the faster website would rank higher in my opinion.
Speed be a lower level tie breaker in Google’s algorithm. Some authority websites can be slow loading their content however because Google knows the content is unique and good it is forgiving about the slow loading of content. Of course, if another authority website in the same niche was in the search engine results for the same query and is actually faster, then the slower authority website will have to do something to up its game.
Requirement 4 – Does your host offer “double hosting”?
Only one web host I am aware of offers this. As modern web hosts should have a lot of redundancies built into their solutions I do not see the need for this as a separate requirement.
Furthermore this is one of those things that I like to see some detailed information of how it would work in the real world, rather than vague “marketing information” that is not backed up with anything.
If your website is down then you are potentially losing out on traffic until you find out that the website is down and then start to take corrective action. Your website could be down for a long time.
There are web monitoring software solutions that will monitor your website for you so if the website is down, you get email alerts. I use the free version at Uptrends to provide me with a very basic website monitoring service for this website which alerts me from time to time. By the time I get to those email alerts, there is usually a sorted email alert as well. However it is good to know that my website is okay before I realise that it was broken. And that the time length was not long. Good to know.
If search engines notice websites being down a lot, it may also hurt your rankings. Another reason to use web monitoring software solutions.
Requirement 5 – Does your host know WordPress?
If your host knows WordPress, this should translate into them sorting out WordPress related issues for you quickly and smoothly.
One very important reason for this is that I expect a secure WordPress hosting solution host to set up the hosting platform in such a way that they take advantage of applicable configurations to protect my websites and to make my websites run as quickly as possible. I would expect the host in this case to do as many practical things as possible to keep the WordPress websites secure.
Security is not an absolute, it’s a continuous process and should be managed as such. Security is about risk reduction, not risk elimination, and risk will never be zero. It’s about employing the appropriate security controls that best help address the risks and threats as they pertain to your website.
Please be aware that if you install WordPress with some hosts, if you run into WordPress issues, they may not help you. Or they may charge additional fees to help you.
With a WordPress host, they usually have already installed WordPress for you and associated a database with it for you so you do not have to do these time consuming tasks yourself.
It is also possible but unlikely that your host does not support the technical specifications for WordPress.
Requirement 6 – Does your host have several layers of security that shield your websites and keep them secure?
Whatever overall solution your host has, it had better include several different layers of security. Having several layers of security makes a lot of sense. The website security package needs to include different security related protections at the host level.
Requirement 7 – Does your host automatically backup your websites every 24 hours automatically?
Some hosts will be this automatically to allow that copy to be restored in case of an issue at their end. Some hosts will even restore this copy for you if the issue is at your end. Other hosts will not. I think that hosts who provide this service have increased work loads for their support teams and therefore their costs go up.
I recommend having your own backup and restore process in place. I currently use the freeium version of the UpdraftPlus backup/restore WordPress plugin which provides this functionally for me at the present time. Of course this may change in the future. I wrote a post about my experiences with this plugin here.
Furthermore, you should never be dependent on your host’s automated daily backup. In reality, you need to know that not all hosts do automated daily backups. The ones that do may only keep the last copy for a day for disaster recovery purposes only at the webhost level. That copy can’t be provided by the webhost to you if you make a mess of your website in the meantime. I recommend strongly always doing your own backups to another location, not on the same web server or at the same web host. If there is a hardware failure on the web server, having the backup there means you are still in trouble.
I recommend doing automated backups every day to another location. The UpdraftPlus plugin mentioned earlier has this functionally available on its freeium version. I been using this plugin now for a few months and it does the job for me. If you use this plugin yourself you need to also do your own due diligence to be sure that it does what you want it to.
Better to have, and not need, than to need, and not have. – Franz Kafka
With some hosts you need to manually do the backups yourself. You need to have a backup plan that involves you doing the backup on a regular basis consistently. Good luck with that one.
Quite often, in my earlier experience I would do the backups on a regular basis and because I did not actually need them, I would omit to do them. Then trouble. You need to revert to an earlier backup, but your last backup is back too far.
This is why if your host does it automatically every day, at least you can revert to that backup if you need to.
Requirement 8 – Does your host always host your websites on the latest and most powerful servers?
If the host is using not so modern and not really powerful servers, then the experience for your website visitors may not be as quick and responsive and your website visitors may leave your website. Website visitors tend to be very impatient when it comes to requesting web pages online. They expect for the web page to be displayed in a timely manner.
Those servers should also be running the latest approved versions of software.
Requirement 9 – Does your host provide access to the server admins 24/7?
This can be useful. However one host who does only allows access to them via a helpdesk email system. It was not direct access to them via telephone to help sort out problems.
Note that some hosts give you access to helpdesk personal not the Server Admins. Having access to the Server Admins should allow the issue to be fixed in a more effective and efficient manner. In my opinion, this is down to the expertise and experience of the person.
With the secure WordPress hosting solution I used to have, I had access to the Server Admins 24/7 using their helpdesk ticketing system. Any time I did use, my hosting issues were resolved in a timely manner.
Any “real” hosting issues were resolved extremely fast. Any hosting related non urgent “questions” were answered very fast. However the “real” hosting issues were resolved much faster which is what I want.
Requirement 10 – Does your host provide free ssl certificates (https) security?
These days many hosts have set up their hosting offers to provide free Let’s Encrypt Wildcard SSL Certificates. These hosts in many cases, also renew these certs free of charge if you are still hosting with them when the free Let’s Encrypt Wildcard SSL cert is due for renewal.
These days all websites in my opinion should be using SSL (https) security as a matter of normal practice. Please note that some hosts will charge you extra for these SSL certificates on a per website per time period basis. Good for their pockets but not good for your pocket.
Be aware that some hosts charge about $40.00 extra per year for a SSL cert. So if you have 10 websites, that could be $400 extra per year spent on SSL certs alone. It may be worth your while to open a support issue with your host asking how to set up free Let’s Encrypt Wildcard SSL Certificates on your website.
Paid SSL certificates have additional advantages which may justify their costs.
Requirement 11 – Does your host provide botnet security?
This ideally needs to be implemented at the server level. This means that there is then no need to install and implement WordPress BotNet Security type of plugins.
If it is implemented at the server level, the bots typically do not get a chance to “annoy” the website at the website level. If this security is not at the server level, then additional processing needs to happen at the per website level to process these bots. That clogs up processing power and potentially clogs up the WordPress database at the per website level leading potentially to a performance decrease.
Plus it may also require human time with its associated costs to look at and correct.
Also know that some hosts will charge about $20.00 extra per year per website for security scans of your website.
Finding out the differences between hosts for this can be difficult. It may just be that different hosts provide this in different ways.
Requirement 12 – Does your host provide sitehealth?
This is something that my previous host did. I consider this as a nice to have.
The main idea in using their SiteHealth tool is to go from RED to GREEN by focusing time and attention on a wide range of affiliate marketing website building activities. This is not an exact science and is more of a guideline of what activities you could do now in building an affiliate marketing website. It does its basic job well.
The SiteHealth score for a website is an “internal score” rather than an “actual score” achieved against the search engines. This “internal score” and suggestions help to determine what affiliates could be focussing time and attention on.
First the statistics are displayed at an overview level, then by drilling down additional statistics are displayed for a number of different business performance headings relating to the health of the website as shown below.
SiteHealth scores for different business performance headings
This SiteHealth tool has a number of different business performance headings with a score against them (see above) to help determine what needs attention next.
As you can see, these include publishing frequency, content quality & variety, visitor engagement (website comments), your engagement (you replying to website comments with your website comment reply), plugins, site trust, Google ranked and website feedback.
These different business performance headings and scores could be used as a guide to determine what needs to be done next.
This is a tool that one host provides that could be used to help determine what to work on next for the well-being of your website from a business viewpoint along with current statistics relating to each of those things. These statistics could be used to help determine the next task to be worked on.
In my opinion, this tool is limited is it is not a score achieved against say the Google search engine which would be way more meaningful and useful.
However, Google are not going to provide such a tool at the site level and at the overall business level. Google do provide a tool that provides page speed insights on individual web pages. That tool provides some useful technical information however provides no help with the actual content on the page. For instance, it does not tell you that your web page is fast but your keywords and content are not great.
Requirement 13 – Does your host arrange site comments?
This is something that my previous host did. I consider this as a nice to have. Be aware that if search engines detect you are gaming the system they will most likely punish you.
The search engines like to see engagement with your blog posts. One way to get some engagement is to allow comments and also to reply to comments as they come in.
Requirement 14 – Does your host provide website feedback?
This is something that my previous host did. I consider this as a nice to have.
Requirement 15 – Does your host provide community access?
This is something that my previous host did. I consider this as a nice to have.
Having access to similar minded people who are also building their own websites can help greatly. If you can ask related questions and receive answers, you have more information to help you.
Requirement 16 – Does your host provide a decent allowance of website space?
These days many hosts provide a decent allowance of website space.
Requirement 17 – Does your host provide access to website training courses, videos and tools?
This is something that my previous host did. I consider this as a nice to have.
These days doing a highly focussed Google search on a website building term will most likely find the answer in a reasonable quick manner in any case.
The secure managed WordPress hosting
Using secure managed WordPress hosting saves you time that you can use for other purposes. The host in this case does a lot of the routine back ground management work behind the scenes. They usually also configure the web servers so that the web servers are optimized for WordPress.
The 17 requirements discussed here
The 17 requirements discussed above can act as a checklist to ensure that requirements are not overlooked. Note now that not all these 17 requirments may be important to you.
The support uses a web based ticket system and these are routed directly to the host’s technical people to ensure that the ticket is worked on by first level support. This usually allows for the ticket to be resolved in a timely manner.
Does not use standard hosting management dashboard
The Wealthy Affiliate hosting dashboard is much simpler and has way fewer options and functionally than standard hosting management dashboards. This means that some options and functionally that Wealthy Affiliate hosting deem “not necessary” is simply not available.
Only three caching options
These are SiteSpeed Off, SiteSpeed Accelerated and SiteSpeed Extreme. Only one is these is on. It’s possible to flick from one to the other. Sometimes it’s possible that the latest changes to websites are not displayed.
No phone support
Sometimes people are happier to pick up a phone and speak to a technical person at the end of the phone. This option is not available with this host. Personally I think this is a good thing because providing technical phone support on a 24/7 basis would be very expensive and that would lead to prices going up.
Secure WordPress hosting conclusions
As you can see, my list of requirements for a secure WordPress hosting provider is quite long.
These days, cPanel hosting that allows you to use WordPress is also a good option. That option may also be more cost effective than WordPress Managed Hosting.
Here Are Some Recommendations
Thank you for reading this article. I hope you found it helpful. Here are some recommendations that I hope you’ll also find helpful. Of course, I may earn commissions if you buy using my links.
Domain Registrations, Renewals and Transfers
I use Domain Cost Club for domain registrations, renewals and transfers. I been using them now for over six years. I find that they do the job and do it very cost effectively. You can read my review of them by clicking here.
A good WordPress Hosting webhost is Bluehost. They have a good interface and they have 24/7 support. I wrote a short post outlining some of the packages Bluehost have available. Click here to read that post.
If you are more technical and already have practical cPanel Hosting expertise, you might find the cPanel Hosting solution I currently use hits the sweet spot for you. Just know this solution does not have 24/7 support.
I wrote a post explaining my definition of managed WordPress hosting which includes a pricing comparison at the bottom of that article. You can read that by clicking here.