WordPress Hosting Explained

WordPress hosting explained: a convenience, not a requirement

These plans are usually sold as managed WordPress hosting. Managed means the host takes on routine work that would otherwise land on you: keeping the software current, caching, sometimes a staging copy. The industry uses the word loosely, so the feature list decides what you get, not the label.

WordPress is ordinary software: a folder of PHP files and a database. Any shared hosting plan that runs PHP will run it, and a great many business sites are hosted exactly that way. If you are still weighing plan types, the web hosting guide compares them by what the site does.

So you are not buying permission to run WordPress. You are buying three chores, arranged so they happen whether or not anybody at your business remembers them.

Updating. Core, plugins and themes. This is where compromised sites almost always come from, and the real reason to consider the plan.
Caching. Handing visitors a finished copy of the page instead of rebuilding it every time.
Staging. A private copy of the site to try changes on before they touch the live one.

Which of the three a given plan includes varies by provider and by tier, so read the plan rather than the category name.

The update question, which is the real one

Not storage. Not speed. This: who installs the plugin updates, and who looks at the site afterwards. Settle that before you pay for anything.

Most WordPress sites that get defaced or start sending spam were not targeted by anybody. They were running a plugin with a publicly documented hole in it, months after the fix was published, because whoever meant to click Update stopped logging in.

Three honest arrangements exist. A WordPress plan is only one of them.

Who does the updating, and who notices when one goes wrong
Arrangement	Who installs updates	Who notices a broken page	Suits
Ordinary shared hosting	You, or whoever built the site	Nobody, until a customer mentions it	A site somebody genuinely logs into
WordPress hosting plan	The plan, for whatever it covers	Still you, unless somebody is under contract	A site nobody wants to babysit
Maintenance contract	Your web company, on a schedule	Your web company, as part of the job	A site that takes bookings or orders

The middle row is the one people misread. Automatic updating solves the problem of nobody clicking Update. It does not solve the problem of nobody looking at the site afterwards.

What an automatic update can break

A theme update overwrites customisations made inside the theme's own files. A child theme prevents that, and older sites often do not have one.
A plugin the site depends on was abandoned by its author and stops working with the current version of WordPress.
A form or booking plugin keeps rendering but quietly stops delivering, which nobody sees from the front of the site.

None of that is common. It only gets expensive when nobody notices for six weeks.

Hardening is a separate subject. Logins, user accounts, file permissions and what to do after a compromise are on WordPress security.

Staging, and why it earns its place

A staging site is a private copy of your live site, at an address only you use. You try a change there first, look at it, then do the same thing to the real site.

Two different things get called staging. A plan that includes it makes the copy for you, usually keeps search engines off it, and gives you a button that pushes it back over the live site. A copy built by hand does none of that on its own, and somebody has to remember it is there.

The push-live button overwrites the live site

That is what it is for, and it catches people out. Anything published on the live site while you worked in staging goes with the overwrite: a news item, a corrected phone number, an edit somebody else made. Refresh the copy from live right before you push, unless nothing on the live site has changed since you made it.

Staging is not a backup. It shows you a problem before it is public; a tested backup undoes one that already is. Read website backups for the restore side.

The update routine itself is on WordPress security.

Caching, in plain terms

Normally every visit to a WordPress page makes the server build it: run the code, ask the database for your content, assemble the result. Caching means the server builds the page once and hands the finished copy to the next visitor.

There is nothing more to understand, and no reason to leave it off.

The gotcha

You edit a page, save it, load the site, and see the old version. So you edit it again, save again, still the old version, and now you are wondering what you broke.

You broke nothing. You are being handed the cached copy. In order:

Reload while holding Shift, which skips your own browser's copy.
Open the page in a private window. If it is right there, the problem was only your browser.
Clear the site cache. If the control panel has a cache button and the site also runs a caching plugin, clear both. Two caches is the usual reason a change half appears.
Give it a few minutes, because some caches expire on a timer rather than on demand.
Only then start looking for a real fault.

One habit worth keeping: check the site logged out. An administrator is usually served the live version while everybody else gets the cached one.

Who should not buy it

This is a product with a real no attached, and the no is common.

Leave it alone if

The site is not self-hosted WordPress. Pages edited inside Squarespace, Wix or Shopify run on the platform's own software, so this plan has nothing to look after. Shared hosting is the right product for a hand-built HTML or PHP site.
The theme was customised without a child theme. Unattended updates are riskier there rather than safer, because each one can overwrite work somebody paid for. Get a child theme in place first.
The domain and hosting are still held by a former designer. Settle who owns those accounts before you buy a plan you cannot log into.
You are replacing the site soon. Put the new build where it is going to live and skip the move in between.

Worth having if

The site runs self-hosted WordPress and the business owns the hosting account and domain.
Nobody logs into the admin from one month to the next.
You would use a staging copy and do not want to build one yourself, and the plan you are looking at includes one.
The site takes bookings or orders, so a few unattended weeks cost real money.

Get WordPress Hosting Ask us whether you need it

Moving an existing WordPress site across

The order of operations for any move, and the DNS discipline that keeps your email alive while it happens, is on the website migration page. Four things are specific to WordPress.

Half the site is in the database. Your pages, posts, menus and settings are not files, so copying the folder is not copying the site.
The site's own address is stored inside that database, in hundreds of places, including inside packed-up plugin settings. Use a migration tool that understands that format. A find and replace in a text editor corrupts those settings in a way that is hard to undo.
Turn the caching plugin off before you copy and on afterwards. Cached files carrying the old address are why a site arrives with half its images missing.
Open the permalink settings on the new server and save them. That rewrites the URL rules, and fixes the case where the homepage works and nothing else does.

Then check the SSL certificate on the new server, submit every form, and leave the old account running until traffic has moved.

How AldoMedia helps

AldoMedia has been building and maintaining websites for Western New York businesses since 1999, so WordPress sites nobody has logged into in years are familiar work. We are an independent authorised reseller, not the operator of the underlying platform. If you already pay somebody to maintain the site, we will tell you that this plan duplicates it. Call 716-771-2536 and tell us what the site runs on, or start with the support pages.

Common questions

WordPress hosting questions

Does WordPress need a WordPress hosting plan?

No. WordPress is ordinary PHP software with a database, and it runs on any shared hosting plan that supports both. A WordPress plan is a convenience purchase that takes updating, caching and staging off your desk. It is not a requirement, and the case where it pays for itself is a site nobody logs into.

Who installs the plugin updates on a WordPress hosting plan?

Settle that before you buy, because it varies by provider and by plan. Automatic updating solves the problem of nobody clicking Update. It does not solve the problem of nobody looking at the site afterwards, and that second job stays with you unless somebody is under contract to do it.

Can an automatic update break my website?

Occasionally, yes. A theme update can overwrite customisations, and a plugin the site depends on can stop working with current WordPress. None of it is common. All of it is cheap to fix if you find out the same day, which is what a staging copy and a tested backup are for.

I edited a page and the site still shows the old version. What is wrong?

Almost always caching. The server is handing out a saved copy of the page. Reload while holding Shift, check the page in a private window, then clear the cache in the hosting control panel and in the caching plugin if the site has both. Do not edit the page again, because that is how one change becomes three.

My web company already maintains my WordPress site. Should I still buy a WordPress plan?

Usually not. You would be paying twice for the same updating, and two update schedules on one site is how one person's change gets undone by another's. Ask what your maintenance contract already covers before you change hosting plans.

Related guides and services

Web Hosting

The plan comparison this page sits under, and when you have outgrown yours.

Read the hosting guide

WordPress Security

Logins, permissions, hardening, and what to do after a compromise.

Read about WordPress security

Website Migration

Moving a site between hosts without losing your email along the way.

How a migration works

Also useful: shared hosting if the site is not WordPress, website security for scanning and malware, or all of the guides.