What makes WordPress hosting good or bad

Most WordPress hosting reviews go out of date within a year. The pricing changes, the dashboard gets redesigned, a vendor gets acquired and the article is now wrong. What does not change is the underlying engineering that separates a host you can trust from one you cannot.

I have moved client sites on and off most of the major UK and US providers over the past decade. The traits below are the ones I check first, in roughly the order I check them. They apply whether you are paying ten pounds a month or three hundred.

The caching stack tells you almost everything

A WordPress page request, served honestly, is a database query, some PHP execution, then HTML out the door. Without caching, that round trip happens on every visit. With caching done right, most visits never touch PHP at all.

Good hosting handles three layers of cache at the server level, so you do not have to bolt them on with plugins. Full-page caching (Varnish, Nginx FastCGI cache, or similar) sits in front of WordPress and serves an HTML snapshot for anonymous visitors. Object caching, almost always Redis in 2026, holds the results of database queries so that logged-in users and dynamic pages still respond fast. OPcache holds compiled PHP in memory so the interpreter is not parsing the same files on every request.

If a host expects you to install WP Rocket or W3 Total Cache to get acceptable performance, that is a hint about where they sit. Plugin-level caching is a workaround for thin infrastructure. It can work, but it is fragile and it competes with the host on the same job.

PHP version and database version are not boring details

In 2026 the minimum sensible PHP version for WordPress is 8.3, and 8.4 is the version I would put new sites on. Anything below 8.2 is either at end of life or close to it, which means no security patches.

Ask your host which PHP version is the default for new sites, and how easy it is to switch. A good host lets you change PHP version per site from the dashboard, has tested the popular plugins against it, and pushes you to upgrade rather than letting you sit on 7.4 forever. A bad host quietly keeps you on the oldest version that still boots, because it is less work for their support team.

Each major release tightens the floor. The WordPress 7.0 features worth knowing about raise the minimum PHP version again, and a host stuck on older PHP becomes a hard upgrade blocker.

The same logic applies to the database. MariaDB 10.6 or later, or MySQL 8, is the right baseline. If the dashboard does not tell you which version you are on, that is a sign the host does not expect you to care, which is a sign you should.

Isolation: who you share the box with

On classic shared hosting, your site lives on the same machine as hundreds or thousands of others. If one of those neighbours gets hammered by a bot or runs a runaway query, your site slows down. The host can throttle the noisy neighbour, but the design is the problem.

Containerised hosting (LXC, Docker, Kubernetes under the hood) puts each site in a sandbox with its own resource limits. A spike on one container does not bleed across to another. Most decent managed WordPress hosts are now container-based even on entry-level plans, even when they call it something else in the marketing copy.

A dedicated cloud server (your own droplet, VPS or instance) gives you the strongest isolation but more responsibility. Managed cloud platforms split the difference: you get a dedicated server, the host manages the OS and stack for you. For most agency and freelance work, that is the right tier.

Support: developers who read code, not script-readers

The single biggest difference between cheap hosting and decent hosting is the person who picks up the ticket. On the worst hosts, support is a flowchart. They ask you to clear your cache, deactivate all plugins, switch theme to Twenty Twenty-Five, then escalate to someone who repeats the script.

On good hosts, the first responder reads your error log, knows what a stack trace means and can tell the difference between a plugin conflict and a server memory limit. You do not need them to fix your code. You need them to tell you with confidence that the problem is or is not on their side.

Test this before you commit. Open a chat with sales and ask a technical question (object cache invalidation, how staging databases handle imports, whether the Redis instance is per-site or shared). If the answer is vague or visibly copy-pasted, the support team probably runs the same way.

Data residency for UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you do not have to keep personal data inside the UK. You do have to know where it is, document it and apply appropriate safeguards if it leaves the UK or the EEA. For most small business sites that means using a host with EU or UK data centres, picking the right one when you provision the server and recording the choice in your privacy policy.

A host that cannot tell you which physical region your data sits in is a problem. So is a host that quietly replicates backups to a US region without making that clear. For regulated clients (legal, medical, public sector) data residency is often a contractual requirement, not a preference.

Backups and restore time

Daily backups are table stakes. The question that matters is how fast you can restore one, and whether you can restore individual files or only the whole site.

A good host stores backups for at least 30 days, lets you trigger an on-demand backup before risky changes and offers a one-click restore that takes minutes rather than hours. The best ones also let you restore the database and the files separately, so you can roll back content without losing recent code changes.

A bad host stores backups on the same server as the live site (so a disk failure takes both), keeps them for 7 days or fewer and makes you raise a support ticket to restore. If that is your fallback when something breaks, your fallback is too slow.

Staging, SSH and Git access

Staging environments matter because nobody should be testing plugin updates on the live site. A good host gives you one-click staging that clones live, lets you work on it, then pushes changes back when you are ready. The simpler this is, the more often it actually gets used.

SSH access matters because the alternative is editing files through SFTP and a web file manager, which is slower and error-prone. Git access matters because deploying via git pull or a managed pipeline is far more reliable than dragging files around.

These three together are what separate a host built for developers from one built for the assumption that you will never touch the underlying files. If you work with a developer, or you are one, the absence of all three is disqualifying.

Monitoring: what they actually watch

Most hosts will tell you they monitor uptime. Almost any service can manage that. The useful question is what else.

Worthwhile monitoring covers PHP error rate (so the host knows when your site is throwing 500s, beyond raw uptime), database slow queries, disk usage trending and SSL certificate expiry. Some hosts surface this in the dashboard. Some only act on it internally. Either is fine. What is not fine is a host that only notices a problem when you tell them.

Why "unlimited" anything is a warning sign

Unlimited bandwidth, unlimited storage, unlimited sites, unlimited visits. Every host that offers these has a fair use policy buried in the terms, and that fair use policy is the real limit. Marketing the plan as unlimited just means you discover the cap when you hit it, usually at the worst moment.

Hosts that publish their actual limits (CPU minutes, PHP workers, monthly visits, storage in GB) are doing you a favour. You can plan against a number. You cannot plan against a vague promise.

What this looks like in practice

If you are choosing a host today, start with the principles above and treat the brand as secondary. The best WordPress host for you is the one that gets the engineering right at your budget, located in the region that matches your audience and your legal obligations. If you want a vendor-by-vendor view, I keep a separate post on the best WordPress hosting in the UK and update it annually.

If you would rather not pick yourself, the support and maintenance plans I run cover hosting recommendations as part of the setup. Or get in touch and tell me what your site is doing.