Business website essentials - illustration

Picking hosting isn’t just about price or bandwidth. For a UK small business you must balance availability, security, data‑protection obligations and the practicalities of moving a site if a studio or supplier exits. The short brief below explains hosting types, the key risks to address, and the minimum contract and operational checks to include so your website is usable, secure and portable.

1. Why hosting choice matters

Key risks to assess:

  • Availability — downtime costs sales and trust; understand the host’s uptime practices and incident response.
  • Data protection — if your site handles personal data you remain responsible under UK GDPR; assess where data is stored and how transfers are handled (ICO cloud guidance).
  • Security and compromise — hosting-level protections (TLS, patching, malware detection) reduce reliance on correct client configuration (NCSC: using cloud services securely).
  • DNS and takedown exposure — bundled domain services can simplify management but create a single point of failure if an abuse claim or registrar action occurs (NCSC: takedown guidance).

2. Hosting types and when they suit a small business

  • Static site + CDN — best for brochure sites with no server‑side processing. Pros: fast, low‑attack surface. Cons: limited dynamic features.
  • Shared hosting — low cost for simple sites but you share resources and some security responsibility with other tenants.
  • Managed WordPress — useful if you want platform‑specific support (updates, caching, staging). Check what “managed” covers in the contract.
  • VPS — gives control and isolation; requires in‑house or contracted sysadmin for hardening and patching.
  • Cloud IaaS/PaaS — scalable and feature rich; choose carefully and document responsibilities when you split tasks between provider and your team (NCSC guidance on cloud security).

3. Minimum procurement and contract checklist

Include these requirements in any tender, order form or contract. They are practical, testable and directly reduce risk.

  • TLS: managed certificates and automatic renewals — provider must manage HTTPS certificates and renewals so your site doesn’t go unencrypted in production (NCSC: TLS and domain guidance).
  • Account ownership and 2‑step admin access (2SV) — the business must retain ownership of accounts; administrative logins should require two‑step verification and be minimised to named roles (NCSC guidance).
  • Backups, retention and restore testing — specify backup frequency, retention period, who performs restores and documented RTO/RPO. Ask for periodic restore tests and evidence of successful restores (NCSC cloud guidance).
  • Incident handling and abuse contact — supplier must provide an abuse contact, SLA for incident acknowledgement and a clear takedown/appeal process. Check whether the supplier has relationships with registrars and how quickly they act on abuse reports (NCSC takedown guidance).
  • Data location and transfers — document where personal data is stored, whether transfers outside the UK/EU occur, and what contractual safeguards the supplier uses; use the ICO cloud checklist when assessing processors (ICO cloud guidance).
  • DNS ownership and recovery — your organisation should own the domain registration or have an exportable DNS record set; request DNS export procedures and an emergency change process (NCSC: managing public domain names).
  • Exit and portability — contract must require delivery of full site backups, database exports, access to code/artifacts, and step‑by‑step DNS change instructions on termination. Specify a handover timeframe and test a mock extraction if possible.

4. Quick decision matrix (common scenarios)

  • Brochure site — static site + CDN or managed WordPress. Prioritise TLS, simple backups and DNS ownership.
  • Online shop — prefer a platform specialised for ecommerce or cloud hosting with PCI‑aware processes; ensure you document where card and customer data are processed and stored.
  • Membership or data‑heavy site — VPS or managed cloud with clear SLA, backup/restore testing and defined processor responsibilities.

5. Appendix: plain‑English contract snippets and due‑diligence questions

  • "Provider will manage TLS certificates for example.com and renew automatically; any expiry or failed renewal must be notified within 24 hours."
  • "Provider will retain daily backups for 30 days by default and provide a restore within x hours on request; quarterly restore tests must be provided on demand."
  • Due‑diligence questions: Where are customer data stored? Which services are sub‑processors? Who owns the domain name and DNS records? What is the abuse contact and SLA for incident acknowledgement?"

Authoritative UK guidance underpins these checks: see the NCSC’s cloud and takedown guidance for operational points and the ICO’s cloud checklist when assessing data‑protection responsibilities (NCSC cloud guidance, NCSC takedown guidance, ICO cloud guidance). Note the ICO guidance document linked here is an established checklist; check the ICO site for any more recent updates.

If you want a ready‑to‑use procurement checklist and exit template tailored to your site type, use our website launch check tool to generate one for your scenario: Run the website launch check.

Digital Pegas

We build business websites, online stores and focused custom software for UK businesses. These guides explain the decisions involved in planning and launching a project.