What "hosting" actually includes
The word hosting covers everything from a folder on a shared server to a global network with certificates, deploys, rollbacks and monitoring. A checklist to hold against any quote. Fully referenced.
Almost every website quote has a line called hosting. It is usually one word and one number, and it is the line most people skip. That is a mistake, because hosting is the part you keep paying for after everyone has stopped talking about the design. This post explains what the word can mean, what it should mean, and ends with a checklist to hold against any quote.
The bare meaning
At its simplest, hosting is space on a computer that is connected to the internet, where your site’s files sit waiting for visitors. Mozilla’s guide for beginners describes the traditional pricing model: “Hosting providers charge you according to how much bandwidth your website consumes”[1]. Bandwidth is the amount of data sent to visitors over a month.
That is all a bare hosting plan promises: files on a server, and a monthly allowance of data. Everything else below may or may not be included, and one word on a quote does not tell you which. The same guide notes why the cheapest option is rarely the right one: “It is better to go for paid hosting rather than relying on free hosting, as it is possible to move your files easily and uptime is guaranteed by most paid sites”[1]. Uptime, portability and the items below are what you are really buying.
A CDN: where your files physically are
A server is a machine in a place. If it is in Sydney, a visitor in Perth waits for data to cross the country and back. A content delivery network, or CDN, removes that wait. Mozilla defines it as “a group of servers spread out over many locations”, where “these servers store duplicate copies of data so that servers can fulfill data requests based on which servers are closest to the respective end-users”[2]. The rule is simple: “Geographical distance affects latency proportionally”[2].
This site is served by Cloudflare Pages, which does this for every file: “Pages uploads each file on your site to Cloudflare’s globally distributed network to deliver a low latency experience to every user that visits your site”[3]. There is no single machine that is “the server”. A visitor in Perth is served from near Perth.
The distance matters to your business, not just to engineers. Google’s summary of the evidence records that “the BBC found they lost an additional 10% of users for every additional second their site took to load”, and that “slow sites have a negative impact on revenue, and fast sites are shown to increase conversion rates”[4]. A CDN is the first thing to ask about, because a bare shared-hosting plan almost never includes one.
TLS certificates: the padlock
The padlock in the browser’s address bar means the connection is encrypted with HTTPS. That needs a certificate, a small file issued by a trusted authority that proves your domain is yours. Certificates used to be bought and renewed by hand, and a missed renewal put a warning in front of every visitor.
Let’s Encrypt, run by a nonprofit, is “a free, automated, and open Certificate Authority (CA), run for the public’s benefit”[5]. Its stated aim is “to make it possible to set up an HTTPS server and have it automatically obtain browser-trusted certificates without any human intervention”[6]. Renewal is the same process repeated: “Renewing a certificate at a later time means repeating the issuance process over again - performing domain validation and then requesting a new certificate”[6], and a machine does the repeating.
Cloudflare does the same for every domain on its network: “By default, Cloudflare issues — and renews — free, unshared, publicly trusted SSL certificates to all domains added to and activated on Cloudflare”, and “Cloudflare handles issuance, renewal, and deployment automatically”[7]. So if a quote lists an annual charge for an “SSL certificate”, ask what it is for. Automatic SSL is one of the things we include with hosting.
DNS: pointing the domain at the site
Your domain name and your hosting are separate things. A set of records called DNS tells the internet where to send visitors and where to deliver your email. Connecting a new site means changing those records, and it is easy to get wrong. Cloudflare’s own documentation warns that “Manually adding a custom CNAME record pointing to your Cloudflare Pages site - without first associating the domain (or subdomains) in the Cloudflare Pages dashboard - will result in your domain failing to resolve”[8]. Do the steps in the wrong order and the site disappears.
The bigger risk is email, because its records live alongside the website’s and a careless cut-over can break both. This is why our Launch stage lists DNS and SSL as a job we do, with the promise that your email and other domain services stay intact. Ask whoever is quoting you: who changes the DNS, and what happens to email when they do?
Deploys: how a change reaches the live site
A deploy is the act of putting a new version of the site in front of visitors. On a bare hosting plan this means copying files onto the server, with no record of what changed or who changed it. A modern pipeline ties deploys to version control. Cloudflare Pages, for example, lets you “connect each Cloudflare Pages project to a GitHub or GitLab repository, and Cloudflare will automatically deploy your code every time you push a change to a branch”[9].
The pipeline also gives you somewhere safe to look first. “Preview deployments allow you to preview new versions of your project without deploying it to production”, each at “a unique preview URL”[10]. That is how the staged previews in our Build stage work: you see a change at its own address, and it does not touch the live site until it is signed off.
Backups and versions: getting yesterday’s site back
Ask a bare host about backups and you will hear about a copy of the disk, restorable by a support ticket. A pipeline built on version control is better, because every deploy that ever went live is kept as a complete version. Cloudflare’s rollback feature is one sentence: “Rollbacks allow you to instantly revert your project to a previous production deployment”, and “any production deployment that has been successfully built is a valid rollback target”[11]. If a change breaks something, the previous version is a click away.
A static site has a quieter advantage too: there is no database to back up, because the whole site is files, and their source lives in a repository. The repository is the backup.
Uptime monitoring: knowing before your customers do
A host that promises uptime is not the same as a host that watches for downtime. Monitoring means a separate service checks your site at short intervals and raises an alert when it fails, so the person responsible knows before a customer rings. A bare plan does not include it. It is part of our Live stage: we run the hosting and deployment pipeline with monitored uptime. Whatever quote you are reading, ask who is watching and how they are told.
Analytics without the cookie banner
Most quotes bundle analytics in without saying which kind. The distinction that matters is whether the tool tracks individual people. Cloudflare’s web analytics, for example, describes itself as “Privacy-first analytics for your website without changing DNS or using Cloudflare proxy”, built to “get vital web analytics for your website without compromising user privacy”[12]. Privacy-friendly analytics is what we set up at launch, so you can see what is working without a consent pop-up in the way.
Content edits: what happens when you want a word changed
The last item is the one most often argued about a year later. On a bare plan, the host is not responsible for your content at all. Our Live stage puts it plainly: you send content changes when you need them, and we make them. There is no monthly retainer for low-touch sites; content edits are billed as needed. If you would rather edit copy yourself, mention a lightweight Git-backed CMS in your brief. Either way, the answer should be in writing before launch.
The checklist
Hold any hosting line against this table. A tick in every row is what “hosting” ought to mean.
| Item | The question to ask | What a bare plan gives you |
|---|---|---|
| CDN | Are files served from near the visitor, or from one server? | One server, one location |
| TLS certificate | Is it issued and renewed automatically, at no extra charge? | Often a yearly line item, sometimes manual |
| DNS cut-over | Who changes the records, and will email stay intact? | You do, at your own risk |
| Deploys | Is every change tracked, with a preview before it goes live? | Files copied by hand |
| Versions and backups | Can the previous version be restored instantly? | A disk copy, restored by ticket |
| Uptime monitoring | Is someone alerted when the site goes down? | Nobody, until a customer tells you |
| Analytics | Is it privacy-friendly, or does it track individuals? | Usually not included |
| Content edits | Who makes them, and on what terms? | Not the host’s problem |
Our own answers are on the home page, next to the measured figures for this site. The other posts in this series cover the build side: what React is and how islands keep it cheap.
If you have a quote in front of you and want a second opinion on the hosting line, the brief builder takes three minutes, and the fixed price we send back says which of these items is included.
Reference list
All sources accessed 30 June 2026.
- Mozilla (n.d.) How much does it cost to do something on the Web? MDN Web Docs. https://developer.mozilla.org/en-US/docs/Learn_web_development/Howto/Tools_and_setup/How_much_does_it_cost
- Mozilla (n.d.) CDN. MDN Web Docs Glossary. https://developer.mozilla.org/en-US/docs/Glossary/CDN
- Cloudflare (2026) Limits. Cloudflare Pages documentation. https://developers.cloudflare.com/pages/platform/limits/
- Google (n.d.) Why does speed matter? web.dev. https://web.dev/articles/why-speed-matters
- Internet Security Research Group (2021) About Let's Encrypt. Let's Encrypt. https://letsencrypt.org/about/
- Internet Security Research Group (2025) How It Works. Let's Encrypt. https://letsencrypt.org/how-it-works/
- Cloudflare (2026) Universal SSL. Cloudflare SSL/TLS documentation. https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/
- Cloudflare (n.d.) Custom domains. Cloudflare Pages documentation. https://developers.cloudflare.com/pages/configuration/custom-domains/
- Cloudflare (2026) Git integration. Cloudflare Pages documentation. https://developers.cloudflare.com/pages/configuration/git-integration/
- Cloudflare (2026) Preview deployments. Cloudflare Pages documentation. https://developers.cloudflare.com/pages/configuration/preview-deployments/
- Cloudflare (2026) Rollbacks. Cloudflare Pages documentation. https://developers.cloudflare.com/pages/configuration/rollbacks/
- Cloudflare (2026) Cloudflare Web Analytics. Cloudflare Docs. https://developers.cloudflare.com/web-analytics/