A few years back, I took over hosting for a small accommodation business in New Zealand. The kind of place where every booking comes through the website — no walk-ins, no call centre, just a homepage and a booking form. Over the course of about a year, their site had been hacked twice. The first time, they didn’t even know until a guest mentioned the site looked “weird.” The second time, it went down completely. No monitoring had picked it up. No automated backup was in place to restore from. The owner spent days trying to get her old hosting provider to even respond.
When I finally got under the bonnet, the picture was predictable: weak admin password, no two-factor authentication, no uptime monitoring, backups stored on the same server as the site (which is like keeping your spare house key under the doormat — technically accessible, practically useless when you need it most). Every booking that didn’t happen during those outages was money gone. Not delayed — gone. A guest looking for a weekend stay doesn’t wait for your hosting provider’s ticket queue. They book the next place that loads.
This isn’t a rare horror story. After twenty-plus years hosting WordPress sites for hundreds of businesses, I’ve seen this pattern so often it’s become background noise. And every time, the business owner says some version of the same thing: “But my hosting company said everything was fine.”
The Problem: Specs Instead of Outcomes
The hosting industry has spent two decades selling you the wrong things.
Open any hosting provider’s homepage and you’ll see the same metrics paraded like badges of honour: 99.9% uptime guarantee. Unlimited storage. Unlimited bandwidth. 24/7 support. Free SSL. One-click WordPress install.
These sound reassuring. They’re designed to. But let me translate what they actually mean in practice.
99.9% uptime means your site is allowed to be down for 8 hours and 46 minutes per year. That’s a full business day. And read the fine print — most providers exclude “scheduled maintenance,” DDoS attacks, and anything they classify as your fault. By the time you’ve navigated the exclusions, the guarantee covers almost nothing. It’s the hosting equivalent of travel insurance that doesn’t cover travel.
Unlimited storage doesn’t exist. There’s no unlimited anything in computing. What it means is: “We won’t tell you the limit until you hit it, and then we’ll either throttle you or ask you to upgrade.” The terms of service always include clauses about “normal usage” and “fair use” — definitions they get to write and you get to discover after you’ve signed up.
24/7 support usually means a chatbot at 2am and a human sometime between Tuesday and never. I’ve had clients come to me after waiting five days for a response from their “24/7” provider. Five days, with their site down. One lost sale pays for a lot of hosting.
Here’s what none of these specs tell you: Will someone notice when your site goes down at 3am? Will your backups actually restore to a working state? Will a plugin update break your checkout page on a Friday afternoon? Will anyone test before pushing changes to your live site?
These are the questions that determine whether your website makes you money or costs you money. And the hosting industry has zero incentive to talk about them, because the answers require actual work — not just server space.
What Twenty Years of Hosting Actually Teaches You
So here they are — eleven beliefs about web hosting that contradict almost everything the industry tells you. Each one was learned the expensive way, either by me or by a client who came to me after learning it themselves. I’ll publish each as a standalone article over the next twelve weeks. The truths are grouped by theme here, not numbered in order — you’ll see them roll out one per week.
Platform Choice
Truth #2: WordPress Is the Lingua Franca of the Web
WordPress powers over 43% of all websites. But that’s not the point. The point is that every SEO specialist, every copywriter, every marketing assistant, every virtual admin already knows how to use it. When I say “lingua franca,” I mean it literally — WordPress is the common language of all your digital professionals, and that reduces friction in your digital marketing tremendously. No other platform eliminates onboarding friction like this. Try hiring a Webflow developer in Christchurch at short notice. Good luck.
Truth #3: Open Source Guarantees Longevity
Veteran business owners use WordPress because it guarantees longevity in scale and time — something that only very few closed-ecosystem companies can guarantee. I’ve watched Squarespace pivot, Wix change their pricing model three times, and half a dozen “WordPress killers” come and go. Open source doesn’t depend on one company’s board meeting or one investor’s patience. Your business outlasts platforms. Your website should too.
Plugin Philosophy
Truth #1: Fewer Plugins, More Custom Code
I’m going further than most consultants and recommending that you replace any plugin that can be replaced by fewer than ten lines of code with code in a custom mu-plugin. One per site. It serves as documentation, it’s version-controlled, and it doesn’t phone home, run ads in your dashboard, or break when the author loses interest. In an ecosystem of 10,000 plugins, only about 30 to 50 are used by 90% of people. The rest are crap. There, I said it.
Truth #6: Only 3-5 Plugins Per Vertical Actually Matter
Every “Top 50 Essential WordPress Plugins” article is doing you a disservice. For any given industry vertical — a tradie, a retailer, a professional services firm — there are only three to five plugins that genuinely matter. Everything else is bloat, attack surface, and future maintenance debt. The illusion of choice in the plugin ecosystem is exactly that: an illusion.
Truth #9: Plugin Authors Inevitably Burn Out — Plan for It
We cannot have 10,000 plugins over a time period of six years, because the authors burn out. This isn’t a maybe — it’s a structural feature of the ecosystem. For the price of a premium plugin subscription, I can build and maintain a custom solution that doesn’t depend on a solo developer’s motivation lasting longer than their mortgage payments. The economics of building versus depending always favour building when the dependency has an expiry date.
Security & Operations
Truth #4: Poor Passwords Are the Primary Attack Vector
My gut feeling, confirmed by years of data, is that poor passwords are the main attack vector right now. Not some exotic zero-day WordPress vulnerability. Not a sophisticated state-sponsored attack. Just “admin” as the username and “password123” as the password. Or more commonly, a password reused from a breach on another site. Wordfence blocks over six billion brute force attacks every month. The “WordPress is insecure” narrative is a myth that should never be considered by someone with technical experience.
Truth #5: Backups Must Be Automated, Frequent, Off-Site, and Tested
The only way for backups to work is one central, automated place. Not a plugin that saves to the same server. Not a manual export you run when you remember. Not your hosting provider’s “daily backups” that they may or may not actually test. If your backup is on the same server as your site, you don’t have a backup — you have a second copy of the problem. And if you’ve never tested a restore, you don’t have a backup either. You have a hope.
Truth #8: Monitoring Is Criminally Underused
Why would you not spend ten dollars a month on monitoring when you spend five hundred dollars a month on hosting? This baffles me. I’ve taken over sites where the owner didn’t know their site had been down for three days. Three days! For an accommodation business in peak season, that’s thousands in lost bookings. A ten-dollar monitoring service would have sent an alert in sixty seconds. It’s the cheapest insurance in all of IT, and almost nobody uses it.
Maintenance Discipline
Truth #7: Updates Should Be Scheduled and Deliberate, Not Rushed
Automatic updates should be off, and WordPress should be updated on a schedule. I know this is heresy in certain circles. “Update immediately! Security patches are critical!” And sometimes they are. But most of the time, a rushed update on a Friday afternoon breaks something that takes until Monday to fix — while your customers see an error page all weekend. Scheduled, tested updates on a staging site first. Every time. No exceptions.
Truth #10: Staging Sites Are Non-Negotiable
Best to use a staging site for every little plugin upgrade, because repairing a broken site is much more work than preventing the break. This is the hill I will die on. A staging site costs essentially nothing to run. Testing an update before it hits production takes minutes. Fixing a broken production site takes hours or days — and those hours happen while your customers are watching. The maths is so one-sided it shouldn’t even be a debate.
Infrastructure
Truth #11: AWS Public Cloud Beats Traditional VPS
The comparison between shared hosting and VPS is very popular, easy to understand, but unfortunately outdated since public cloud services became prevalent. I run all my client sites on AWS — not because it’s trendy, but because the infrastructure behind it is invisible, predictable, and scales when you need it. A VPS is almost always slower because it’s unconfigured — you’re paying for a server, not for performance. Public cloud gives you predictable, globally consistent infrastructure — the same service in Auckland as in Sydney as in London.
Why This Matters
Let me bring this back to the accommodation business I mentioned at the start. After I took over hosting, we set up proper monitoring, automated off-site backups, strong passwords with two-factor authentication, and a staging environment for updates. The site hasn’t been hacked since. The owner doesn’t email me in a panic anymore. She edits her own content, bookings come through, and hosting is what it should be — invisible infrastructure that just works.
That’s the gap between what the hosting industry sells and what businesses actually need. The industry sells servers, storage, and uptime percentages. Businesses need their website to work, to be secure, to recover when something goes wrong, and to not break when things change.
The gap isn’t technical — it’s philosophical. Most hosting companies are in the business of selling server space. A managed hosting provider should be in the business of keeping your website healthy, the same way a mechanic keeps your car running. You don’t care about the brand of oil filter. You care that the engine starts on Monday morning.
What’s Next
Over the next twelve weeks, I’ll unpack each of these eleven truths in detail. Real incidents, real numbers, real solutions. No affiliate links, no “Top 10” listicles, no fluff. Just twenty years of operational experience distilled into what actually matters.
If you’ve been nodding along to any of this — if your hosting provider takes days to respond, if you’re not sure your backups work, if nobody is monitoring your site right now — then this series is for you.
And if you can’t wait twelve weeks: we offer a free site audit at managedhosting.partners. No obligation, no sales pitch. Just a clear picture of where your site stands and what needs fixing.
Do it once. Do it right.
