Website Hosting & Maintenance: What Every Business Needs to Know

• A site that is offline cannot take enquiries or orders, so unplanned downtime costs money at any size of business
• Speed affects sales. A 2020 study commissioned by Google linked a 0.1-second mobile speed improvement to an 8.4% rise in retail conversions, so hosting is a revenue question, not just a technical one (Deloitte)
• Most breaches cost little, but some cost a lot. In the UK government's 2025/26 Cyber Security Breaches Survey, the top 5% of cases for micro and small businesses had a perceived cost of £4,000 or more for their most disruptive breach or attack, before wider impacts such as lost revenue and reputational damage (GOV.UK)
• Plugins accounted for 96% of the WordPress vulnerabilities disclosed in 2024, and about 35% of all those disclosed in 2024 were still unpatched in 2025, so keeping software updated matters (Wordfence 2024 report)

Most business owners think about their website when it's being built, and then again when something goes wrong. That gap in the middle — the months or years when the site is quietly sitting on a server, gathering technical debt — is where most of the real problems begin.

Your website is not a brochure that gets printed once and handed out. It's a living system: code running on servers, connected to databases, dependent on third-party software, and exposed to the open internet 24 hours a day. Every one of those dimensions requires active management.

Neglected sites often follow the same pattern. A business launches a website, feels great about it for six months, and then stops thinking about it. Two years later, the site is running an outdated CMS with unpatched plugins, no automated backups, an expired SSL certificate, and page speed scores in the red. In many cases, the site has already been compromised — malware injected quietly into the header, invisible to the owner but flagged by Google's Safe Browsing database.

The consequences aren't abstract. A hacked site can be flagged or removed in search results, and browsers can warn visitors away. Customers will leave. And depending on how long the breach has been running, customer data may already have been exfiltrated — a potential UK GDPR breach. For the most serious infringements, the ICO says the fine can be up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher (ICO).

The businesses that avoid this outcome aren't the ones with the biggest budgets. They're the ones that treat their website as infrastructure — something that requires ongoing care, the same way they'd service a company vehicle or renew their insurance.

Not all hosting is created equal. Understanding the differences helps you make an informed decision about where your website lives — and what happens when things go wrong.

Shared Hosting

Shared hosting is the entry point for most small websites. Your site lives on a server alongside hundreds or thousands of other websites, all sharing the same pool of CPU, RAM, and bandwidth. Providers such as SiteGround offer shared hosting plans. On its UK site the cheapest plan, StartUp, is £1.99 a month ex VAT (intro price, checked 5 Oct 2026), prepaid for 12 months. It renews at £13.99 a month ex VAT.

The appeal is obvious: it's cheap and easy to set up. For a personal blog or a basic holding page, it's arguably sufficient. For a business website that needs to be fast, secure, and always available, it starts to show its limitations quickly.

The core problem is what hosting providers call the "noisy neighbour" effect. If another website on your shared server gets a spike in traffic, runs a heavy process, or gets attacked, your site's performance degrades too — through no fault of your own. You have no visibility into who your neighbours are, no control over what they're doing, and no guarantee that your site won't slow to a crawl at exactly the moment a prospective customer is trying to reach you.

Shared hosting also tends to come with generic, one-size-fits-all security configurations. Server-level hardening, custom firewall rules, and proactive malware scanning are typically not included.

VPS Hosting

A Virtual Private Server (VPS) gives you a dedicated slice of a physical server. You're still sharing hardware, but your resources — CPU, RAM, storage — are allocated specifically to your account and not shared with neighbours. UK pricing varies with specification. On IONOS's UK site (checked 5 Oct 2026), VPS plans start at £2.00 a month for the first 3 months, then £5.00 a month. The largest listed plan is £17.00 a month for the first 3 months, then £59.00 a month. Each plan also has a one-off £10.00 setup fee. All IONOS prices here exclude VAT.

VPS hosting is a meaningful step up in performance and control. It's appropriate for growing businesses with higher traffic, development agencies running client sites, or e-commerce stores that need consistent resource availability.

The trade-off is complexity. A VPS gives you root access and control, but it also gives you responsibility. Unless you're technically comfortable managing a Linux server — handling security patches, monitoring logs, configuring firewalls — the extra power can become a liability. Many businesses on unmanaged VPS plans end up with servers that haven't been patched in years precisely because nobody knows how (or remembers) to do it.

Managed Hosting

Managed hosting is what the name implies: the infrastructure is handled for you. You don't worry about server configuration, security patching, uptime monitoring, or backup management — because someone else does that as part of the service.

This is the model we advocate for at Brambla, and it's the model behind our WebsiteCare service. When a client moves to WebsiteCare, they stop being system administrators by accident and start being business owners again. We handle the infrastructure so they can focus on what actually drives their business forward. WebsiteCare covers the sites we build. WordPress or Umbraco sites are not standard WebsiteCare: we review the site and its hosting, then quote.

Managed hosting tends to cost more than shared hosting, but the comparison isn't quite fair. You're not just paying for a server — you're paying for proactive monitoring, expert management, and the peace of mind that comes from knowing a human being is responsible for keeping your site online and secure.

Cloud Hosting

Cloud hosting — platforms like AWS, Google Cloud, Vercel, and Netlify — distributes your website across multiple servers and data centres. If one server fails, traffic automatically routes to another. For most static sites and modern JAMstack applications, cloud platforms offer excellent performance, resilience, and often very competitive pricing at lower traffic levels.

The scalability benefits are real: cloud hosting can handle traffic spikes that would bring a shared server to its knees. But like VPS hosting, cloud platforms put significant operational responsibility on the user unless you're working with a managed layer on top.

For the business owners we work with, the specific underlying technology matters less than whether it's being actively managed. A well-managed shared environment beats a neglected cloud deployment every time.

Quick Comparison

The managed column is Brambla WebsiteCare pricing, VAT included. The shared and VPS columns are the ranges from one provider each (SiteGround UK and IONOS UK, checked 5 October 2026), exclude VAT and are examples, not a market average.

Website security isn't a product you buy once — it's a practice you maintain continuously. Here's what a properly secured website needs.

SSL Certificates: Your SSL certificate encrypts the connection between your visitor's browser and your server. Browsers can show a "Not secure" warning on sites without one, and Google began using HTTPS as a ranking signal in 2014, a minor one at the time (Google). SSL certificates need to be renewed regularly — a lapsed certificate triggers browser security warnings that turn visitors away.

Malware Scanning: Malware is frequently injected into websites silently — redirecting visitors to phishing pages, harvesting form data, or using your server to send spam — without any visible sign to the site owner. Regular automated malware scanning catches these infections early, before Google's Safe Browsing database flags you.

Firewalls and DDoS Protection: A Web Application Firewall (WAF) sits in front of your site and filters malicious traffic before it reaches your server. DDoS (Distributed Denial of Service) attacks flood servers with traffic to force them offline. Without protection, even a modest attack can take a small business website down for hours.

Login Security: Brute force attacks on login pages — particularly WordPress admin areas — are constant and automated. Strong passwords, two-factor authentication, and login attempt limiting are baseline requirements, not optional extras.

PCI Compliance for E-Commerce: If your website handles card payments, PCI DSS is the payment card industry's security standard, not a UK law. Whether you must comply, or prove that you comply, is set by your payment provider or acquirer (PCI Security Standards Council). Ask your provider what it requires of you.

GDPR Considerations: Under UK GDPR, you're required to implement "appropriate technical and organisational measures" to protect personal data. That includes encrypted transmission (SSL), secure storage, and — critically — a breach notification process. A hacked website that exposes customer data isn't just a reputational crisis; it may be a reportable incident. If the breach is likely to put people at risk, you must tell the ICO within 72 hours of becoming aware of it, where feasible (ICO).

Backups are boring until you need one. At that point, they're the only thing standing between your business and starting from scratch.

A proper backup strategy covers three things: what gets backed up, how often, and where it's stored.

What gets backed up should include everything: your website files, your database (which contains all your posts, products, customer data, and settings), and any configuration files specific to your environment. Backing up only the files and forgetting the database is a common and costly mistake.

How often depends on how frequently your site changes. A business website that publishes new content weekly should have daily automated backups at minimum. An e-commerce site processing orders continuously needs backups more frequent than that. The principle is simple: how much data can you afford to lose? That answer defines your backup frequency.

Where it's stored matters as much as whether it's stored. A backup kept on the same server as your website is not a backup — it's a second copy of something that will disappear when the server fails. Off-site backups, stored in a separate location (a different data centre, cloud storage bucket, or physical media), are what actually protect you.

The other thing most people forget is testing restores. A backup is only as useful as your ability to restore from it. Running a test restore to a staging environment periodically is the only way to know your backups actually work before you're in a crisis.

The phrase "if it ain't broke, don't fix it" is genuinely dangerous when applied to website maintenance. The reason is simple: the security landscape changes constantly, even when your website doesn't.

A plugin that was perfectly secure when you installed it two years ago may have a critical vulnerability discovered last Tuesday. The plugin developer releases a patch. If your site doesn't apply that patch, it remains vulnerable — indefinitely, or until something exploits it.

CMS Updates: WordPress core releases updates that include security patches, performance improvements, and new features. Running an outdated version of WordPress is one of the most common reasons sites get compromised.

Plugin and Theme Updates: In WordPress, this is where most vulnerabilities live: plugins made up 96% of those disclosed in 2024 (Wordfence). Each one represents a potential attack surface. Keeping them updated is not optional — it's baseline hygiene.

Dependency Management: Modern websites often rely on dozens of third-party libraries and frameworks beyond the CMS itself. These need regular review and updating, particularly for any that handle user data or payment processing.

The practical problem is that updates aren't always seamless. A plugin update can break a feature. A theme update can change layout behaviour. This is why updates should be applied in a staging environment first, tested, and then deployed to the live site — not clicked through in bulk on a Friday afternoon and hoped for the best.

At Brambla, our WebsiteCare plans for sites we build include software updates. We stage each update first, test it, and roll it back if something breaks. If a site we look after gets infected, we clean up the malware. Plans are Essential £65/mo, Growth £125/mo and Premium £245/mo (including VAT), with uptime monitoring and alerts.

Your hosting infrastructure directly determines how fast your website loads — and speed has a direct, measurable impact on your business outcomes.

A 2020 study commissioned by Google and prepared by Deloitte found that a 0.1-second mobile site speed improvement was linked to an 8.4% rise in retail conversions and a 9.2% rise in average order value (Deloitte). As a simple illustration, a business taking £500,000 a year through its website would earn an extra £10,000 from a 2% rise in sales.

Core Web Vitals are Google's framework for measuring real-world user experience. The three key metrics are:

• Largest Contentful Paint (LCP): How long it takes for the main content to load. Target: under 2.5 seconds.
• Cumulative Layout Shift (CLS): How much the page visually jumps around as it loads. Target: under 0.1.
• Interaction to Next Paint (INP): How quickly the page responds to user interactions. Target: under 200ms.

Google says Core Web Vitals align with what its core ranking systems seek to reward, alongside other page experience signals (Google Search Central). They are one signal among many. A slow site frustrates visitors whether or not it affects rankings.

Your hosting environment is one of the primary levers. Server response time (Time to First Byte, or TTFB) sets the floor for everything else. As a rough guide, Google's web.dev says most sites should aim for a TTFB of 0.8 seconds or less (web.dev). Where your site is hosted is one of the factors that decides whether you meet it.

Beyond hosting, meaningful performance improvements come from image optimisation (serving correctly sized images in modern formats like WebP), caching (storing pre-rendered pages rather than generating them fresh for every request), CDN usage (serving assets from servers geographically close to your visitors), and database query optimisation.

Cheap hosting looks attractive until you factor in the full picture.

A £5/month shared hosting plan costs £60 a year. That sounds like a good deal. But consider what it doesn't include:

• Downtime: A 99.9% uptime target still allows over 8 hours of downtime per year. Each hour of downtime has a cost.
• Security incidents: Recovery from a malware infection — cleaning files, restoring from backup, investigating the breach, updating everything — takes professional time if you're paying someone to fix it.
• Performance degradation: Suppose your hosting makes your site 2 seconds slower and that costs you 10% of your conversions (an illustration, not a measured figure), then the "savings" on hosting are being eaten many times over.
• Your time: Managing your own hosting, monitoring uptime, handling server issues — this has a real cost even if you don't pay someone else to do it.

For context, here's a rough comparison:

The question isn't whether managed hosting costs more — it does. The question is whether the value of your website's uptime, security, and performance is worth the difference. For most business websites, it clearly is. For domain, SSL and change costs too, see What Does It Cost to Run a Website Each Year in the UK?.

Brambla prices include VAT. View our full WebsiteCare pricing at /pricing/.

There are clear warning signs that your current hosting arrangement isn't working anymore. If you're experiencing any of the following, it's time to have a conversation:

Slow load times: If your pages consistently miss Google's 2.5-second Largest Contentful Paint target, your hosting environment may be a contributing factor. Run a quick test at Google PageSpeed Insights or GTmetrix — if your server response time (TTFB) is above 0.8 seconds, the server is a likely cause.

Frequent downtime: If you're finding out from customers that your site was down, rather than from a monitoring system, you're already behind. Downtime you don't know about is downtime you can't measure or address.

Security incidents: If your site has been compromised once, the underlying vulnerability — unpatched software, weak credentials, inadequate server hardening — almost certainly still exists. A one-time cleanup without structural improvement is a temporary fix.

Outgrowing shared resources: If your site is getting meaningful traffic and you're seeing performance issues at peak times, you may have hit the ceiling of your shared hosting plan's available resources.

Your business has grown: A website that was a minor asset when your business was small becomes critical infrastructure when you're generating significant revenue through it. The hosting arrangement should reflect the importance of the asset.

Upgrading doesn't have to be disruptive. A proper migration to managed hosting — with DNS changes handled carefully and a testing window before the old hosting is switched off — should be seamless for visitors. At Brambla, CMS migrations are quoted separately from WebsiteCare, so ask us what your move would involve. If you're unsure whether your current setup is holding you back, our free mini audit gives you a homepage review and a mobile and speed snapshot. Our £149 Full Audit adds a performance and speed test and a technical health check.

What's included in managed website hosting?

Managed hosting covers the full stack of infrastructure responsibilities: server provisioning and configuration, uptime monitoring, security patching, SSL management, automated backups, and often performance optimisation. The key difference from unmanaged hosting is that these things are actively maintained by someone with expertise, rather than left to you. Our WebsiteCare service covers hosting, security, backups, software updates, SSL management and uptime monitoring on every plan, with content-update minutes on Growth (30) and Premium (90) and ongoing performance optimisation on Premium.

How often should I update my website's CMS?

As a rule: as soon as updates are available for security releases, and within a regular maintenance window (typically monthly) for feature updates. Wordfence's 2024 report tells site owners not to use old, outdated, unmaintained or abandoned plugins and themes. The practical answer for most businesses is to set up automated security-critical updates and handle other updates in a managed, tested process monthly. (Wordfence 2024 report)

Do I need a separate SSL certificate?

Most managed hosting providers include SSL certificates as standard — ours do. If you're on a legacy hosting plan or have been told you need to purchase an SSL separately, it's worth reviewing your hosting arrangement overall. Free SSL certificates via Let's Encrypt are widely available and perfectly valid for most business websites; you should not need to pay extra for a basic SSL. What matters is that it's installed correctly, auto-renews before expiry, and covers all the domains and subdomains your site uses. (Let's Encrypt)

What happens if my website gets hacked?

The immediate priorities are: take the site offline if it's actively serving malware to visitors, notify your hosting provider, restore from a clean backup, identify and close the attack vector, and scan all files for remaining infection. If personal data was affected and the breach is likely to put people at risk, UK GDPR says you must tell the ICO within 72 hours of becoming aware of it, where feasible. For clients on our WebsiteCare plans, we monitor security and keep backups, so if something goes wrong we can restore the site and clean up any malware. (ICO: Reporting a personal data breach)

What does "99.9% uptime guarantee" actually mean?

99.9% uptime sounds excellent, but it translates to about 8.76 hours of allowed downtime per year (0.1% of 8,760 hours). "Allowed" is the key word — many hosting SLAs offer service credits rather than meaningful compensation for downtime, and the credits rarely reflect the actual revenue impact on your business. For a business website, 99.9% is a minimum baseline. Some providers commit to more. AWS's EC2 Region-Level SLA, for example, is 99.99%, with service credits rather than refunds if it is missed. (AWS SLA)

• Shared vs Managed Hosting: UK Costs Compared
• Website Security Checklist for Small Businesses
• What Does Website Downtime Cost a UK Business?
• CMS Comparison Guide: Choosing the Right Platform
• Web Design for Small Businesses: The Complete Guide