Your hosting choice decides more than where your files live. It shapes how fast your pages load, who is responsible when something breaks, how secure the site is by default and what you’ll pay each month for years. Most sites end up on one of three models: static/Jamstack hosting, managed WordPress hosting or a virtual private server (VPS). Each is the right answer for some projects and an expensive mistake for others. This guide compares them on the factors that actually matter and gives you a simple way to decide.
What your hosting choice really decides#
Before comparing options, separate the questions that hosting answers:
- Performance: how quickly the server responds (Time to First Byte) and how close your content is to visitors.
- Security: how much of the stack can be attacked, and who patches it.
- Maintenance: who updates the operating system, web server, PHP, database and application.
- Flexibility: what you can install and configure.
- Cost: the monthly bill plus the cost of people’s time to run it.
The last point gets overlooked. A cheap server that needs several hours of expert attention a month isn’t cheap. With that in mind, here are the three models.
Static and Jamstack hosting#
How it works#
A static site is a set of prebuilt HTML, CSS, JavaScript and image files. The pages are generated ahead of time, either by hand or by a static site generator or framework build step, and the files are deployed to a content delivery network. When a visitor requests a page, the nearest CDN edge location returns a file. No code runs and no database is queried. “Jamstack” describes this architecture with dynamic features added through JavaScript and APIs: forms handled by a form service, search by a hosted index, and server-side logic in serverless or edge functions.
Strengths#
- Speed: serving files from a CDN keeps Time to First Byte low worldwide, which gives your Core Web Vitals a head start.
- Security: no PHP, no database and no admin login on the public server means a far smaller attack surface.
- Resilience and scale: CDNs absorb traffic spikes that would overwhelm a single server.
- Low running costs: many platforms have free or inexpensive tiers for small sites.
- Git-based workflow: every deploy is versioned, previewable and easy to roll back.
Limitations#
- Editing: non-technical editors need a headless CMS or Git-based CMS on top, which adds a moving part.
- Dynamic features need extra services: forms, search, comments, user accounts and e-commerce each need an API or serverless function, often from a third party with its own pricing.
- Build times: very large sites can take a while to rebuild, though incremental builds help.
Static hosting is a natural fit for landing pages, brochure sites, documentation and blogs with technical editors. It suits sites built with lean, framework-light JavaScript particularly well.
Managed WordPress hosting#
What “managed” should include#
Managed WordPress hosting runs the full PHP and database stack for you on a platform tuned for WordPress. “Managed” is a marketing word with no fixed definition, so check that a plan includes:
- Current, supported PHP versions with an easy way to switch.
- Server-level full-page caching and an object cache (Redis or Memcached).
- Automatic daily backups with self-service, one-click restores.
- A staging environment with push-to-live.
- Free TLS certificates, a web application firewall and malware scanning.
- Optional or automatic WordPress core updates, and clear rules on plugin updates.
- Support staff who understand WordPress, not just servers.
WordPress.org’s hosting requirements currently recommend PHP 8.3 or greater, MySQL 8.0+ or MariaDB 10.11+, and HTTPS support. Any serious host should meet these comfortably.
Strengths#
- Editor-friendly: the familiar WordPress admin, the block editor and a huge plugin ecosystem.
- Dynamic features built in: forms, search, memberships and WooCommerce run natively.
- Shared responsibility: the host handles the server, while you, or your maintenance partner, handle the application.
Limitations#
- Uncached requests depend on PHP and the database. Logged-in users, carts, checkouts and search results bypass the page cache, so plugin bloat and slow queries show up directly.
- Restrictions: some hosts ban certain plugins, limit background processes or cap PHP workers, which matters for busy stores.
- The application is still yours to maintain. Managed hosting doesn’t keep your plugins and theme updated or secure. See our WordPress security hardening checklist.
VPS hosting#
How it works#
A VPS is a virtual machine with dedicated CPU, memory and storage allocations, where you have root access. You choose and configure everything: the operating system, web server (Nginx, Apache, Caddy), PHP-FPM or another runtime, the database, caching, firewall and backups. Cloud instances from the large providers work the same way for this purpose.
Strengths#
- Full control: any language, any software, custom server configuration, background workers, WebSockets and scheduled jobs.
- Predictable resources: no noisy shared environment and no arbitrary plugin bans.
- Good price-to-performance for raw compute, if you have the skills to use it.
- The natural home for custom applications that don’t fit a CMS or static model.
Limitations: you are the operations team#
An unmanaged VPS makes you responsible for security patching, firewall rules, intrusion prevention, TLS renewal, backups (and testing restores), monitoring, log rotation and capacity planning. Software lifecycles keep moving. PHP’s supported versions page shows each branch getting two years of active support plus two of security fixes, and PHP 8.2 reaches end of life at the end of 2026. On a VPS, nobody upgrades it for you.
A minimal Nginx configuration for a PHP application gives a sense of what you take on, and this is before hardening, caching and monitoring:
server {
listen 443 ssl;
http2 on;
server_name www.example.com;
root /var/www/example/public;
index index.php;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# Long-lived caching for fingerprinted static assets
location ~* \.(css|js|woff2|avif|webp|svg)$ {
expires 1y;
add_header Cache-Control "public, immutable";
try_files $uri =404;
}
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.4-fpm.sock;
}
# Never serve hidden files such as .env or .git
location ~ /\. { deny all; }
}Managed VPS plans and server-management panels can take over some of this work, at a cost somewhere between plain VPS and managed hosting pricing.
Side-by-side comparison#
| Factor | Static / Jamstack | Managed WordPress | VPS |
|---|---|---|---|
| Typical TTFB | Very low (CDN edge) | Low when cached; depends on PHP when not | Depends entirely on your configuration |
| Attack surface | Minimal | Moderate (PHP, plugins, admin login) | Whatever you expose |
| Server maintenance | None | Host handles server; you handle WordPress | All yours |
| Non-technical editing | Needs a headless/Git CMS | Excellent | Depends on the application |
| Dynamic features | Via APIs and functions | Native, plugin-based | Anything |
| E-commerce | Via third-party platforms | WooCommerce, natively | Any platform you install |
| Scaling under spikes | Excellent | Good with caching; limited by PHP workers | Manual or by your own automation |
| Skills needed | Front-end and build tooling | WordPress know-how | Linux administration |
| Best for | Landing pages, docs, content sites | Business sites, blogs, stores | Custom apps, special requirements |
Performance and responsibility in practice#
Server response time#
web.dev’s Time to First Byte guidance treats 0.8 seconds or less as a rough guide to a good TTFB. TTFB isn’t a Core Web Vitals metric itself, but every millisecond of it delays Largest Contentful Paint. Whatever you choose, these levers matter most:
- Serve cached HTML for anonymous visitors: CDN for static sites, full-page cache for WordPress, reverse proxy cache on a VPS.
- Put a CDN in front of static assets at minimum, and of HTML where the platform supports it.
- Choose a server region close to your audience for anything that can’t be cached.
- Keep the stack current. Newer PHP versions generally bring performance improvements as well as security fixes.
Who is responsible for what?#
| Task | Static / Jamstack | Managed WordPress | VPS |
|---|---|---|---|
| OS and server patches | Platform | Host | You |
| PHP and database versions | Not applicable | Host provides; you choose and test | You |
| Application, theme and plugin updates | You (dependencies) | You | You |
| Backups | Git history plus content source | Host (verify restores) | You |
| TLS certificates | Platform | Host | You (automate renewal) |
| Uptime monitoring | Recommended | Recommended | Essential |
- Even the best managed host usually leaves plugin, theme and custom-code updates to you. Outdated plugins remain one of the most common ways WordPress sites get compromised.
- Decide before launch who will apply updates, test them and respond to incidents, whether that’s someone in-house or a maintenance partner.
Understanding the real cost of hosting#
Hosting prices are hard to compare because each model bills for different things. Rather than relying on headline figures, which change constantly, break the cost down into the same four parts for every option:
1. The platform fee#
Static platforms usually charge by bandwidth, build minutes, team seats and serverless function usage, and many small sites stay within free or entry tiers. Managed WordPress plans are typically priced per site or by monthly visits and storage, with higher tiers adding PHP workers, staging sites and priority support. A VPS is priced by CPU, memory and storage, and is often the lowest raw fee for the computing power you get.
2. Add-on services#
A static site that needs forms, search and a headless CMS may pay three separate subscriptions. A VPS may need a paid backup destination, an external monitoring service and a transactional email provider. Managed WordPress often bundles CDN, backups and a firewall, but premium plugins add their own yearly licences.
3. People’s time#
This is the cost that changes the ranking most. Static hosting needs developer time for content changes unless editors have a CMS. Managed WordPress needs regular application updates and testing. A VPS needs ongoing system administration, plus someone available when something fails at the weekend. Put a realistic number of hours per month next to each option and multiply by what that time costs you.
4. The cost of failure#
Ask what an hour of downtime, a hacked site or a lost order would cost your business. A setup with automatic backups, tested restores and monitoring may cost more each month and still be the cheaper choice over a few years.
Moving between hosting models#
Your first choice doesn’t have to be permanent. Sites often move from one model to another as they grow. A brochure site becomes a WooCommerce store, or a WordPress blog is rebuilt as a static site to cut maintenance. A careful migration follows the same steps whichever direction it goes:
- Inventory everything: files, database, scheduled tasks, email settings, DNS records, redirects and third-party integrations such as payment webhooks.
- Build and test on the new platform using a temporary domain or hosts-file override, including forms, checkout and transactional emails.
- Lower the DNS TTL a day or two in advance so the switch propagates quickly, and plan a short content freeze for sites with frequent updates or orders.
- Keep URLs identical wherever possible. Where they must change, implement 301 redirects. Our technical SEO launch checklist covers this in detail.
- Keep the old hosting running for a couple of weeks after the switch, as a fallback and a reference.
Email deserves special mention. If your mailboxes live with your current web host, moving the website can break email unless MX, SPF, DKIM and DMARC records are carried over correctly. Many businesses use the move as an opportunity to separate email hosting from web hosting altogether.
How to choose: a practical decision path#
Answer these questions in order:
- Do non-technical people need to edit content often? If yes, lean towards managed WordPress, or static with a headless CMS if you have the development budget for it.
- Do you sell online? For a full store with stock, variations and custom checkout logic, managed WordPress with WooCommerce is a strong default. Choose a plan with enough PHP workers for checkout traffic.
- Is the site mostly content that changes occasionally? Static hosting gives you the best speed and security for the least ongoing effort.
- Do you run custom application logic, such as background jobs, real-time features or non-PHP stacks? Choose a VPS or a managed application platform, and budget for operations.
- Who will look after it in two years? If the honest answer is “nobody”, choose the option with the least to maintain.
Checks before you sign up#
- The renewal price, not just the introductory rate.
- Resource limits: storage, bandwidth, PHP workers, and what happens when you exceed them.
- Backup retention, off-site storage and whether restores are self-service.
- Data-centre locations and whether they matter for your privacy obligations.
- How easily you can export everything and leave.
- Static/Jamstack hosting wins on speed, security and running costs for content that doesn’t need server-side logic.
- Managed WordPress is the practical default for editable business sites and WooCommerce stores, but the application still needs maintenance.
- A VPS gives you total control along with total responsibility. Choose it for custom applications, not to save a few dollars.
- Count people’s time as part of the hosting cost.
Choose the hosting that fits the people, not just the site#
There’s no universally best hosting, only the best fit for your content, your features and the people who will run the site after launch. Get that match right and hosting fades into the background, which is where it belongs. If you’re still shaping the overall project, our guide to planning a website project shows where hosting fits into budget and scope.
We build on all three models and recommend whichever fits. We can also take the ongoing work off your plate. Our Website Care & Maintenance Plan covers updates, backups, monitoring and security for $149 a month. Get in touch and we’ll recommend a hosting setup that suits your site and your team.
Frequently asked questions
Is static hosting faster than WordPress hosting?
Usually, for the first byte. A static site serves prebuilt files from a CDN with no server-side processing per request. A well-configured WordPress host with full-page caching can come close for anonymous visitors, but logged-in users, carts and other uncached requests still depend on PHP and database performance.
Do I need a VPS for a small business website?
Rarely. A VPS gives you full control, but you also take on operating system updates, security hardening, backups and monitoring. Unless you need custom server software or have someone responsible for server administration, managed hosting is usually the safer and cheaper choice overall.
Can I host WordPress as a static site?
Yes. A headless or static-export setup uses WordPress for editing and publishes static files to a CDN. It improves speed and security for content sites but adds build complexity, and dynamic features such as search, comments, forms and WooCommerce checkout need separate solutions.
What should I check before choosing a hosting provider?
Check supported PHP and database versions, automatic backups and how restores work, staging environments, server locations and CDN options, security features, support quality, resource limits and the price at renewal rather than the introductory rate. Also confirm that you can export your site and leave easily.
