What should I check before buying web hosting?

Last updated: 26 August 2026 · Reviewed: 26 August 2026 · By: Alston Antony

Quick answer

Twelve checks separate a good hosting purchase from a locked-in mistake. The critical five are the renewal price (usually 2 to 3 times the intro), included free SSL and daily backups with easy restore, PHP 8.2 or newer, a real 30-day money-back window, and a timed support test before you pay. Skipping any of these on a plan that looks cheap - Hostinger Premium intro at USD 2.99 per month, roughly LKR 1,020 (checked 27 August 2026) - is how sites end up paying LKR 2,720 per month the year after and unable to leave.

The twelve buying checks, in priority order

Renewal price in the plan's currency. Not the intro. Ask for the exact renewal in USD or LKR.
Free SSL certificate issued through Let's Encrypt or the host's own AutoSSL, on every domain.
Daily automated backups with one-click restore, kept for at least seven days.
PHP 8.2 or newer and MariaDB / MySQL current within the last two releases.
Bundled CDN, usually Cloudflare or the host's edge network. If missing, plan to add Cloudflare free tier.
30-day money-back guarantee on shared and WordPress plans, no restocking fee, no domain charge.
Support response test - a specific pre-sales question, timed. Under thirty minutes for a real answer.
Independent third-party reviews from Trustpilot and Reddit r/webhosting, not just the host's own testimonials.
Server region - Mumbai, Bangalore or Singapore for Sri Lankan visitors; ask before purchase.
Free migration if a live site already exists elsewhere. Most reputable hosts do this on signup.
Staging environment on WordPress plans from the mid tier upward. One-click clone and merge is the bar.
Ownership of the account. If a designer buys hosting on their account, the site is not yours.

Renewal price is the trap that catches most Sri Lankan buyers

Renewal pricing is where introductory offers earn back their discount. Hostinger's Premium plan moves from USD 2.99 to USD 7.99 per month, a jump from roughly LKR 1,020 to LKR 2,720 at USD/LKR 340 (checked 27 August 2026). SiteGround GrowBig moves from USD 3.99 to USD 17.99, roughly LKR 1,360 to LKR 6,120. Namecheap Stellar Plus moves from USD 1.99 to USD 4.44, roughly LKR 680 to LKR 1,510. Budget on the renewal from the start, because the intro rate only covers the first invoice. A three-year term extends the intro but ties the site to that host for three years - a real cost if support turns out to be poor.

Backups are not the same as "included backups"

Backups are the check most first-time buyers get wrong. "Daily backups included" often means the host takes a snapshot but charges LKR 3,000 or USD 20 to restore it, or keeps only the last 24 hours. The real question for the host's chat window is: "Do you keep at least seven daily restore points, and is the restore free from cPanel or the equivalent panel?" SiteGround keeps thirty rolling snapshots on GrowBig with free restore. Hostinger keeps weekly on Premium and daily on Business (paid restore below Business). Namecheap keeps twice-weekly. Ask before you buy.

PHP version and database version matter more than "unlimited"

PHP version is the biggest single lever on WordPress speed and security. PHP 8.2 (released 2022) is roughly 40 to 60 percent faster than PHP 7.4 on typical WordPress workloads, and PHP 8.3 adds another 5 to 10 percent. Any host still stuck on PHP 7.4 or 8.0 as the default is behind. MariaDB 10.6 or newer, or MySQL 8.0 or newer, is the matching database standard. "Unlimited storage" and "unlimited bandwidth" are marketing labels; a typical Sri Lankan small business site uses under 1 GB of storage and under 30 GB of bandwidth per month, so the versions matter more than the caps.

Independent reviews and the ownership question

Independent reviews are where the host's real reputation lives. Trustpilot, Reddit's r/webhosting, and search results for "[host name] downtime 2025" or "[host name] refund refused" surface the failure modes the sales page hides. Filter for reviews about billing, refunds and support - those are the moments hosts stop trying. Separately, the ownership question is the one non-technical check that matters most for Sri Lankan buyers who use a designer: the hosting account and domain must be in your name and your email, not the designer's. Losing access to a designer's cPanel is the most common way small businesses lose their sites.

Frequently asked questions

What is a fair money-back guarantee for web hosting?

30 days is the industry standard on shared and WordPress plans. Hostinger, SiteGround, Namecheap and Bluehost all honour it. VPS and cloud plans usually offer less (7 to 14 days) because they cannot be resold. A shorter window than 30 days on shared hosting is a red flag.

Does the host include free SSL, or do I need to buy one?

Every reputable host includes free Let's Encrypt SSL on all plans in 2026. Paying for premium SSL is only useful for extended-validation certificates on banking or medical sites. If a host charges LKR 3,000 per year for basic SSL, that is old pricing and worth skipping.

Should I ask about the exact server location before buying?

Yes, and prefer Mumbai, Bangalore or Singapore for Sri Lankan visitors. Cloudways lists the Vultr HF Bangalore region explicitly; Hostinger and SiteGround assign a region at signup. If the host cannot name a specific city, they are probably reselling and you cannot verify the latency.

Is unlimited storage or unlimited bandwidth real?

Not really. Fair-use limits kick in around 20 to 40 GB of storage or when CPU spikes, at which point the host throttles or asks you to upgrade. A typical Sri Lankan small business site uses under 1 GB of storage and under 30 GB of bandwidth per month, so unlimited claims are marketing not utility.

Sources

Hostinger - premium plan features — Backup, SSL, PHP version, refund policy (checked 26 Aug 2026)
SiteGround - GrowBig plan features — Staging, on-demand backups, CDN (checked 26 Aug 2026)
Namecheap - Stellar Plus — Migration, refund window, included features (checked 26 Aug 2026)