Hosting checklist

You should be able to answer these questions before you sign or cancel a hosting contract. Tick off what has been clarified and note down the provider’s answers. Your entries are stored only in your browser and are not transmitted anywhere.

We deliberately name no providers. Which host suits you depends on your website – the questions help you find out. Which type of hosting is an option at all is explained on the page Choosing hosting.

1. Contract and costs

How long does the contract run, and with what notice can I cancel? Note the minimum term, renewal and notice period – and put the last possible cancellation date in your calendar.
What does the plan cost after the introductory period? Teaser prices often only apply for the first few months. Calculate with the regular price.
What is included in the price, and what costs extra? Domains, SSL certificates, mailboxes, databases, backups, restores.
Who is the contracting party – you or your agency? If an agency holds the contract, clarify how you would get access and data in an emergency.

2. Domains

Who is registered as the holder of the domain? That should be you or your company, not the service provider.
Will I get the code for changing provider without fuss? For .de domains (Germany’s country-code domain) it is called AuthInfo. According to DENIC, the .de registry, it expires automatically after 30 days and then has to be requested again – so only request it when the move is due. Procedure: Moving a domain.
Where is the DNS hosted? With the host, the registrar or a separate service? This determines what has to be switched over when you move (including email).

3. Technology

Which PHP versions are offered, and for how long? Make sure the versions offered still receive security updates. According to php.net (as of October 2026) these are the branches 8.2 (security updates until 31 December 2026), 8.3 (until 31 December 2027), 8.4 (until 31 December 2028) and 8.5 (until 31 December 2029). PHP 7.4 has not received any updates since 28 November 2022.
Does my website run on a current version? Older applications often break when you upgrade. A typical example: the old MySQL extension (mysql_* functions) was removed in PHP 7.0 – code that uses it no longer runs on any supported PHP version.
Are TLS certificates issued and renewed automatically? Following a decision of the CA/Browser Forum, the maximum validity of publicly trusted certificates is being reduced step by step to 47 days by March 2029. Without automation, renewal becomes a permanent chore.
Is there SSH, Git or another deployment method? Important if your website is to be deployed automatically.
Will database and storage space be enough for the growth of the next few years?
Is there a test environment (staging)?

4. Backups and restoring

How often does the host back up, how long are backups kept, and where are they stored?
Can I restore them myself – and what does it cost if the host does it?
Do I also have my own backup outside the hosting provider? A backup stored only with the same provider does not help if the account is blocked or terminated.
Are there no backup files in the public web directory? ZIP archives, database exports or copies of configuration files (e.g. config.php~) in the web directory can be downloaded by anyone.

5. Data protection

Is there a data processing agreement (DPA)? If the host processes personal data on your behalf – such as form submissions, customer accounts or emails – Art. 28 GDPR requires such an agreement. Reputable providers offer it as a download or in the customer area.
Where are the servers located? If data is transferred to countries outside the EU, the rules of Art. 44 et seq. GDPR also apply.
Which security measures does the provider describe? Art. 32 GDPR requires appropriate technical and organisational measures; many hosts attach them to the data processing agreement.

These notes are not legal advice.

6. Email

Are mailboxes included in the plan, and how large may they be?
What happens to the emails when you switch? Plan the move of the mailboxes and the timing of the DNS switch together, otherwise messages will be lost.

7. Support and exit

How do I reach support, at what times, and in which language?
How do I get all my data when I switch? Files, databases, mailboxes, access credentials – ideally in standard formats.
Who has access to hosting, domain and DNS today? Keep the credentials in a safe place, e.g. in a password manager.
Can the sign-in be secured with a second factor? The BSI (Germany’s Federal Office for Information Security) recommends two-factor authentication as soon as a service offers it.

From practice. When we moved the old version of this website to a new server in 2026, we found a few things in the web directory that did not belong there: a backup copy of a configuration file (with a tilde at the end of its name) that could be downloaded publicly, and a complete backup of the website as a ZIP file. An old contact script sent an email every time it was called, without checking who was calling it. An administration interface and an installation script could be reached from outside. And parts of the code still used the old mysql_* database functions, which were removed in PHP 7.0. So before a move, check what is in your web directory – and take only what you really need.

Terms from this list are explained in the Glossary: hosting.

The list is deliberately short. Is a question missing? Write to us at redaktion@hosting-stammtisch.de. How this page was created and which sources we use: How we work.