Unlimited Lies. A Field Autopsy Of The Hosting Industry's Greatest Hits.

Open a private window. Search for 'best web hosting 2026'. Click any of the top ten results. I will save you the trouble of opening the next nine: they all recommend Bluehost first, SiteGround second, Hostinger third, and HostGator somewhere in the top five. Every single one. Across thousands of independently published, lovingly curated, editorially independent review sites. A statistical miracle. Or, if you prefer the dull explanation, a £4 billion affiliate marketing industry in which the same three or four hosts pay the highest per-signup commission and the rankings exist to harvest it. WPBeginner, HostingAdvice, Themeisle, WebsiteSetup, Tooltester, Hosting Tribunal — read their disclosures, then read their rankings, then read the disclosures again. The rankings are the disclosure.

Hosting is not a technical decision any more. It has not been a technical decision since approximately 2013, when Endurance International Group finished swallowing the bottom half of the market and discovered that the most profitable kind of server is one full of customers who will never leave because migrating sounds frightening. Everything you read about hosting from that point onward — every blog post, every comparison table, every YouTube review titled 'I tried the cheapest hosts so you don't have to' — has been written inside a marketing funnel built by people who already know which provider you are going to end up with, because they wrote the funnel to deliver you there. This is the field autopsy. Names included. Receipts attached.

The shelf is shorter than it looks.

Walk down the hosting aisle and you will count, on a generous estimate, several hundred brand names. Bluehost. HostGator. iPage. FatCow. JustHost. A Small Orange. Site5. Domain.com. Network Solutions. Web.com. Crazy Domains. Yahoo Small Business. Constant Contact. MOJO Marketplace. Register.com. These are not several hundred companies. These are one company, called Newfold Digital, formerly Endurance International Group, currently owned by the private equity firm Clearlake Capital, which acquired it in 2021 for $3 billion specifically because the cash flow from automatically renewing hosting accounts is the closest thing the internet has to a municipal water bill. The brands exist to give the illusion of choice. The infrastructure is the same. The support team is the same. The oversold shared servers are the same. The renewal pricing is co-ordinated.

Add GoDaddy, which owns Media Temple (since shuttered into GoDaddy Pro), 123 Reg in the UK, Heart Internet, Host Europe Group, and the corpse of what used to be a respectable mid-market shop called tsoHost. Add IONOS, which is the rebranded 1&1 plus Arsys plus a dozen European acquisitions. Add Hostinger, which also operates Niagahoster and Hosting24 and 000webhost, the last of which leaked 13 million plaintext passwords in 2015 and another tranche of customer data in 2019. Add WP Engine, which spent 2024 being publicly throttled by Automattic in a trademark dispute Matt Mullenweg picked on a Friday night in September, leaving WP Engine customers locked out of plugin updates from WordPress.org for days. Add Automattic itself, which owns Pressable and WordPress.com and Jetpack and was happy to weaponise all three the moment its CEO felt slighted.

What you think of as a competitive marketplace is six holding companies, a private equity fund, and one very angry founder, all trading customers between themselves through a network of affiliate sites that they also, in several cases, own. The shelf is a shop window painted onto a warehouse wall.

'Unlimited' has a footnote, and the footnote is the actual product.

There is no such thing as unlimited storage on a shared server. There is no such thing as unlimited bandwidth on a shared server. There is no such thing as unlimited websites on a shared server, unless the word 'website' has been redefined to mean 'a static HTML file that nobody visits'. Every host that uses the word 'unlimited' has, somewhere in section eleven of its acceptable use policy, a clause that reads — and this is paraphrased only lightly from Bluehost's own terms as they stood in 2025 — 'Unlimited hosting accounts are subject to fair usage. Accounts using more than a normal share of CPU, memory, processes, or inodes may be suspended, throttled, or required to upgrade.' The fair-usage threshold is not published. It is decided in retrospect, by an automated abuse system, the first time your site does well enough to matter.

The inode limit is the one nobody warns you about. An inode is a filesystem entry: every file, every folder, every cached page, every email message in every mailbox. Bluehost's 'unlimited' shared plan caps you at 200,000 inodes. A medium-traffic WordPress site with WooCommerce, half a dozen plugins, a cache directory, a backup directory and a mailbox the client never empties will pass 200,000 inodes inside eighteen months without anyone noticing. When you hit the cap, backups stop completing, the cache stops writing, and the host sends you an email recommending you upgrade to VPS. The word 'unlimited' has been on the sales page the entire time.

“Unlimited means 'until you matter'. The day your site starts paying for itself is the day your hosting stops being free.”

The price on the sticker is for the trailer, not the car.

Bluehost's headline price, as of writing, is £2.39 a month for the Basic plan. To get £2.39 a month you must pay 36 months in advance, you must accept that the renewal price is £10.99 a month — quadruple — and you must not, at any point during checkout, untick the pre-selected boxes for CodeGuard Basic at £2.99 a month, SiteLock Security Essential at £2.99 a month, Domain Privacy at £1.08 a month, and Microsoft 365 Email at £4.20 a mailbox per month. Tick nothing, click through politely, and the £2.39 plan exits checkout at £8.73 a month before VAT. Forget to disable auto-renew, and the same plan re-bills at £395.64 plus add-ons in year four. The marketing page never said £395.64. The marketing page said £2.39. Both numbers are true. Only one of them is the product.

Hostinger runs the same playbook with a Lithuanian accent. £1.79 a month for the Premium plan, on a 48-month term, contingent on a launch promotion that has been live continuously for six years. The renewal is £8.99. The 48-month commitment means you have paid £85.92 up front before the first invoice you actually agreed to arrives. The cancellation window is 30 days. The refund excludes the domain, the SSL upgrade you did not realise was not free, and a £4.99 'setup fee' that appears on the invoice and not on the sales page. GoDaddy's Economy plan starts at £1 a month and renews at £9.99. SiteGround, the supposed grown-up in the room, raised its renewal pricing 40% in 2020 when it migrated everyone off cPanel to its in-house Site Tools panel — a panel which, conveniently, is harder to migrate away from because no other host supports its backup format.

This is not aggressive pricing. This is a deliberately engineered cliff edge, calibrated against the well-documented psychological fact that the average small business owner will tolerate a 300% renewal increase before they will tolerate the imagined complexity of moving their website. The renewal is not a price. The renewal is a tax on inertia. The entire industry runs on that tax.

Shared hosting is a Ryanair flight where they oversell the oxygen.

A standard shared hosting node, at Bluehost, HostGator, Hostinger or any of the Newfold brands, carries somewhere between 500 and 2,000 customer accounts on a single physical or virtual server. Nobody publishes the number. The number is what the sales team calls 'commercially sensitive', because if it were on the pricing page it would also be on the cancellation page. The oversubscription works because the host has correctly calculated that most of those 500 to 2,000 sites are abandoned, parked, or receiving fewer than ten visitors a month. The plan only collapses when one neighbour goes viral, gets hacked into a spam relay, or installs a poorly written plugin that opens a database connection per request and never closes it.

This is the 'noisy neighbour' problem and it is not a bug. It is the business model. The host has sold the same CPU core to forty customers on the bet that not all forty will use it simultaneously, and the bet is right until it isn't, at which point the slowest 39 sites get throttled to protect the server, and the customer experiencing the throttling is told their site is slow because they need to upgrade. Move from shared to VPS, and the upsell margin triples. Move from VPS to managed WordPress, and it triples again. The whole pyramid is designed to push you up it, one bad weekend at a time.

The most cynical version of this is GoDaddy's Managed WordPress tier, which from 2017 to 2019 silently injected JavaScript into customer sites to collect analytics for GoDaddy's own marketing platform. Security researcher Igor Kromin discovered the injection in January 2019; GoDaddy initially defended it, then made it opt-out after a public backlash, then removed it entirely after a second wave of coverage. The customers paying for 'managed' hosting were, without their knowledge or consent, hosting GoDaddy's tracking script on their own checkout pages. The injection was disclosed in no contract any of them had signed.

Support is a Zendesk macro and a sincere apology.

Bluehost's '24/7 expert support', if you call it at three in the morning with a database connection error, will connect you to a tier-one agent in Cebu or Bangalore whose job is to confirm your security PIN, paste the contents of a knowledge base article into the chat, and escalate to tier two if you push back politely for more than four minutes. Tier two will run a phpinfo, screenshot the result, and recommend you upgrade to VPS. There is no tier three you can reach as a £2.39-a-month customer. There is a tier three. It exists. It is reserved for accounts billing over $500 a month and for the specific category of incident that lands in the trade press.

The 'managed WordPress' premium tier — WP Engine, Kinsta, Pressable, Cloudways, Flywheel — does buy you genuine human support, and on a good day at Kinsta or WP Engine the response time is measurable in single-digit minutes and the engineer on the other end can read a stack trace. You are paying £25 to £100 a month for one site to get this, and the moment you outgrow the plan you are quoted £300 a month for the next tier without negotiation. The expertise is real. The pricing is calibrated to a market that has nowhere else to go, because the alternative — going back to shared — is unthinkable once you have experienced a support engineer who does not begin every reply with 'I understand your frustration.'

Your backups are not your backups.

Bluehost's CodeGuard Basic, the £2.99-a-month add-on quietly pre-ticked at checkout, gives you a daily backup with a 90-day retention window and one free restore per month. The second restore costs $49.95. The backup excludes files larger than 2GB, which on a WooCommerce site with product images is most of /wp-content/uploads by year two. HostGator's automatic backups are explicitly described in the terms as 'a courtesy' that the host is under no obligation to maintain, restore, or guarantee. Hostinger's weekly backups on the cheap plans run on a 7-day rolling window, which means if your site gets hacked on a Monday and you notice on the following Tuesday, the only backup left is the post-hack one.

Every single host in the consumer tier has, somewhere in its terms of service, a clause that reads — again paraphrased only lightly — 'The customer is solely responsible for maintaining backups of their own data.' Read that sentence again. You are paying a hosting company for the storage and serving of your data, and the contract you signed at checkout explicitly absolves them of any responsibility for keeping a copy of it. The 3-2-1 rule — three copies, two media, one offsite — is not a paranoid best practice. It is the bare minimum required to survive the contract you have already agreed to.

“If the only copy of your business is the one your host is holding, you do not have a website. You have an unsecured loan against their uptime.”

Migration is hard because they made it hard.

cPanel used to be the lingua franca of hosting. Any cPanel host could export a full account backup to any other cPanel host, restore it in one click, and migrate a customer in twenty minutes. In 2018 the private equity firm Oakley Capital bought cPanel and immediately moved its pricing from a flat per-server licence to a per-account model that, depending on tier, increased the cost of running a typical shared server by 300 to 800 percent. The official story was that cPanel was 'simplifying' its pricing. The unofficial story, told quietly by every hosting CTO at every industry conference for the following two years, was that the new model was specifically designed to extract revenue from the customer base before they could leave.

The hosts responded in the only way private equity ever responds, which was to either pass the cost on to customers or build a proprietary control panel and lock everyone into it. SiteGround built Site Tools. Hostinger built hPanel. GoDaddy has cPanel on some plans and a bespoke panel on others, depending on which acquired brand you signed up under. WP Engine never had cPanel. Each of these panels has its own backup format, its own database tooling, its own SSL workflow, and its own dance you have to learn to extract your site. None of them export cleanly to any of the others. The migration friction is the moat. It was deliberately engineered, by an industry that watched cPanel get squeezed and decided the answer was to start squeezing in the same direction themselves.

Green hosting is a carbon offset and a stock photo of a windmill.

GreenGeeks, the host whose entire brand identity is environmental, runs on data centres operated by other companies and offsets its electricity consumption by purchasing Renewable Energy Credits at 300% of its measured grid draw. This is a legitimate accounting practice. It is not the same thing as running on renewable energy. The actual electrons powering the server your site is on are whatever the local grid is producing on the day, which in most of North America is somewhere between 40% and 60% fossil. The 300% REC purchase is a paper offset, not a power-source change. Kualo, Krystal in the UK, and a handful of others run similar models with similar caveats. None of them mention the words 'Renewable Energy Credit' in the marketing copy. They mention 'powered by 300% renewable energy', which is technically true and practically meaningless.

Cloudflare, AWS, Google Cloud and Microsoft Azure all publish actual Power Usage Effectiveness numbers, actual data centre locations, and actual renewable energy contracts with named utilities. The independent ratings exist. They are not on any consumer hosting comparison page, because the consumer hosting comparison page is an affiliate funnel and the actual answers do not move signups.

The 99.9% SLA is a refund of £1.43.

Ninety-nine point nine percent uptime, sustained over a year, permits eight hours and forty-five minutes of downtime. The Bluehost SLA, the HostGator SLA, the iPage SLA, and the SiteGround SLA all promise 99.9% and all define the remedy for breach as a credit equal to the prorated cost of the downtime, which on a £2.39-a-month plan works out to roughly £1.43 if the host loses an entire business day. There is no clause covering lost revenue, lost search ranking, lost transactional email, or reputational damage. There never is. The SLA is not a guarantee. It is a worst-case price ceiling on the refund, capped at the cost of the service itself, which on a shared plan is rounding error.

The historical record is also worth noting. In August 2013 Endurance International Group suffered a multi-day outage across Bluehost, HostGator, HostMonster, JustHost and FatCow simultaneously, because all five brands shared infrastructure and a single data centre cooling failure took the entire portfolio offline. In September 2021 GoDaddy disclosed that the personal data of 1.2 million Managed WordPress customers had been accessed by an unauthorised third party for two months before detection. In November 2021 Hostinger reset the passwords of 14 million customers after a database breach. In 2020 Network Solutions, owned by Newfold, disclosed a breach affecting 22 million accounts that had occurred a year earlier. The pattern is not 'these things happen'. The pattern is 'these things happen, the disclosure is delayed, the credit is £1.43, and the marketing page still says 24/7 expert security monitoring'.

The reviews you are reading were written by the hosts.

WPBeginner, the largest WordPress tutorial site on the internet, is owned by Syed Balkhi, who also owns OptinMonster, WPForms, MonsterInsights, AIOSEO and SeedProd. Every plugin recommendation on WPBeginner is, with vanishingly few exceptions, either a plugin Balkhi owns or a plugin paying him an affiliate commission. The 'best WordPress hosting' guide on WPBeginner has recommended Bluehost in the top slot continuously since 2013, a recommendation that, per public archives of the affiliate disclosure, pays $200 per signup. Bluehost is one of three hosts officially 'recommended' on WordPress.org's hosting page — a recommendation that is also paid, has been paid since 2005, and is the single largest signup driver any consumer host on the internet possesses. The other two are Pressable, which Automattic owns, and Hostinger, which began paying for the slot in 2022.

Read that paragraph twice. The biggest tutorial site in the WordPress ecosystem and the official WordPress.org recommendations page are both, in effect, paid placements for the same host, owned by the same private equity firm, running the same oversold shared infrastructure, with the same £2.39-to-£10.99 renewal cliff. The recommendation engine of the entire WordPress economy points to a single sponsored door, and the people walking through it think they are making an informed choice.

What to actually do, if you still need a host this afternoon.

If you are building a brochure site, a blog, a portfolio, or anything that does not require server-side rendering of authenticated content, do not buy hosting. Put the site on Cloudflare Pages, Netlify, or Vercel's free tier. There is no renewal cliff. There is no fair-usage clause that triggers when you succeed. There is no inode limit. There is no shared neighbour. The CDN is the host. The host is global. The bill, for anything short of viral traffic, is zero. If you need a CMS, use a static site generator with a headless content layer, or build on a modern framework like TanStack Start or Astro and deploy the same way. The entire shared-hosting market was invented to solve a problem — running PHP cheaply — that most sites in 2026 no longer have.

If you genuinely need WordPress, because the client refuses to move and the ecommerce plugin stack only exists on WooCommerce, do not buy it from Newfold. Pay actual money to Kinsta, WP Engine, Pressable, or Cloudways. The bill will start at £25 a month per site and you will know exactly what you are paying for, the support engineer will be a human being who has seen a stack trace before, and the migration tooling will not be designed to trap you. The £2.39 was always the most expensive option. You just paid for it in time, downtime, and the cumulative cost of every Friday evening you spent on chat with someone whose first reply was 'I understand your frustration.'

• →Assume the renewal price is the real price. Multiply the headline by four and budget accordingly.
• →Untick every pre-selected add-on at checkout. Then untick them again on the next screen, because some of them come back.
• →Read the inode limit, the CPU minutes limit, and the entry-process limit on whatever 'unlimited' plan you are about to buy. They are in the terms. They are not on the sales page.
• →Keep your own backups, off the host, on a schedule the host has nothing to do with. UpdraftPlus to S3 is fifteen minutes of setup and saves you a business in year three.
• →Treat 'recommended by WordPress.org' the same way you treat 'recommended by a flight comparison site'. It is a paid slot, not an endorsement.
• →If you can avoid PHP, avoid PHP. The entire shared hosting industry exists to keep PHP cheap, and PHP being cheap is the reason the rest of this article had to be written.

Final thoughts, for the people still on the £1.99 plan.

Hosting is not a commodity. Hosting is a contract you signed in a hurry, three years ago, with a company that has since been sold to a private equity firm you have never heard of, who hired a consultancy to model the maximum renewal increase your specific customer cohort would tolerate before churning, and then set the renewal price one pound below that number. The contract is honoured. The price is honoured. The 'unlimited' is honoured up to the point where it is enforced against you. Everything is technically true. Everything is also the reason your business is paying £127 a month for a service that is materially worse than the one a £0 Cloudflare Pages deployment would provide for the same site.

The industry is not evil. It is just optimised, ruthlessly and competently, for a customer who does not read the contract, does not check the renewal, does not migrate, and does not complain until the site is already down. If you are still reading at this point, you are not that customer. Act accordingly. Cancel the auto-renew. Pull the backups offsite. Schedule the migration for a Tuesday in the quiet week between Christmas and New Year. And the next time a junior at the agency asks which host you recommend, do not say Bluehost. Do not say Hostinger. Do not say SiteGround. Say the truth: that the question is the wrong question, and the answer is to stop needing a host in the shape the industry currently sells one.

The £1.99 was never the price. The £1.99 was the hook. The price was your attention, your inertia, and the four years of renewals you forgot to cancel. You can have all three of those back. Starting today.