How Do You Choose Website Hosting for a Small Business?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Choose a host on five things: it stays up, it’s secure, it’s fast enough, your business owns the account, and you can export your whole site if you leave. The Federal Trade Commission (FTC) tells small businesses to make security a top priority when comparing hosts. That includes a secure connection, a clear plan for software updates, and multi-factor authentication (MFA) on logins.

What this means

Your web host is the company that stores your website files and serves them to visitors. Some hosts only rent you space. Others, often called website builders, include the design tools, the hosting, and the updates in one package.

Here’s what each of the five points means in plain terms:

Reliability. The site is up when customers look for it.
Security. The host offers a secure connection, called Hypertext Transfer Protocol Secure or HTTPS (see 13.2.2 HTTPS), keeps its systems patched, and lets you turn on MFA.
Performance. Pages load quickly on a phone (see 19.5.3 Page Speed).
Ownership. The account is in your business’s name and you can always log in.
Exportability. You can download your pages, images, and data and move them to a new host.

Say a salon uses a website builder bundled with its booking software. Two years later, it wants to switch booking systems. It finds out the website can’t be exported. It has to rebuild every page from scratch. Asking about exports up front would have caught that.

Why it matters

Downtime loses customers. If the site is down when someone searches, they call the next business.
A hacked site hurts trust. Browsers and search engines may warn people away from a site that’s been compromised.
You can get trapped. If you can’t export, leaving the host means paying for a new site.
Vendor-owned accounts cause fights. If the account is in a designer’s name, you may have to ask permission to change your own website.

Who this applies to

Every business with a website. If you already have one, use this page to check your current host. If a vendor hosts your site as part of a package, the same questions apply to them.

How to do it

Decide what kind of site you need. A simple local service site has different needs than an online store. Write down what the site must do (see 13.3.1 Website Objective and Audience).
Ask each host the questions in the list below these steps. The Federal Trade Commission suggests most of them.
Check the account owner. The account should be in the business’s name, under a shared business email (see 12.1.2 Email Accounts and Shared Inboxes).
Read the cancellation terms. Find out what happens to your files and data if you stop paying.
Turn on MFA as soon as the account is open (see 11.7.3 Multi-Factor Authentication).
Give access to a second business-controlled person. Add your web designer as a user with their own login, not by sharing yours.
Set up your own backups if the host’s backups don’t meet your needs (see 11.8 Business Backups).
Record the host in your Master Business Record, with the plan, renewal date, and who has access.

Questions to ask each host:

Is a secure connection (HTTPS) included, and who sets it up?
Who keeps the site’s software and security patches up to date?
Can I turn on MFA for every login?
If my email runs on this domain, do you support email protection settings? (see 12.1.6 Email Security)
Do you back up my site? How often, how long are copies kept, and can I restore one myself?
Can I export my full site, including pages, images, forms, and data?
Who can make changes, and can I do it myself?

What proof to keep

The hosting plan and terms of service, saved as a file
Written answers from the host about backups, updates, and exports
A screenshot of the account owner and user list
Billing receipts

Store these in your website records folder.

Common mistakes

Choosing only on price. The cheapest plan may skip backups, support, or a secure connection.
Letting the designer open the account in their name. Ask them to set it up under your business, then add them as a user.
Never testing an export. A host may say export is possible, but the file may be missing forms or images. Try it once.
Bundling everything with one vendor without an exit plan. Domain, hosting, email, and website in one place is convenient. Make sure each can be moved on its own.
Ignoring renewal pricing. First-year discounts often end. Check what year two costs.

When to get help from a pro

A web professional: if your site has an online store, customer logins, or custom features. Ask:

What hosting does this kind of site need, and why?
If I leave you, what exactly do I get to take with me?
Who handles updates, and how quickly are security patches applied?

Bill’s note

[Bill: add a short story or lesson here. For example, a local business that couldn’t leave a website platform because nothing could be exported, or why you chose the hosting setup SiteSmarty uses.]

If you’d rather have this done for you, SiteSmarty builds and hosts websites for local businesses.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: which host I chose for SiteSmarty and the answers I got to the questions above]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: hosting account owner, user list, and backup settings]
[Result so far:]

Questions people ask

Who should own my hosting account? Your business. Your designer can have their own user login, but the account should be in your business’s name.

Can I move my website to another host later? Usually, if the host lets you export everything. Ask before you sign up, and test an export once.

Does my web host keep backups? Many do, but not all. Ask how often, how long copies are kept, and how to restore one.

Is cheap hosting good enough? It can be for a simple site, if it includes a secure connection, updates, backups, and support. Check what the plan leaves out.

Audit check

Question: Is the website hosted in a business-owned account that is secure, backed up, and exportable?
Pass looks like: Account in the business’s name with MFA. Two business-controlled people can log in. HTTPS included. A clear update and backup plan. Export tested.
Fail looks like: Account owned by a designer or former employee. No MFA. No backups. No way to export the site.
Evidence to collect: Hosting terms, account owner and user list, backup settings, and the host’s written answers about updates and exports.

Where this fits

Do this first: 13.1.2 Registrar Ownership, 13.1.4 DNS Access

Do this next: 13.2.2 HTTPS

Sources

Federal Trade Commission, "Cybersecurity for small business: Hiring a web host" (checked October 16, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.