Early in my Web Dev career, I made the classic mistake of thinking I was a fully-fledged sysadmin just because I knew my way around a bit of PHP and could copy-paste commands into a terminal. Now, after many years running Code Clinic (aff), I've realised that knowing your limits, understanding your actual requirements, and valuing your own time are the most profitable skills you can develop. So, in this edition of The Admins' Toolkit, we are going to dissect the reality of hosting for WordPress (and non-WordPress) sites. We will look at it through the lenses that actually matter to an agency: your true skill level, ease of maintenance, the nightmare of security, and ultimately, how to monetise it properly without losing too much sleep.
The Skill Level Reality Check
The hosting industry loves to sell the dream of “unmanaged cloud compute.” It sounds brilliant, doesn't it? Spinning up a bare-metal server on DigitalOcean (aff), Linode (aff), or Vultr (aff) for a fiver a month. But here is the reality check: if you break out in a cold sweat looking at a Linux command line, you have absolutely no business running an unmanaged server. There is a massive difference between being a brilliant web developer and being a competent systems administrator.
As developers, we want to write code, build layouts, configure advanced custom fields, and launch projects. Sysadmins spend their days configuring firewalls, optimising Nginx, tuning MySQL databases, and reading server logs to figure out why a PHP worker suddenly decided to eat 16GB of RAM. If you lack the in-house Linux expertise, do not fake it. The moment a server goes down, your client doesn't care that you saved them twenty euros a month; they care that their e-commerce store is losing sales by the minute.
The Middle Ground
For most WordPress-focused agencies, the sweet spot lies in server control panels like GridPane, RunCloud, or SpinupWP (aff). These services act as a bridge. You still purchase your own cloud infrastructure (which keeps costs incredibly low), but the control panel handles the complex Linux administration, security patching, and server stack optimisation. It allows a standard web developer to wield the power of a sysadmin without having to memorise Bash commands.
Ease of Use and Maintenance: The True Cost of Time
When you are evaluating a hosting platform, you must factor in the cost of your own time. A server that costs €10 a month but requires three hours of manual maintenance, backup checking, and troubleshooting every month is significantly more expensive than a €50 a month managed solution that you never have to touch.
Managed WordPress Hosting (e.g., Kinsta, WP Engine, Flywheel): These are incredibly easy to use. They take care of daily backups, caching, staging environments, and WordPress core updates. If something breaks at the server level, you open a chat window and someone else fixes it. The trade-off? You pay a premium for that peace of mind, which directly eats into your agency's profit margins. Furthermore, they are highly restrictive. Need a specific PHP module? Bad luck. Want to run a custom Node.js application alongside WordPress? Not going to happen.
VPS + Control Panel (The Agency Standard): This is where most profitable agencies end up. By standardising your stack -for example, putting all clients on Vultr high-frequency servers managed via GridPane- you create a predictable, easily maintained environment. You get staging sites, automated backups, and one-click SSL certificates, but you retain full root access if you ever need it. Maintenance becomes a breeze because every site you manage lives within the exact same architecture.
The Legacy cPanel Shared Host: While cPanel is familiar, traditional shared hosting environments are often overcrowded, chronically slow, and entirely unsuited for modern, dynamic WordPress sites—especially those running WooCommerce or complex membership plugins. If your client is paying you thousands for a bespoke website, putting it on a €3/month shared host is doing them a massive disservice.
The Security Headache: Who Holds the Bag?
Security is usually an afterthought until a client calls to say their homepage is redirecting to a pharmaceutical site. When you provide hosting, you are implicitly taking on the responsibility for the site's security. Security operates on two levels: the application (WordPress) and the server.
Server-Level Security
If you are rolling your own server, you are responsible for keeping the OS updated, configuring fail2ban, setting up firewalls (UFW/iptables), and closing unnecessary ports. This is a massive liability. If you use a managed provider or a modern control panel, this is largely handled for you.
Isolation and Cross-Contamination
This is the most critical security flaw I see in how small agencies handle hosting. They buy a large VPS, install a basic control panel, and dump fifty client sites onto it under the same system user. If just one of those sites gets compromised -perhaps through an outdated plugin- the malware can traverse the server and infect every single site you host. Proper hosting requires strict isolation. Each website should run under its own system user, completely walled off from the others. If Client A gets hacked, Client B should remain completely oblivious and untouched. Never compromise on user isolation.
Pro Tip: Don't rely solely on WordPress security plugins like Wordfence (aff) to do a server's job. While application-level firewalls are great, blocking malicious traffic at the server level (via Nginx rules or a Web Application Firewall like Cloudflare (aff)) uses far fewer resources and stops the bad actors before they even hit PHP.
Profitability and the Agency Business Model
Now we get to the crux of the matter: how do we actually monetise this? Hosting should be a massive source of recurring revenue for your agency, not a loss leader. If you are simply telling clients, “Go and buy a GoDaddy (aff) account and send me the login,” you are leaving serious money on the table and making your own life significantly harder. You will end up working across ten different, awful control panels, dealing with ten different support teams.
The Reseller Route
You can buy a bulk plan from a managed host and resell it. If a plan costs you €100 a month for 10 sites, your cost per site is €10. You sell hosting and a basic maintenance package to the client for €50 a month. You've made €40 profit per site. It's safe, it's easy, but the margins are fixed, and as you scale, the managed host takes a large cut of your potential revenue. The Infrastructure Route (Maximum Margin) Let's look at the VPS + Control Panel route. A high-performance 8GB RAM cloud server might cost you £40 a month. The control panel to manage it costs perhaps €30 a month. Total outgoing: €70 a month.
On that server, you can comfortably host 30 standard WordPress brochure sites. If you charge each client your £50/month hosting and maintenance fee, you are generating €1,500 a month in revenue against a €70 infrastructure cost. That is a profit margin that allows you to actually grow an agency. It pays for your time to run the updates, it pays for premium plugin licenses, and it leaves a healthy surplus.
However, you must be disciplined. Standardise your stack. Refuse to host clients on their own bespoke setups unless they are paying enterprise rates. When a client insists on using their cousin's server under the stairs, politely decline or add a 50% “foreign environment tax” to your hourly rate, because it will invariably break, and it will invariably take you twice as long to fix.
The Non-WordPress Elephant in the Room
While WPAC is obviously heavily focused on WordPress, the reality of a modern agency is that you rarely work with just one technology. You might have a client who needs a custom Laravel application, a headless front-end built in React or Vue, or perhaps a simple static site generated via Hugo or 11ty. Do not try to force a non-WordPress square peg into a managed WordPress round hole. Sticking a Node.js app on a stack highly optimised for PHP-FPM and WordPress transients is a recipe for disaster.
When selecting hosting for bespoke web applications, you need environments designed for modern deployment workflows. Services like Vercel (aff) or Netlify (aff) are absolute game-changers for static sites and serverless front-ends. For Laravel, using Laravel Forge to provision a standard Ubuntu server is the industry standard for a reason.
If you have clients with mixed technology requirements, you must maintain separate infrastructure. Keep your WordPress ecosystem completely segregated from your bespoke application servers. It makes scaling easier, it makes debugging much simpler, and most importantly, it limits your blast radius if something goes catastrophically wrong.
Conclusion: Standardise to Organise
At the end of the day, selecting the correct hosting isn't about finding a magical server that never goes down. It’s about creating a predictable, manageable ecosystem for your agency. Be brutally honest about your team's technical capabilities. If you don't know how to restart a hung MySQL process from a command line, do not rent unmanaged bare metal. Value your time enough to pay for tools like RunCloud (aff) or GridPane (aff) that bridge the gap between raw cloud power and user-friendly interfaces.
Prioritise server-level isolation to protect your clients from each other, and standardise your hosting environment so your team isn't context-switching between five different providers every afternoon. When you get the hosting architecture right, it shifts from being a constant source of stress to being the quiet, highly profitable backbone of your entire
business.
