You Get What You Pay For. Sometimes You Get a Lot Less.

Hosting · Part 1 of 4

You can host a business website in Australia for about twelve dollars a month. I want to be straight about what that price does and does not buy, because in thirty years the same two things have caught people out, and both of them are things nobody mentions at checkout.

You get what you pay for. Sometimes you get a whole lot less.

The first thing missing is backups

Almost every cheap hosting plan says something about backups. Very few of them mean what the customer thinks they mean.

Here is what I have found over and over when somebody finally needs one.

The backup is on the same machine as the website

If the server has a bad day, both copies have a bad day. That is not a backup, it is a second copy in the same building. The ACSC guidance on regular backups is blunt about it: keep a copy on a local device rather than elsewhere in the cloud, then disconnect that device from your network and store it somewhere secure. It is the step cheap plans quietly skip.

Nobody has ever restored it

A backup that has never been restored is a belief, not a system. I have opened backup archives that were empty, archives that had been silently failing for eleven months, and archives that restored perfectly and brought the infection back with them because the site was already compromised when the copy was taken.

The restore is where the price appears

The backup is free. Getting it back is a support ticket, a queue, and sometimes a fee. You discover this on the day you can least afford to discover it.

The question is never whether they take backups. It is when someone last put one back, and who watched it work.

The second thing missing is a space of your own

On a budget plan your website is not on a server. It is on a slice of a server, alongside hundreds of other businesses you will never meet, chosen by nobody, vetted by nobody.

Most of the time that is invisible and fine. The problem is what happens when one of them gets hacked.

Your site can be perfectly maintained. Every plugin current, strong passwords, nothing out of place. And you can still be taken down, blacklisted, or have your pages quietly altered, because somebody three accounts over ran an abandoned plugin from 2019 and the trouble did not stay in their slice.

I have lost count of how many times I have seen this. Not a handful. I genuinely cannot put a number on it, and every single time the owner says the same thing: but there was nothing wrong with my site.

There was not. That was never the point. You were sharing a fate you did not know you had agreed to.

The maths people do not do

Twelve dollars a month is a hundred and forty four dollars a year. That is the number in the decision.

Here is the number that is not in it. Our malware cleanup starts at $700 inc GST, worked in two-hour blocks, and a badly compromised site is not a two hour job. A full security audit is $1,000 inc GST. Neither of those counts the days your site was offline, the customers who tried to reach you and could not, or the email you have to write explaining what happened.

One incident erases several years of the saving, and that is before anyone asks whether customer data was involved.

When cheap hosting is genuinely fine

It is worth saying plainly, because an argument with no honest counter is just advertising.

If your website is a brochure, takes no bookings, holds no customer information, processes no payments and you could rebuild it in an afternoon from a copy on your own laptop, then a budget plan is a reasonable decision. The downside is an inconvenience, and you are pricing it correctly.

The trouble starts when the site quietly stops being a brochure. Somebody adds a contact form. Then a booking system. Then payments, then a customer login. Nobody revisits the hosting decision, because nothing announced that it had changed. That is the moment the price stopped matching the risk, and almost nobody notices it while it is happening.

Five questions to ask your host this week

• Where exactly are my backups stored, and is any copy on a different machine to my website?
• When did you last restore a customer site from backup, and how long did it take?
• How many other accounts share the server my site is on?
• If another account on that server is compromised, what stops it reaching me?
• Who do I call at nine at night, and will they know anything about my site?

You are not trying to catch anybody out. You are finding out what you actually bought. A good host answers all five without hesitating. If the answers take three days to arrive and are vague when they do, that is the answer.

What we do instead

Our hosting runs on hardware we control in Sydney, not a reseller account three layers deep. Backups follow the three copies, two media, one off site rule. One copy is held encrypted at rest with a third party offshore, and another is pulled down to a drive that spends most of its life disconnected from everything. Ransomware cannot encrypt a disk that is not plugged in. We keep those offline archives for at least a year, which matters more than people expect. A compromise that sat quietly for months makes a fortnight of backups worthless, because every copy inside that window is already infected. And if you want to know which country the offshore copy sits in, ask us and we will tell you, which is the same answer you should demand from anyone. If you ring us, you get someone who knows your build.

It is not twelve dollars a month. It is not meant to be. It is meant to be the version where the bad Tuesday is a phone call rather than a fortnight.

The rest of this series

• Part two: why distance still slows your website down, and what a cache cannot hide.
• Part three: where your website data actually lives, and what the Privacy Act really requires.
• Part four: the arithmetic of twelve dollar hosting.

Those three land on the next three Thursdays. They will appear in the hosting archive as they go up.

Common questions