Web Hosting and Domains: The Complete Guide to Names, Servers, Backups, HTTPS and Email

Setting up a website means making a handful of separate decisions: where the name lives, where the files live, how they are backed up, how visitors reach them safely, and how email from your domain is trusted. Hosting companies often sell all of it as one bundle, which makes it harder to see what each part does and what to ask before you pay. This guide puts the pieces in one place. Every section is drawn from public sources from Mozilla, the UK's National Cyber Security Centre (NCSC), ICANN, Let's Encrypt, the US Cybersecurity and Infrastructure Security Agency (CISA), WordPress.org, Amazon, DigitalOcean and Google's web.dev, and each has its own source link and "last checked" date.

This guide is based on the public sources listed in each section. We have not tested any hosting company, registrar or service, and we do not recommend one. Where a fact is about one vendor, we say so and use it only as a worked example.

Quick map: what each piece does

What a web server and hosting are

Source: Mozilla (MDN), "What is a web server". Last checked: 15 October 2026.

A web server is hardware (a computer that stores a site's files and stays online), software (an HTTP server that understands web addresses and answers requests), or both together. When someone visits a page, the browser sends an HTTP request for that address. The server looks for a matching file. If it finds one, it sends it back. If not, it may build the page on the spot, and otherwise it returns an error, usually 404 Not Found.

MDN describes two kinds:

• Static server: sends files exactly as stored.
• Dynamic server: adds an application server and usually a database that builds pages before sending them, for example by filling a template with database content.

MDN suggests starting with a static site when you can, because it is simpler. Hosting simply means storing your site's files on a machine that stays connected and usually has a fixed IP address, so visitors can reach it through your domain name.

So a small brochure site needs far less than a store with a database, logins and a checkout. Match the plan to the software you will actually run.

Domain names: what they are made of and how lookup works

Source: MDN, "What is a domain name". Last checked: 15 October 2026.

A domain name is a human-readable address for a server. It exists so that people do not need to remember IP addresses, which are hard to remember and can change. Read a domain from right to left:

Each label can be 1 to 63 characters of letters, digits and hyphens, with no hyphen at the start or end.

What happens when someone types your address

1. They type a name, such as example.org.
2. Their computer checks its local DNS cache for the matching IP address.
3. If it is not cached, it asks a DNS server, which returns the IP address.
4. The browser connects to the web server at that address and asks for the page.

DNS data is cached for a time and then refreshed from authoritative servers, so a change to a record can take hours to spread. That is why a site move or a new email setup does not always work instantly.

Domain, registrar, registry and host: who does what

Sources: MDN, "What is a domain name"; UK NCSC, "Managing public domain names"; ICANN registrar pages. Last checked: 15 October 2026.

You do not buy a domain outright. MDN explains that you pay to use it for one or more years and can renew it, with renewals taking priority over new applications. You can check whether a name is free with a registrar's "whois" lookup. A misspelled name is paid for and cannot be undone, so check it carefully. Give a valid real-world address, because registrars may close domains without one. MDN gives no prices, so compare renewal prices on each registrar's own page.

The registrar and the host can be different companies, and bundling them is optional. Registering a name does not create a website: the name needs hosting (or a redirect) to show anything, and unused names may be "parked" on an advertising page by the registrar.

The NCSC's advice for keeping control of a domain

The NCSC's guidance is aimed at organisations, but the points carry over to any small site:

• Keep the domain in an account you control, not under the hosting company's login.
• Make sure more than one trusted person can get in, and turn on two-factor sign-in on the registrar account with a strong, unique password.
• Consider a registrar lock.
• Turn on auto-renew and pay with a card that will not expire, because a lapsed name can be registered by someone else.
• Remove old DNS records when you retire a service, because leftover records can be hijacked.
• Watch for unexpected changes to name servers and mail records.
• Publish SPF, DKIM and DMARC records to reduce email spoofing (explained below).
• DNSSEC is optional and adds complexity.

Renewals and expiry: how not to lose a domain

Source: ICANN, "Domain name renewal and expiration FAQs" (page dated 2018, so check ICANN for the current policy). Last checked: 15 October 2026.

ICANN says registrars must send renewal reminders about a month and a week before expiry, and a notice within five days afterwards. Reminders only help if your contact details are current. Many registrars offer auto-renew, which needs up-to-date payment details.

What happens after expiry:

1. The registrar may delete the domain, which can then be released for anyone to register.
2. For about 30 days after deletion, a redemption grace period lets the registrar restore the name, often for an extra fee.
3. If it is not restored, it sits about five days in "pending delete" before release.
4. An expired domain can be transferred, but one in redemption must be restored by the current registrar first.

If something goes wrong, contact your registrar first (ICANN's WHOIS lookup shows who it is). If reminders were missing, renewal failed or redemption was blocked, a Domain Renewal Complaint can be filed with ICANN Contractual Compliance, which says responses typically take 3 to 5 business days. Keep your contact email current, put the renewal date in your calendar, and do not rely on auto-renew alone.

Choosing a hosting plan: what the numbers mean

Source: DigitalOcean documentation, "Choosing a plan", used as a worked example of virtual servers, not as a recommendation. Last checked: 15 October 2026.

A virtual private server (VPS) is a virtual machine carved out of a physical host. DigitalOcean's documentation lists the resources to compare:

It also explains that shared-CPU plans pool processor time with neighbours, which makes them cheaper and fine for light or bursty sites but with no performance guarantee when neighbours are busy, while dedicated-CPU plans reserve threads for steady performance. Its advice for choosing is to measure: check CPU and memory graphs under realistic load, and resize when one resource is constantly maxed out.

Our guide to web hosting types compares managed WordPress, cloud and shared hosting in more detail.

What WordPress asks of a host

Source: WordPress.org, "Requirements". Last checked: 15 October 2026.

If you run WordPress, its official requirements page recommends a current PHP version, MariaDB or MySQL, HTTPS support, and Apache or Nginx (with mod_rewrite) as the most robust choice, though any server that runs PHP and MySQL works. Older versions (PHP 7.4 and MySQL 5.5.5 are named as still running) are end-of-life and may expose a site to security risk. The exact version numbers change with each release, so read the page rather than a table on a hosting site. WordPress suggests asking a host:

• Do you support these versions and HTTPS?
• Do you run Apache or Nginx with mod_rewrite?
• What do you do to secure my account?

It also recommends running PHP under the site's own account rather than a shared default user, for security.

Five questions to ask before you pay

1. Does it meet the software requirements above for what I will run?
2. What will it cost at renewal, not just in the first term, and what is the refund window? (General advice: read the seller's terms.)
3. What does "unlimited" mean in the terms, for example fair-use limits on bandwidth or storage?
4. What are the backup and exit arrangements? (See the next sections.)
5. How is uptime measured and what do I get if it fails?

Other checks worth making: where the data centre is, when support is available, how to export a full copy of your site, how to cancel, and whether the domain is registered in your own name.

Backups: the 3-2-1 rule

Source: US CISA, "Back up business data". Last checked: 15 October 2026.

A backup stored on the same server as your site does not help if that server fails or is attacked. CISA, writing for small and medium businesses, gives a simple rule:

• Keep three copies of important files.
• Store them on two different types of storage.
• Keep one copy off-site.

Cloud storage can serve as the second type. Mixing on-site and remote copies protects against both cyber attacks and physical damage.

What to include: customer and financial records, email, configuration files, and website or operational databases. CISA suggests starting with an inventory: what data you have, where it is kept and who can reach it.

Good habits: run backups automatically on a regular schedule, protect them with physical security, encryption and offline copies, and test restores, both full and partial. CISA says to make sure you can roll data back at least seven days.

CISA's page is general business advice, not a hosting checklist. For a website, turn it into questions for the host:

1. Are backups kept on a different server or location from the live site?
2. How often are they taken and how long are they kept?
3. Can I download my own full copy?
4. How do I restore, and does restoring cost extra?
5. Who is responsible for backups on this plan, the host or me? Read the terms, because this is often the customer's duty.

HTTPS and the padlock

Source: Let's Encrypt, "How it works". Last checked: 15 October 2026.

HTTPS is the ordinary web protocol with encryption (TLS) added. It hides data as it travels between your browser and the site and lets you detect changes along the way.

Let's Encrypt, a non-profit certificate authority, describes how a free certificate is issued:

1. The site owner's software proves it controls the domain by answering a challenge, either a DNS record or a file served over HTTP.
2. The authority checks from several points on the network.
3. After a signed request, it issues the certificate and logs it in public Certificate Transparency logs.
4. Renewal repeats the process, and a certificate can be revoked with the account key.

Many hosts set this up and renew it automatically.

What the padlock tells you: the connection to that domain is encrypted, and whoever requested the certificate controlled the domain when it was issued. What it does not tell you: who the business is, or that it is honest. The Let's Encrypt page does not claim to verify anything beyond control of the domain. A padlock is not a reason to trust a shop; our guide to checking whether an online store is legit covers the checks that matter.

For site owners: ask whether a free certificate is included and renewed automatically, and what happens if renewal fails.

Email on your domain: SPF, DKIM and DMARC

Source: UK NCSC, "Email security and anti-spoofing". Last checked: 15 October 2026.

If you send email from your own domain, three DNS records help receiving servers tell your real mail from forgeries:

Together they make it harder for criminals to send fake email that appears to come from your domain. The NCSC recommends setting up all three on every domain you own, including domains used with cloud email providers such as Google Workspace and Microsoft 365. It also advises making sure your email service sends and receives with TLS, and checking your setup with its free email security check. The guidance is aimed at organisations, and a small site can use the same three checks.

Questions for a host or email provider: is email included with the domain or a separate paid product, can I add SPF, DKIM and DMARC records in your DNS panel, what are the mailbox and sending limits, and how is spam handled?

Uptime promises and service-level agreements

Source: Amazon Web Services, EC2 service level agreement, used only as a worked example of how an SLA works. Last checked: 15 October 2026.

A promise of 99.9% uptime sounds close to perfect. The arithmetic shows what it allows:

Over a whole year, 99.9% allows about 8.8 hours.

Amazon's compute SLA is for a large cloud provider, not shared hosting, but it shows the mechanics clearly:

• Availability is defined narrowly: an instance counts as down only when it loses external connectivity.
• The remedy is a service credit as a percentage of that month's bill, in tiers (for example 10% below the target but at least 99%, 30% below 99%, and 100% below 95%).
• Credits go against future bills. They are not cash refunds.
• You must file a claim with logs and dates within a set window (here, by the end of the second billing cycle).
• Causes outside the provider's control, and your own actions or software, are excluded.

What to look for in any host's terms: how downtime is measured and what is excluded, what the remedy is and how to claim it, whether the credit is automatic, and whether there is a time limit on claims. We have no source on typical shared-hosting terms, so read the terms of the plan you are considering.

Page speed: Core Web Vitals

Source: Google web.dev, "Web Vitals". Last checked: 15 October 2026.

Google's web.dev describes three measures of page experience:

A page is assessed at the 75th percentile of page loads, separately for mobile and desktop, and passes if all three meet their targets at that point.

Hosting comes in through server response time and caching, which can affect LCP. When comparing hosts you can ask whether caching is included and whether the plan offers a content delivery network. We have no source on what any particular host offers. The web.dev page describes how the measures work. It does not say a good score will raise a page's position in search results, so do not buy a plan on that promise.

A pre-launch checklist

1. Domain registered in your own account, with two-factor sign-in, auto-renew on and a current card.
2. Hosting plan matched to your software, with renewal price, refund window and "unlimited" terms read.
3. Backups: three copies, two storage types, one off-site, with a restore tested.
4. HTTPS certificate included and renewing automatically.
5. SPF, DKIM and DMARC records published, and the setup checked.
6. Uptime terms read: how measured, what remedy, how to claim.
7. Page speed measured on mobile for your own pages.
8. A way to export a full copy of the site, and cancellation steps noted.

Related complete guides

• Safe Online Shopping: Scams, Fake Reviews, Fake Goods and the Checks That Work: Phishing, fake reviews and safe shopping for the people who use your site.
• Wi-Fi, Cooling and Smart Home Basics: Home networking and smart home basics.