Hostinger Web Hosting

The Agency Lead

AMD EPYC, NVMe storage, LiteSpeed with object cache, a built-in CDN, HTTP/2 and a 99.9% uptime guarantee are documented, the agency tariff states its cores, RAM, storage and inodes, and the status page shows ninety days of uptime history. The captured pages give different pictures of PHP support — one promises the latest PHP and MySQL updates, another documents switching between versions 5.2 to 7.4. We found no public information on an SLA with a service credit, HTTP/3 or a published PHP end-of-life policy, and that gap matters when two of my sixty client sites are shops. 1 3 5 11 14

Report an error

The Small-Business Owner

The pages name AMD EPYC processors, NVMe storage, a 1 Gbps network, HTTP/2 across servers, LiteSpeed caching with an object cache and a global CDN, a 99.9 % uptime figure and a public status page with the last ninety days of uptime visible — more than I need to know as a layman. What I miss is a guaranteed-resources promise with a service credit behind the uptime figure, and a written policy on how long PHP versions stay supported; the captured pages give different figures here, one describing PHP versions 5.2 to 7.4, another the latest PHP and MySQL updates. 1 3 5 11 14

Report an error

The Shop Operator

The hardware story is good for my size: AMD EPYC, NVMe, LiteSpeed, HTTP/2 across all servers, a built-in CDN with object cache, CPU, RAM, storage and PHP workers per tariff published, and a free 24-hour plan boost that is exactly what I want for a Black Friday weekend. What I cannot verify holds me back: the captured pages give different figures for PHP support, naming versions 5.2 to 7.4 on one page while promising "the latest PHP" on another, and the 99.9% uptime guarantee carries no published service credit, with the terms saying any applicable guarantee is defined in other documents. I found no public information on HTTP/3, a PHP end-of-life policy, guaranteed rather than shared resources, or platform redundancy beyond a line about replicated data in the data processing addendum. 1 4 5 8 11

Report an error

The Freelance App Developer

The numbers are there — AMD EPYC, NVMe, a 1 Gbps link, and per-plan CPU cores, RAM, inodes and PHP workers — plus HTTP/2, OPcache, a built-in CDN with Object Cache, and a status page showing ninety days of uptime against a 99.9% guarantee. But nothing documents guaranteed rather than shared resources, an uptime SLA with a service credit, or a PHP end-of-life policy, and the captured pages give different figures for how current PHP is: one documents switching between versions 5.2 to 7.4 while another promises the latest PHP updates — for a Laravel shop that distinction decides deployments. 1 3 4 5 11 14

Report an error

The Data Protection Officer

LiteSpeed servers on AMD EPYC processors with NVMe storage, HTTP/2, OPcache, an object cache and a global in-house CDN are documented, and resources are stated per tariff down to CPU cores, RAM, inodes and PHP workers. A 99.9% uptime target and a public status page with a ninety-day uptime history and incident notices exist, though the terms place the guarantee's specifics in other documents, and we found no public information on a service credit, HTTP/3 or platform failover. The pages describe a PHP selector from versions 5.2 to 7.4 alongside a promise of the latest PHP, with no end-of-life policy published. 1 4 5 8 11 14

Report an error

The Skeptic

Hardware and resources are named in numbers — AMD EPYC, NVMe storage, a 1 Gbps line, CPU cores, RAM, inodes and PHP workers per tariff — plus HTTP/2, LiteSpeed with OPcache and an object cache, a CDN, and a status page with 90 days of uptime history. But the 99.9% uptime claim carries no documented service credit, the terms push the applicable uptime guarantee off to other documents "if any", and we found no public information on HTTP/3, an end-of-life policy for PHP versions, or resources guaranteed rather than shared. 1 3 4 5 8 11 14

Report an error

The Agency Lead

hPanel plus one-click WordPress install, automatic core, plugin and theme updates, staging, one-click cloning, SSH, WP-CLI, Git, cron, SFTP account management and a public API cover nearly everything my fifteen people touch daily, and the agency layer — one multi-site dashboard, access sharing per site, unlimited collaborators and an unbranded client dashboard — is the right shape for my shop. The captured pages give different figures for the maximum client sites on one agency plan, up to 300 on one page and up to 200 on another. We found no public information on handing a project with its billing to the client, on automatic-update rollback, or on the API's coverage of sites, databases, domains and backups, and the terms require written consent before reselling services. 3 6 8 11 12

Report an error

The Small-Business Owner

hPanel with over one hundred one-click installs, managed WordPress with automatic core, plugin and theme updates, staging, one-click cloning, cron jobs and malware scanning is exactly the hand-holding I want without ever learning what PHP is. Should my nephew's successor need more, there are SSH, WP-CLI, Git, an access manager for developers, APIs and CLI tools, and an agency view with client accounts and an unbranded dashboard. I stay below the top because Composer, a versioned interface covering sites, databases, domains and backups, and a documented handover of client projects are not described. 1 3 6 11

Report an error

The Shop Operator

The daily toolkit is genuinely complete: hPanel with over 100 one-click app installations, SSH and WP-CLI, Git deployment, a MySQL manager, staging, one-click cloning, cron jobs and a PHP version per site, plus an access manager, access sharing per site and an agency view with client accounts, up to 200 client sites on one plan and an unbranded client dashboard. A public API, CLI tools and SDKs are named, but I found no public information on their scope across sites, databases, domains and backups, on Composer support, on update rollback or on transferring ownership of a project to a client. 1 3 6 11 13

Report an error

The Freelance App Developer

hPanel with over a hundred one-click installs, SSH, WP-CLI, Git deployment, cron jobs, staging with one-click cloning, per-site PHP versions, a MySQL manager, a public API with CLI tools and SDKs, and an agency view with client access management and an unbranded dashboard covers most of my daily workflow, and Laravel is named as a supported stack. What keeps it down for me: the documented SSH is a limited bash interface without root access, the pages give different information on which plans include SSH, and I found no public information on Composer, on update rollback, or on the scope of the API and CLI. 1 2 3 6 11 13

Report an error

The Data Protection Officer

The in-house hPanel carries more than one hundred one-click installs, SSH with WP-CLI, Git deployment, cron jobs, a MySQL manager, staging with one-click cloning, per-site access sharing and a Docker manager — a workable daily toolkit. Agency tooling is real: a multi-site dashboard, up to 300 client sites on one plan, an unbranded client dashboard and an agency directory. We found no public information on Composer, infrastructure-as-code, single sign-on or transferring a project's ownership to the client. 1 3 6 11 13 14

Report an error

The Skeptic

Day-to-day work is well covered in facts: hPanel with over 100 one-click installs, SSH and WP-CLI, SFTP account management, cron jobs, per-site PHP versions, staging with one-click cloning, Git deployment, an access manager for developers, and an agency dashboard with client access, up to 200-300 sites per plan and an unbranded client view. We found no public information on Composer, automatic updates with rollback, transfer of ownership to a client, or audit logs of panel changes — mailbox audit logs exist, panel ones are not shown. 1 2 3 6 11

Report an error

The Agency Lead

Free SSL with automatic renewal, a WAF, DDoS and brute-force protection, automatic malware removal, per-site isolation, an ISO 27001:2022 statement, penetration testing and a bug bounty give me real confidence in the walls around sixty client sites. Backups are documented as automatic weekly on every plan, daily on higher tiers with on-demand on Cloud Startup, files and databases backed up separately and downloadable in the panel — but retention is never stated, and we found no public information on point-in-time restore of a single file or database or on a second backup location. The terms also state the customer is solely responsible for backing up their own content, so I would keep my own copies regardless. 2 8 10 11 15

Report an error

The Small-Business Owner

Free SSL with automatic renewal, a web application firewall, DDoS protection, automatic malware removal, per-site isolation, penetration testing and a published ISO/IEC 27001:2022 certificate read well on paper. But the base plans back up only weekly, and I found no public information on how long backups are kept or whether a copy sits in a second location — while the terms place the back-up responsibility squarely on me, the customer, even though the product pages describe automatic backups. For a firm whose livelihood sits in twelve mailboxes and one website, that uncertainty decides the score for me. 3 8 10 11 15

Report an error

The Shop Operator

The security half is strong: a WAF with custom firewall rules, DDoS protection, automatic malware removal, per-site isolation, two-factor login, ISO 27001, penetration testing and a bug bounty programme are all documented. The recovery half is where I hesitate, because getting yesterday's database back within the hour is my hard requirement: base PHP plans back up weekly, retention is not stated, and I found no public information on a second backup location or point-in-time restore of single files, databases or tables. The captured pages also give different positions on backup responsibility, with the plan pages including automatic weekly or daily backups while the terms state the customer is solely responsible for backing up their data and that Hostinger does not warrant any backup. 2 4 8 10 11 15

Report an error

The Freelance App Developer

Free domain-validated SSL with automatic renewal, a web application firewall, DDoS protection, automatic malware removal, per-site isolation, an ISO 27001-based security policy, penetration testing and a listed bug-bounty programme are all documented, and managed tariffs get vendor-side patching — the October 2026 PHP vulnerability was mitigated for Web, Agency and cPanel customers with no action needed. The backup side is thinner next to that: weekly backups, daily on higher plans, downloadable and restorable in the panel, but no stated retention, no documented second-location copies and no point-in-time single-file restore, while the terms put backup responsibility entirely on the customer. 2 3 5 8 9 10 11 15

Report an error

The Data Protection Officer

Isolation per site, a web application firewall, DDoS protection, automatic malware removal, two-factor login, encryption at rest, penetration testing and an ISO 27001:2022 certification are all documented. Recovery is where I would ask more before putting patient or client data here: backup frequency varies by plan, retention and a second storage location are not stated, and the terms state the customer is "solely responsible for backing up your data in all circumstances" while Hostinger "does not warrant that it backs-up any Account or Customer Content". The marketing pages advertise weekly or daily backups while the terms put the risk of loss on the customer, and no restore times, recovery objectives or point-in-time restore of single files or tables are published. 2 3 8 9 10 11

Report an error

The Skeptic

Free SSL with automatic renewal, a WAF, DDoS protection, malware scanning with automatic removal, website isolation, and weekly (daily on higher plans) backups downloadable in the panel are documented, alongside penetration testing and a responsible-disclosure programme. The backup story is where I dig in: no retention period or second-location copy is stated anywhere, and the captured pages give different positions — the plan pages promise automatic backups with restore, while the terms state that Hostinger "does not warrant that it backs-up any Account or Customer Content" and the customer is solely responsible; the security policy references ISO/IEC 27001:2022 but no certification with its scope is shown. 2 3 8 9 11 13 15

Report an error

The Agency Lead

Migration in is documented unusually honestly: free and unlimited, claimed without downtime, with scope stated — 85% of moves done in under five minutes, WordPress typically under two hours, cPanel-based sites more than twenty hours, multisite supported, builder-built sites excluded, DNS propagation downtime possible. Tariff limits are real numbers (cores, RAM, storage, inodes, databases, PHP workers), upgrades run without downtime, extra storage can be added anytime, and data is deleted thirty days after termination. We found no public information on domain transfer out, plan downgrades or the contents of the fair use policy, and every plan I can see is a 24- or 48-month prepaid commitment, which is a long bet across sixty clients. 4 9 13 18

Report an error

The Small-Business Owner

Moving in costs nothing — free unlimited migrations with the scope spelled out, a WordPress site usually moved in under two hours and 85 % inside five minutes — and plan upgrades run without downtime, with the main limits per plan (sites, storage, databases, inodes, mailboxes) published in a comparison. Cancellation is stated as possible anytime, and the data processing agreement says data is deleted thirty days after termination. Downgrades, monthly terms and a documented path from shared hosting to a server with the same vendor are not described, which keeps it off the top. 4 9 18 19

Report an error

The Shop Operator

Growing is documented the way I need it: plan upgrades without downtime, extra storage at any time, a free 24-hour boost for traffic spikes, and the main limits published per tariff including CPU cores, RAM, storage, inodes and databases. Migration in is free and unlimited with the scope honestly stated — WordPress typically under two hours, cPanel-based shops over twenty hours, one request per site, website-builder shops excluded — and exit is covered too: export is my responsibility before termination, data is deleted 30 days after termination, and domain transfer with an EPP code is documented. I found no public information on tariff downgrades, a monthly term, or a domain transfer-out fee. 1 4 9 18 19

Report an error

The Freelance App Developer

Free unlimited migration with a stated scope — one request per site, up to five concurrent, WordPress typically under two hours, cPanel and Laravel sites around twenty — concrete per-plan limits including inodes, no-downtime plan upgrades with add-on storage, and deletion of customer data thirty days after termination give me a growth and exit path I can plan against. I found no public information on downgrades, on monthly terms as an alternative to the prepaid 24- and 48-month terms, or on exporting mailboxes on the way out, and the pages give different positions on migration downtime — one says the site stays live throughout, another notes possible downtime during DNS propagation. 1 3 4 9 13 18

Report an error

The Data Protection Officer

Growth and exit are documented better than at most hosts: a free unlimited migration service with its scope, timing, limits and requirements spelled out, plan upgrades without downtime, stated per-plan limits including inodes and PHP workers, downloadable file and database backups, and deletion of customer data thirty days after the termination date stated in the data processing addendum. Domain transfer with an EPP code and a published domain transfer agreement are documented as well. We found no public information on monthly terms as an alternative to the prepaid multi-year plans, or on exporting mailboxes on the way out. 4 9 10 12 18 19

Report an error

The Skeptic

Migration in is unusually well documented — free and unlimited, WordPress typically under two hours, cPanel sites over twenty, five concurrent requests, credentials required, site kept running — and the real limits per tariff (inodes, RAM, CPU, databases, workers) are published next to the "unlimited" fair-use wording, with upgrade without downtime and deletion of data 30 days after termination stated. But we found no public information on plan downgrades, the fee and process to transfer a domain out, or what the Fair Usage Policy actually permits; export before termination is stated to be the customer's responsibility. 1 4 9 13 18 19

Report an error

The Agency Lead

24/7 support in 30+ languages, agents responding in under thirty seconds, priority expert support on plans, automatic malware removal when a client site is hit, and a rich tutorial and Academy library — plus ICANN-accredited domains, DNS in hPanel, webmail, catch-all, aliases, stated mailbox sizes of 5 GB, 20 GB or 50 GB and a spam filter that stops 99.9% of malicious emails. That is most of what my team needs day to day. We found no public information on phone or ticket support, on a contractual response-time guarantee or on a named contact for business customers, and the agency programme's concrete benefits are thin beyond the Pro plan and a directory listing. 3 6 18 20

Report an error

The Small-Business Owner

Help is there around the clock via AI chat with escalation to a human agent who answers in under thirty seconds, backed by tutorials and an academy, and the same account sells domains with DNS management plus mailboxes with tiered storage, aliases, forwarding rules and a spam filter that stops 99.9 % of malicious mail. For a German-speaking tradesman the sore point is that I found no public information on telephone support, and the languages are given only as thirty-plus without naming German. The agency programme and priority expert support are documented, but no response-time guarantee beyond the chat figure. 1 3 6 14 19 20

Report an error

The Shop Operator

Support is chat-based and around the clock in over 30 languages, with a stated agent response under 30 seconds and priority expert support on the plans, but I found no public information on phone or ticket channels or a contractually bound response time, which matters when the shop is down on a Friday night. Everything around it is documented well: an ICANN-accredited registrar with DNS management in hPanel, a free domain for the first year, tutorials and an academy, an agency directory, and mail plans with stated mailbox sizes of 5, 20 or 50 GB, aliases, forwarding rules, webmail and a spam filter stated to stop 99.9% of malicious emails. 1 3 6 19 20

Report an error

The Freelance App Developer

Chat around the clock with a stated agent response under thirty seconds, support in over thirty languages, a tutorials and Academy knowledge base, ICANN-accredited domain registration with DNS management in hPanel, and paid mail tiers with stated mailbox sizes, aliases, forwarding rules and spam filtering stop 99.9% of malicious emails cover the day-to-day. I found no public information on phone or ticket channels or on a contractually bound response-time guarantee, which is what I would want before pointing a client's broken production site at them at two in the morning. 1 3 6 18 19 20

Report an error

The Data Protection Officer

Support runs around the clock by chat with human agents behind an AI chatbot, in thirty-plus languages, with tutorials and an academy alongside, and the hosting plans include priority access to expert support. Domains and mail live in the same account: an ICANN-accredited registrar with DNS management in the panel, free WHOIS privacy, and mailbox plans with stated sizes, aliases, forwarding rules, webmail and spam filtering claimed at 99.9%. We found no public information on phone support or on response times stated per channel. 1 3 6 14 19 20

Report an error

The Skeptic

Support is documented as 24/7 in 30+ languages, marketed as expert priority support with agents responding in under 30 seconds, and the mail side is documented in hard numbers — mailbox sizes of 5 to 50 GB, aliases, forwarding rules, spam filtering stopping 99.9% of malicious mail, webmail — with domains bookable as an ICANN-accredited registrar and DNS managed in hPanel. The gap a buyer feels at 3 a.m.: the only documented channel is chat (AI plus human); we found no public information on phone or ticket channels, on response-time guarantees, or on a separate premium support tier. 1 3 6 14 18 19 20

Report an error

The Agency Lead

EU customers contract with Hostinger International Ltd. in Cyprus, data centres in France, Germany, Lithuania and the Netherlands are selectable at setup, a data processing agreement with EU Standard Contractual Clauses and Cyprus governing law is published, and the subprocessor list names AWS, Google Cloud, Cloudflare, MailChannels, Proofpoint, Anthropic Ireland, spectra tech and Vonage. The group is private, headquartered in Vilnius, founded in Kaunas and never publicly listed. Subprocessor locations are only implied by company names rather than stated, the ISO 27001 statement is not tied to the data centres, and the processing chain includes the United Kingdom and servers outside the EEA, so I cannot call it sovereign end to end. 6 7 8 9 10

Report an error

The Small-Business Owner

The European parts of the chain are named: data centres in France, Germany, Lithuania, the Netherlands and the United Kingdom with the location chosen at setup, a Cyprus contracting entity as the default for EU customers, a published data processing agreement with EU Standard Contractual Clauses, and a subprocessor list that includes EU entities alongside a Vilnius-headquartered, privately held company. The same list also routes services such as mail filtering through Cloudflare, Inc., MailChannels Corporation and Proofpoint, Inc., whose locations are not given, with the standard contractual clauses stated as the safeguard. The ISO 27001 certificate is stated for the information security management system rather than specifically for the data centres. 6 7 8 9 10

Report an error

The Shop Operator

The chain is largely European: the default contracting entity for EU customers is Hostinger International Ltd in Cyprus, with a Luxembourg entity and a UK entity available, the company is private, headquartered in Vilnius and founded in Kaunas, and EU data centres are named in France, Germany, Lithuania and the Netherlands, selectable at setup with Germany recommended. A data processing addendum with EU Standard Contractual Clauses under Cyprus law is published, and subprocessors are listed — though by name only, and several of the named entities are US corporations. I found no public information on where backups are stored, and the ISO 27001 certification is stated for the information security management system rather than for the data centres. 6 7 8 9 10

Report an error

The Freelance App Developer

For EU customers the contracting entity is Hostinger International Ltd in Cyprus, EU data centres are named by location — France, Germany, Lithuania, the Netherlands — a data processing agreement is published with a named subprocessor list, and transfers rely on the EU Standard Contractual Clauses under Cyprus law with the Cyprus supervisory authority named. But the subprocessor list carries names without stated locations, some servers are documented outside the EU in the US, Brazil, Singapore and Indonesia, and I found no public information on where backups are kept or on the reach of non-EU group companies, so I stop short of a top mark. 6 7 8 9

Report an error

The Data Protection Officer

EU customers contract with Hostinger International Ltd of Cyprus, an EU entity, can place sites in named EU data centres in France, Germany, Lithuania or the Netherlands, and the group is European-owned with headquarters in Vilnius; the published data processing addendum invokes the processor role, EU standard contractual clauses under Cyprus law and the Cyprus supervisory authority, audit rights, a ten-day objection right with penalty-free termination, and a named subprocessor list including Amazon Web Services EMEA, Google Cloud EMEA, Cloudflare, MailChannels, Proofpoint, Anthropic Ireland, spectra tech and Vonage. What no page answered for me: where the backups are kept, and whether the Singapore contracting entity or the Indonesia offices can reach EU customer data — the privacy policy itself notes servers in the US, Brazil, Singapore and Indonesia with standard contractual clauses for transfers. The ISO 27001 statement covers the information security management system, not the data centre facilities, so certification scope for the locations a practice would choose is not evidenced. 6 7 8 9 10

Report an error

The Skeptic

EU customers contract with the Cyprus entity by default, EU data centres are named by country (France, Germany, Lithuania, the Netherlands) and selectable at setup, and a published DPA carries EU standard contractual clauses, an audit right and a named subprocessor list including AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint and Anthropic Ireland; the group is Lithuania-founded, Vilnius-headquartered and privately held. What I cannot verify end to end: we found no public information on where backups are stored, subprocessor locations are implied by entity names rather than stated, and the jurisdiction of the roughly 30% private-equity stake is not documented. 1 6 7 8 9

Report an error

The Agency Lead

About as computable as this market gets: every plan I checked shows the introductory rate, the exact upfront total and the renewal side by side — 'Today you pay $167.52 for 48 months. Renews at $16.99/mo for the same term' — the prepaid model is explained in plain words, 'Prices are listed without VAT' is stated, mail and domain renewals are priced, and a 30-day money-back guarantee applies. As an agency I wince at the jumps — the Unlimited plan is $3.49 per month now and $16.99 on renewal — but it is printed where I can find it. We found no public information on setup fees, restore costs or extra-storage pricing, and the fair use policy behind the 'unlimited' features is only referenced, never shown. 4 18 19 20

Report an error

The Small-Business Owner

Every plan I looked at shows the promotional price, the total paid today for the term and the renewal price side by side — Premium today $119.52 for 48 months, renewing at $10.99/mo — with the prepaid model explained, VAT stated as excluded, a thirty-day money-back guarantee and free migration, so I can see in advance what my invoice will look like in year two, three and four. Domain and mailbox add-ons carry first-year and renewal prices too, the email domain at $5.99 for the first year and $35.99/yr on renewal. What keeps me from full marks: I found no public price for extra storage or a restore, and the fair usage policy behind the 'unlimited' features is only referenced on these pages, not spelled out. 2 4 13 19 20

Report an error

The Shop Operator

Nearly everything I need to compute the real cost is public: first-term and renewal prices side by side (Unlimited at $3.49/mo renews at $16.99/mo for the same 48-month term, KVM 2 at $8.79/mo renews at $14.99/mo), the prepaid model explained, VAT stated as excluded, and the inclusions listed per plan — free domain for a year, SSL, backups, CDN and quantified AI credits. The gaps keep it from full computability: add-ons such as extra storage and restores are not priced, unlimited features are only referenced to a fair usage policy without its terms, and the captured US and German pages give different renewal figures for the same plans. 2 4 14 18 19

Report an error

The Freelance App Developer

Every plan I checked shows the list price, the introductory rate, the exact upfront total for the term and the renewal price side by side — Premium at $12.19 reduced to $2.49 a month, $119.52 today for 48 months, renewing at $10.99/mo — with VAT treatment stated as "Prices are listed without VAT", cancellation stated as anytime with a 30-day money-back guarantee, and mail plans, domain renewals and even the $0.20 ICANN fee priced. I found no public information on setup fees, restore fees or the price of add-on storage, overage is covered only by unlimited features subject to a Fair Usage Policy, and the captured pages give different renewal figures in dollars and euros for the same plans. 2 4 13 18 19 20

Report an error

The Data Protection Officer

Every tariff we read shows the introductory rate, the total payable today, the term in months and the renewal price side by side, with plans stated as paid upfront, VAT stated as excluded, migration free, domain privacy free and a thirty-day money-back guarantee. Add-ons such as the mailbox plans, the email domain first year and renewal, and the ICANN fee are priced publicly. We found no public information on setup fees, restore fees or the price of extra storage, and the captured American and German pages give different renewal figures for the same plans, so a buyer should compute from their own region's page. 2 4 14 18 19 20

Report an error

The Skeptic

This is the rare host that shows the second-year price: first-term and renewal sit side by side — Premium at "$ 2.49 /mo" on "$119.52 for 48 months" renewing at "$10.99/mo", KVM 1 at "$ 6.49 /mo" renewing at "$11.99/mo" — with prepaid billing explained, a 30-day money-back guarantee, and "Prices are listed without VAT" stated plainly. The gaps: we found no public information on setup fees, and extra storage, restores and fair-use overage handling are unpriced; the captured US and German pages also give different renewal figures for the same Premium plan ("$10.99/mo" versus "9,99 €/Mon."). 2 4 10 13 14 18 19 20

Report an error