Web Hosting
IONOS Webhosting
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by IONOS SE · www.ionos.de
Compare with ALL-INKL.COM Webhosting → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
IONOS Webhosting at a glance
- Vendor
- IONOS SE
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Starting price
- “Ab 1 € /Monat” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates IONOS Webhosting 3/5, the mean of 6 judges. IONOS Webhosting scores best where it publishes most. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
IONOS Webhosting scores best where it publishes most. Pricing transparency is a flat 7: every tariff shows the introductory price, its duration and the renewal price side by side — Standard at 3 €/Monat für 6 Monate, danach 6 €/Monat, plus a 10 € setup fee, VAT included — and even PHP Extended Support is priced per version. Support and service and sovereignty follow at 6-7, resting on around-the-clock phone, chat and email, a personal advisor, and an identifiable German contracting entity (IONOS SE, HRB 24498) with German data centres and a published data processing agreement. Security and backups and scaling and portability are weakest, both 4-6: backups are called automatic with no public information on frequency, retention or restore, and neither migration in nor export, domain transfer or cancellation terms out are documented. The splits sit there: on security, the small-business owner's 6 credits the protective layer while the 4s mark the undocumented recovery; on scaling, the shop operator's 6 rewards click-based scaling and the ladder to cloud and dedicated servers where the 4s see a thin exit.
Speaks for it
- Pricing transparency scores 7, with introductory and renewal prices side by side on every tariff, a 10 € setup fee, VAT included, and PHP Extended Support priced per version from 7,81 € to 23,58 € a month
- Support runs around the clock by phone, chat and email with a published number (0721 / 170 5522) and a personal advisor assigned after ordering
- The contracting entity is identifiable — IONOS SE, Amtsgericht Montabaur HRB 24498 — with web space in German data centres, geo-redundant infrastructure and a published data processing agreement
- Tariff resources are published in numbers per plan (RAM, vCPU, NVMe storage, databases) beside a public status page listing monitored services and incidents
- Developer access is documented — SSH, SFTP and WP-CLI, a freely selectable PHP version, and GitHub deployment with per-branch staging preview URLs
Held against it
- Backups are described only as automatic, with no public information on frequency, retention, self-service restore or the price of a restore
- No public information on a migration service in, export of files, databases and mail, domain transfer out, or the cancellation period, with the minimum term only hinted at („teils abhängig von Mindestvertragslaufzeiten")
- BSI and ISO certification claims appear without a named standard or scope, and no public information exists on data centre locations or a subprocessor list for the hosting chain
- No public information on server-side caching, Redis, a CDN or HTTP/3 on the shared tariffs, or on a service credit behind the 99.99 % uptime figure
- The captured pages give different figures for the hosting plans and different statements on third-country transfers, one saying visitor data is never passed to third countries, the privacy policy reserving transfers outside the EU and EEA with safeguards
Best for
- You want a German-contracted host with fully visible pricing before you buy — every tariff shows introductory price, duration, renewal price and setup fee, and pricing transparency is the top score at 7
- You run WordPress sites with light developer work — SSH, WP-CLI, selectable PHP versions and GitHub deployment with preview URLs are documented, with around-the-clock phone support and a personal advisor
- You expect to grow past shared hosting — vServer, cloud and dedicated servers exist at the same vendor, the cloud line on per-minute billing with no minimum term
Avoid if
- Your recovery plan needs documented backup frequency, retention and a self-service restore — the pages stop at automatic backups, and security and backups is among the lowest-scoring criteria at 4-6
- You must compute the full contract cost or know exit terms before signing — ask the vendor: the public pages we read do not show it
- Your compliance review needs a subprocessor list with locations or named data centre cities — we found no public information on either, and the privacy policy reserves transfers outside the EU and EEA with appropriate safeguards
- You are an agency needing team roles per project, cloning or a client-transfer view — the documented tooling covers single-site daily work, and management and developer tools scored 5-6
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 3 of 5 |
| Control panel, WordPress & developer tooling | 3 of 5 |
| Security, backups & recovery | 2 of 5 |
| Scaling, migration & exit | 2 of 5 |
| Support, domains & email | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Performance, uptime & infrastructure
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
Every tariff publishes its RAM, vCPU, NVMe storage and database count, HTTP/2 is documented, and a 99.99 percent uptime figure is called guaranteed, backed by geo-redundant replication across data centres and a public status page with an incident feed. We found no public information on a CDN, Redis or page caching on the shared tariffs, or on a service credit if the uptime figure is missed. 4 1 2 8
The Small-Business Owner
Real numbers per package are there — 6 to 20 GB RAM, 1 vCPU, 100 to 500 GB NVMe storage — with HTTP/2, a stated 99.99 % availability figure, a public status page, and replication of my data across several data centres. Before I lean on it fully: I found no public information on server-side caching, a CDN, or any compensation if the uptime promise is missed, and current PHP updates on the platforms are documented but old versions only as a paid extended support. 1 2 4 5 8 11
The Shop Operator
I can read the tariff specs before buying: the plans state NVMe storage from 100 to 500 GB, RAM from 6 to 20 GB, one vCPU and the number of databases, plus HTTP/2, free SSL, a 99.99 % uptime figure described as guaranteed, geo-redundant replicated storage, Tier IV data centres and a public status page that lists incidents. What I could not find for my Black Friday planning is any word of a page cache, Redis or an object cache, HTTP/3 or a CDN on the web hosting tariffs, or an uptime SLA that pays a service credit when the shop is down. PHP stays patchable through a paid extended support programme, which softens that gap a little. 1 2 4 5 8
The Freelance App Developer
Every tariff lists vCPU, RAM and NVMe storage in plain numbers, the PHP version is selectable with an extended-support policy that is actually priced, HTTP/2 and a 99,99 % uptime figure are published, and there is a public status page showing incident entries. I found no public information on server-side caching like Redis or a page cache, on a CDN or HTTP/3 for the shared tariffs, and the uptime guarantee comes without a documented service credit, with the 1 vCPU being shared rather than dedicated. 1 2 4 5 8 11
The Data Protection Officer
Every tariff states its NVMe storage, RAM, vCPU and database count, HTTP/2 is documented, and a published PHP policy lists selectable versions from PHP 4 to 8.1 with paid extended support after community end-of-life. A 99,99 % uptime figure is given as guaranteed on geo-redundant, replicated infrastructure and a public status page lists monitored services with at least one investigated incident; we found no public information on HTTP/3, a CDN on the shared tariffs, Redis, or an uptime SLA with a service credit. 1 2 4 5 8 11
The Skeptic
Resources are published per tariff (RAM, vCPU, NVMe storage, database counts) together with HTTP/2, a 99,99 % availability figure, georedundant replication across data centres and a public status page showing incidents. The 99,99 % is called guaranteed, but we found no public information on a service credit behind it, and no public information on server-side caching such as OPcache or Redis, HTTP/3, or a CDN on the shared hosting tariffs. 1 2 4 5 8 11
Control panel, WordPress & developer tooling
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
One-click WordPress with automatic security updates, SSH, SFTP and WP-CLI access and a freely selectable PHP version cover the daily basics, and Deploy Now adds GitHub deployments with a preview URL per feature branch managed from one dashboard. For an agency like mine the story stops there: we found no public information on team roles per project, cloning or push-to-live for WordPress sites, or a platform API covering databases and backups. 5 2 11 8
The Small-Business Owner
WordPress installs with one click, SSH, SFTP and WP-CLI come with every package, the PHP version and update behaviour are selectable with.htaccess access, and GitHub deployment with staging and preview URLs exists through Deploy Now. For daily running I found no public information on cron jobs, a database web interface, log files or staff accounts with separate rights, so day-to-day control of the site stays with whoever built it. 2 5 7 11
The Shop Operator
Day-to-day running is covered: one-click WordPress and hosting apps, SSH, SFTP and WP-CLI access, a freely selectable PHP version,.htaccess access and a domain API, and for the developers the Deploy Now line documents GitHub deployment with framework auto-detection, editable YAML workflows, configuration files and staging preview URLs per branch. We found no public information on cron jobs, a database web admin, team roles, log access or cloning on the hosting tariffs, so it reads as a solid working panel rather than an agency platform. 1 2 5 11
The Freelance App Developer
SSH, SFTP and WP-CLI are documented, the PHP version is freely selectable with.htaccess access and a domain API, GitHub deployment with automatic framework detection and per-branch preview URLs exists, and the Cloud Panel API is described as fully documented. I found no public information on cron jobs, Composer, a database web admin, team roles or log access, which is exactly the tooling I need for everyday app maintenance. 1 2 3 4 5 11
The Data Protection Officer
A one-click WordPress installer, SSH, SFTP and WP-CLI, a freely selectable and reversible PHP version, automatic security updates in Managed WordPress, GitHub-based deployment with per-branch staging preview URLs and editable workflow files, and a documented API for the cloud panel cover the daily work on a site. For cron jobs, a web interface for databases, team roles, Composer and an agency or client-transfer view we found no public information. 1 2 3 5 8 11
The Skeptic
SSH, SFTP and WP-CLI access, a selectable PHP version with.htaccess and domain API access, one-click WordPress installation, managed WordPress with automatic security updates, and GitHub-based deployment with staging preview URLs and editable workflow files are all documented. We found no public information on cron jobs, a database web admin, log access, team roles, or an agency client and project view. 1 2 3 5 8 11
Security, backups & recovery
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
The protective side is well documented — WAF and Webshield on all hosted sites, a DDoS shield, malware scans with automatic removal on higher tariffs, a free wildcard SSL certificate and a BSI certification claim. The recovery side is thin: backups are called automatic, but we found no public information on frequency, retention or a self-service restore, which is exactly what my team needs at 2 a.m. 7 12 1 2
The Small-Business Owner
Free wildcard SSL, DDoS protection, malware scans with automatic removal on the larger packages, a web application firewall on every hosted site from the first minute, and WordPress security updates applied automatically by the host give me real confidence. But the pages only say "automatische Backups" — how often they run, how long they are kept and how a restore happens is not visible in the pages I read, and that restore path is exactly what my twelve mailboxes depend on. 1 2 7 8 12
The Shop Operator
The protection layer is stated plainly: a WAF and Webshield cover every hosted site from the first minute, DDoS protection, vulnerability analysis and malware scans are included, the higher tariffs add automatic malware removal and a Malware Scanner Pro with automatic repair, and WordPress and PHP security updates are applied automatically on the managed platforms. But for my core question — can I get yesterday's database back within the hour — the pages only say automatic backups are included; we found no public information on backup frequency, retention, self-service restore, point-in-time recovery, two-factor login to the panel or per-site isolation. 1 2 7 8
The Freelance App Developer
Free wildcard SSL, a WAF with Webshield on all hosted sites, DDoS protection, malware scans with automatic removal and automatic backups are all documented, and the vendor applies PHP security updates on its own platforms. Backup frequency, retention and customer self-service restore are not described, and I found no public information on two-factor login to the panel or isolation between customers, so recovery is the weak half of the story. 1 2 7 8 12
The Data Protection Officer
A free wildcard SSL certificate, the WAF and Webshield security systems on all hosted sites, a DDoS shield, malware scans with automatic removal, geo-redundant storage and automatic security updates are documented, and BSI certification and Tier IV data centres are claimed. Backup frequency and retention, customer-initiated restore, isolation between customers and two-factor login are points we found no public information on — from a data protection standpoint the recovery side of the record is thin. 1 2 3 7 8 12
The Skeptic
Free wildcard SSL, DDoS protection, a web application firewall on all hosted sites, malware scans with automatic removal and vendor-applied PHP security updates are documented, and the status page shows a real incident handled as a precaution. Backups are described only as automatic: we found no public information on frequency, retention, customer self-service restore, off-site backup copies or two-factor login to the panel — the details that decide whether recovery costs extra. 1 2 4 7 8 12
Scaling, migration & exit
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
Limits per tariff are published (storage, RAM, databases, mailboxes), scaling by click without a tariff change is advertised, and there is a documented path up to vServer, cloud and dedicated servers at the same vendor with per-minute cloud billing and no minimum term. Entry and exit are the blind spots: we found no public information on a migration service in, export of files and databases, domain transfer out, or the cancellation period behind the promotional minimum terms. 4 1 3
The Small-Business Owner
Each package states storage, RAM, databases and mailboxes, the homepage promises scaling by click without a tariff change, and vServers, cloud and dedicated servers exist in the same house if the firm grows. But I found no public information on a migration service in, transferring a domain away, or the cancellation period — only a note that offers partly depend on minimum terms; the 30-day money-back guarantee is the one exit term I can see. 1 3 4 5
The Shop Operator
This is the one place the vendor speaks my language: real-time scaling by click, flexibly reversible and without a tariff change, plus a documented path from shared hosting up to vServer, cloud and dedicated servers at the same vendor, with the cloud line billed per minute and no minimum term. The limits per tariff are stated openly — storage, RAM, vCPU, databases, mailboxes — and there is a 30-day money-back guarantee. We found no public information on a migration service for bringing an existing shop in, domain transfer out, full export including mail, or deletion of data after the contract ends. 1 3 4
The Freelance App Developer
Resources scale in real time by click without a tariff change, every tariff's limits are stated in numbers, and there is a documented path from shared hosting to vServer, cloud and dedicated servers with root access on enterprise hardware. I found no public information on a migration service in, on exporting files and databases with standard tools, on domain transfer out or on the cancellation period, which leaves the exit side thin. 1 3 4 5
The Data Protection Officer
Storage, RAM, databases and mailboxes are stated numerically per tariff, real-time scaling without a tariff change is offered, and vServer, cloud and dedicated servers at the same vendor give a growth path, with cloud servers on per-minute billing and no minimum term. We found no public information on a migration service, export of files, databases and mail, domain transfer out, the cancellation period, or deletion of customer data after the contract ends — the last is the first thing I look for in an exit. 1 3 4 5
The Skeptic
The limits per tariff are published in numbers (storage, RAM, databases, mailboxes) and real-time scaling without a tariff change is claimed, with a product ladder up to cloud and dedicated servers at per-minute billing and no minimum term. The exit side is undocumented: we found no public information on a migration service in, export of files, databases and mail, domain transfer out, the cancellation period, or deletion of data after the contract ends. 1 3 4 5
Support, domains & email
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
Support runs around the clock by phone, chat and email with a personal advisor assigned after ordering, a broad German help centre, and domains plus mailboxes (including Hosted Exchange and Microsoft 365) in the same account. Response times, mailbox sizes and an agency or partner programme with stated benefits are not documented — a partner portal appears only as a service name on the status page. 12 1 3 7 8
The Small-Business Owner
Around-the-clock support by phone, chat and email with a real German number (0721 / 170 5522), a personal advisor who knows me after ordering, a broad help centre, and domains and mailboxes in the same account with Exchange and Microsoft 365 as options — that is what a plumbing firm needs when the mail stops. Missing for the top marks: response times are not stated, and mailbox sizes, aliases and spam filtering are not described on the pages I read. 1 2 3 7 12
The Shop Operator
Support is around the clock by phone (0721 / 170 5522), chat and email, described as an award-winning expert team, with a personal advisor assigned after the order and a broad German help centre plus a free digital guide. Domains and mailboxes come in the same account, with ad-free mailboxes and hosted Exchange or Microsoft 365 as options. We found no public information on response times per channel, help with hacked sites, partner programme benefits, or mailbox sizes, aliases and spam filtering. 1 3 7 12
The Freelance App Developer
Phone, chat and email expert support is available around the clock with a published number, a personal advisor is assigned after ordering, the help centre covers hosting, WordPress, server and security topics, and domains plus mailboxes come in the same account with a free domain and ad-free mailboxes. Response times are not stated, and I found no public information on mailbox sizes, webmail or spam filtering, or on the benefits of the partner programme. 1 3 4 7 12
The Data Protection Officer
Support is available around the clock by phone, chat and email with a published number, described as an award-winning expert team, and a personal advisor is assigned after ordering; the help centre, the status page, included domains and mailboxes, and Hosted Exchange or Microsoft 365 options are documented. Help with compromised sites appears through the malware scans with automatic removal; we found no public information on response times per channel, mailbox sizes, webmail with spam filtering, or a partner programme's stated benefits. 1 2 7 12 13
The Skeptic
Support runs around the clock by phone, chat and email with a published number and an award-claiming expert team, a personal advisor is available after ordering, and a free domain plus mailboxes with Exchange and Microsoft 365 options come in the same account alongside an extensive help centre. We found no public information on response times per channel, DNS management, webmail with spam filtering, mailbox sizes, or the benefits of the partner programme. 1 2 3 4 7 12
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
The contracting entity is IONOS SE in Montabaur with a German commercial register number, webhosting is offered with web space in German data centres, a data processing agreement is published, and the pages state visitor data is never passed to third parties outside the EU. The chain is not fully evidenced: data centres are not named by location, no subprocessor list with locations is published, and the privacy policy allows transfers outside the EU with safeguards. 9 3 10 4
The Small-Business Owner
IONOS SE is registered at the Montabaur court (HRB 24498) and listed in Frankfurt, the pages state German data centres with data replicated across European locations, a published data processing agreement, and that visitor data of hosted sites is never passed on or moved to third countries. Certifications such as BSI are claimed without scope, the data centre cities are not named, and the privacy policy allows personal data to be transferred outside the EU with safeguards — reassuring, but the hosting chain is not traceable end to end. 1 2 3 4 9 10
The Shop Operator
The chain I can verify is European: IONOS SE with register entry Amtsgericht Montabaur HRB 24498, listed in Frankfurt, web servers and webspace in Germany, geo-redundant Tier IV data centres, a published data processing agreement, 100 % DSGVO-conformity and references that federal and state bodies are customers, with a BSI certification claimed. The certifications are named without their scope, and we found no public information on a full list of hosting-chain subprocessors with their locations — only marketing audience tools (Meta, LinkedIn, TikTok, Reddit, Google) and the SSL partner Sectigo are named, and the privacy policy allows transfers outside the EU with safeguards. Good enough for my German customer data on paper, but I cannot audit the whole chain from these pages. 1 2 3 9 10
The Freelance App Developer
The contracting entity is IONOS SE in Montabaur with a German commercial register entry and VAT ID, the hosting pages state German data centres for webserver and webspace, a data processing agreement is published, and BSI and ISO certifications are claimed. The captured pages list no subprocessors for the hosting chain, the certification scope is not published, and the privacy policy states that transfers outside the EU can occur with appropriate safeguards. 1 2 3 4 9 10
The Data Protection Officer
IONOS SE is entered at Amtsgericht Montabaur under HRB 24498 with a Montabaur address and is named as controller, German data centres, geo-redundant European infrastructure and a published data processing agreement are stated, and BSI certification and Tier IV facilities are claimed. The captured pages give different statements on third-country transfers — one says visitor data is never passed to third parties or third countries, the privacy policy reserves transfers outside the EU and EEA with appropriate safeguards — and we found no public information on data centres named by location, a subprocessor list with locations, certification scope, or which group company can reach the data. 1 2 3 4 9 10
The Skeptic
The contracting entity is IONOS SE of Montabaur with commercial register and VAT numbers, hosting runs in German data centres with georedundancy, and a data processing agreement is published, with BSI and ISO certification claims for Tier IV infrastructure. However, the certifications carry no named standard or scope, the data centres carry no locations, no subprocessor list with their locations exists, and the privacy policy itself states that personal data can be transferred outside the EU with appropriate safeguards. 1 2 3 4 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
Introductory and renewal prices sit side by side on every tariff with the ten-euro setup fee and VAT-inclusive pricing, and even the PHP extended support add-on is priced per version age. Two gaps keep me from computing a three-year cost: the minimum contract term behind the promos is only referenced as sometimes applying, and restores or extra backups carry no published price; the captured pages also give different plan names and figures for the entry and mid-range tariffs. 4 5 11 12
The Small-Business Owner
Every package shows the first-term and renewal price side by side — for example 3 €/month for 6 months, then 6 €/month, plus a 10 € setup fee — prices include VAT, and even the extended support for old PHP versions is priced per version down to the cent. Two things stop me computing the full three-year cost: the captured pages give different plan names and figures for the hosting packages, the minimum term is only hinted at, and I found no public prices for a restore or extra backups. 1 4 5 12
The Shop Operator
This is refreshingly computable: every tariff shows the introductory price with its duration, the renewal price right beside it, the 10 € setup fee and 'Preise inkl. MwSt.' — Standard 3 €/Monat für 6 Monate, danach 6 €/Monat, up to Ultimate 14 €/Monat für 6 Monate, danach 28 €/Monat — and even the paid PHP extended support is priced per version from 7,81 € to 23,58 € a month. What keeps it short of full computability: the actual minimum contract term is only hinted at ('teils abhängig von Mindestvertragslaufzeiten'), and we found no public information on what a restore or extra backups cost or on the Jetpack Vault backup add-on after its free twelve months. 4 5 12
The Freelance App Developer
Every tariff shows the introductory price, its duration and the renewal price side by side, with a 10 € setup fee, VAT included, and even the PHP extended support add-on priced per version from 7,81 € a month for PHP 8.1 up to 23,58 € for the oldest versions. The minimum term behind the promotional offers is acknowledged but never stated as a number, and I found no public information on restore fees, migration fees or cancellation terms. 1 4 5 12
The Data Protection Officer
Every tariff shows the introductory and the renewal price side by side — for example Plus at „1 € /Monat für 12 Monate", „Danach 11 €/Monat", „Einrichtung 10 €" — and prices are stated inclusive of VAT, with the PHP Extended Support add-on priced per version group, for instance PHP 8.1 at „7,81 € / Monat", plus a 30-day money-back guarantee. The pages note that offers depend partly on minimum contract terms without stating their length, and we found no public information on cancellation terms or fees for restores or migration, so the full cost over three years is not computable from the public pages alone. 1 4 5 9 12
The Skeptic
Every tariff shows the introductory price with its duration and the renewal price side by side ("3 € /Monat für 6 Monate Danach 6 €/Monat Einrichtung 10 €"), a 10 € setup fee is stated, prices include VAT, and paid add-ons are priced, including PHP Extended Support per version from 7,81 €/Monat up to 23,58 €/Monat. What remains unverifiable is the commitment itself: offers are only "teils abhängig von Mindestvertragslaufzeiten" with no numeric minimum term, and no cancellation or data-return terms are published. 1 4 5 9 12
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about IONOS Webhosting
Is IONOS Webhosting European?
Yes. whats-best.ai classifies IONOS Webhosting as EU-Made.
Where does IONOS Webhosting store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does IONOS Webhosting have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to IONOS Webhosting?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: IONOS Webhosting alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 37 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (web hosting, with pricing) www.ionos.de Checked 1 Nov 2026 Details →
- 2 Features page (WordPress hosting) www.ionos.de Checked 1 Nov 2026 Details →
- 3 Features page (business hosting) www.ionos.de Checked 1 Nov 2026 Details →
- 4 Features page (hosting in Germany) www.ionos.de Checked 1 Nov 2026 Details →
- 5 Features page (PHP extended support) www.ionos.de Checked 1 Nov 2026 Details →
- 6 Security / trust page www.ionos.de Checked 1 Nov 2026 Details →
- 7 Help centre www.ionos.de Checked 1 Nov 2026 Details →
- 8 Status page www.ionos-status.de Checked 1 Nov 2026 Details →
- 9 Legal notice www.ionos.de Checked 1 Nov 2026 Details →
- 10 Privacy policy www.ionos.de Checked 1 Nov 2026 Details →
- 11 Control panel, WordPress & developer tooling — found from sitemap www.ionos.de Checked 1 Nov 2026 Details →
- 12 Security, backups & recovery — found from sitemap www.ionos.de Checked 1 Nov 2026 Details →
- 13 Security, backups & recovery — found from sitemap www.ionos.de Checked 1 Nov 2026 Details →
- 14 Self-hosting / on-premises installation docs — found from the homepage cloud.ionos.de Checked 1 Nov 2026 Details →