whats-best.ai
Search Sign in

Web Hosting

Kinsta

Rest of world Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Kinsta Inc. · kinsta.com

Compare with Raidboxes → Report an error on this page Is this your product? →

Link to this page

Kinsta: AI-assisted analysis on whats-best.ai Kinsta: AI-assisted analysis on whats-best.ai (dark)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

Kinsta at a glance

Vendor
Kinsta Inc.
Headquarters
Not stated on the vendor’s pages as of 1 Nov 2026
Data hosting
Not stated on the vendor’s pages as of 1 Nov 2026
Free plan
Not stated on the vendor’s pages as of 1 Nov 2026
Panel verdict
The AI panel rates Kinsta 3.5/5, the mean of 6 judges. Kinsta sells managed WordPress hosting on Google Cloud with customer-chosen data centre regions. how scores are made
As of
Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources

Kinsta alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The Data Protection Officer

Weighted verdict

External data protection officer for a group of medical practices and two law firms whose sites take appointment requests and contact forms. Reads the DPA, the subprocessor list and the certifications before anything else: where the servers and the backups are, which group company outside the EU can reach them, how customers are isolated from each other, and when data is deleted after the contract ends.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Data Protection Officer

Panel median The Data Protection Officer This judge’s scores over the panel median. Each label opens its reasoning below.
Scores per criterion, in stars out of 5
Criterion Panel median The Data Protection Officer
Performance, uptime & infrastructure 3.5 of 5 3.5 of 5
Control panel, WordPress & developer tooling 4 of 5 4 of 5
Security, backups & recovery 3.5 of 5 3.5 of 5
Scaling, migration & exit 3.5 of 5 4 of 5
Support, domains & email 3.5 of 5 3.5 of 5
European sovereignty 2.5 of 5 2 of 5
Pricing transparency 4 of 5 4 of 5

Performance, uptime & infrastructure

How this is scored

What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.

0 — Not a hosting product; websites or web apps cannot be run on it.

3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.

5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.

8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.

10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.

Report an error

The Data Protection Officer

The platform runs on customer-selected Google Cloud regions among 30 data centres with a CDN of more than 300 edge locations, HTTP/3, full-page caching, PHP 7.4 through 8.5 patched automatically at platform level, monitoring every three minutes, and an uptime guarantee of 99.9% (up to 99.99%) backed by tiered service credits in a published SLA, with a status page showing ninety days of component-level uptime. Disk, CDN and server bandwidth are stated per tariff, but no CPU or RAM figures are given, no end-of-life policy for PHP versions is published, and replication to a second data centre exists only as a disaster-recovery add-on restricted to dedicated servers. 2 8 13 14 15 17 18

Report an error

Control panel, WordPress & developer tooling

How this is scored

How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.

0 — No documented way to deploy or manage a website on the product.

3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.

5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.

8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.

10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.

Report an error

The Data Protection Officer

MyKinsta covers the daily workflow end to end: one-click staging with selective push of files, database or both, site cloning, automatic plugin and theme updates with visual regression checks and rollback, SSH, Git, WP-CLI and Composer, real server cron jobs per site container, and role-based company and site-level access with SAML SSO and unlimited users. A public REST API in open beta with a downloadable OpenAPI specification manages sites, backups, domains, DNS, SFTP accounts and PHP settings, and the agency offer adds white-labelling, hosting credits and a partner programme. I found no public information on a command-line client or infrastructure-as-code support. 3 4 7 14 15 16

Report an error

Security, backups & recovery

How this is scored

How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.

0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.

3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.

5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.

8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.

10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.

Report an error

The Data Protection Officer

Isolation is clearly documented — each website in its own container — alongside free auto-renewing wildcard SSL, Cloudflare Enterprise firewall and DDoS protection, a web application firewall, continuous 24/7 malware scanning with free hack-fix cleanup, two-factor login, and published SOC 2 Type II and ISO 27001 badges. Daily backups with fourteen to twenty days' retention are restorable with one click in the panel, but each backup is stored on the same host machine as the site, with a second location only through paid external-backup or disaster-recovery add-ons, and no recovery objectives are published. Under the data processing agreement, customer audits require a non-disclosure agreement, at least thirty days' notice, pre-approval, run at most once every twelve months and at the customer's own cost. 2 3 4 11 14 17 18

Report an error

Scaling, migration & exit

How this is scored

What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.

0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.

3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.

5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.

8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.

10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.

Report an error

The Data Protection Officer

Migration in is exemplary: free and handled by a specialist team that scans for malware, from any standard WordPress host or from Duplicator, ManageWP or cPanel backups, with expedited migration at $49 per site under an eight-hour target and the exclusions (DNS, email, third-party services) stated openly. Plan limits for disk, CDN and server bandwidth, visits with a defined visit, are published with priced add-on resources including a dedicated server from $300 per month, and termination is self-service in the panel, effective at the end of the subscription period. Deletion or return of data on termination happens only at the customer's written direction with no deadline stated, and I found no public information on domain transfer out or supported migration to another host. 2 10 11 17 19

Report an error

Support, domains & email

How this is scored

Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).

0 — No support offered beyond a community forum and no domain or email service.

3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.

5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.

8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.

10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.

Report an error

The Data Protection Officer

Support runs around the clock every day through chat in MyKinsta with an average response under two minutes and average resolution of 47 minutes, staffed entirely by WordPress developers and Linux engineers with no tiered queues, in eight languages, with free hack-fix help, an account manager for larger plans and an agency partner programme. There is no telephone support, and the billing, malware and migration desks keep stated weekday hours in UTC. This is hosting without email: mailboxes are not offered, the migration guide tells customers to set up email themselves, and while premium DNS via Route 53 is included, I found no public information on domain registration. 4 6 15 19 21

Report an error

European sovereignty

How this is scored

Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.

0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.

5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.

8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.

10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.

Report an error

The Data Protection Officer

The contracting entity is Kinsta Inc. of West Hollywood under Delaware law, with the US Federal Trade Commission holding jurisdiction over its Data Privacy Framework commitments and only a UK contact as a second entity — no EU company or EU representative — although customer sites can be hosted in a customer-chosen Google Cloud region including Europe, with a published data processing agreement using the SCCs and a subprocessor list naming each processor with its location. The chain nonetheless runs largely through the United States: DNS via Amazon Web Services, support via Hubspot and Intercom, analytics and log storage via Clickhouse, AI tooling via OpenAI and Anthropic, transactional mail via Canada and the United States — and the vendor's own analytics cluster, which processes IP addresses and access-log information from customer sites, is hosted in the United States. Certifications are stated as SOC 2 Type II and ISO 27001, but the DPA may be changed at any time in Kinsta's sole discretion and audits are restricted as described above. 9 10 11 12 14

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.

0 — No public prices at all; every customer is a sales call.

3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.

5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.

8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.

10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.

Report an error

The Data Protection Officer

Add-on pricing is unusually complete: $30 per additional site per month, $20 per 20 GB, Redis at $100 per site and month, hourly backups at $100 and six-hour backups at $20 per site and month, external backups at $10 per 500 MB per month plus $1 per GB bandwidth, disaster recovery at $300 per month plus a one-time $300 setup fee, expedited migration at $49 per site — with the first month free on the Single 35k and WP 2 tariffs, a 30-day money-back guarantee, VAT treatment stated (USD, taxes excluded) and self-service cancellation at period end. The overage policy promises the site stays online with notices at 80% and 100% of usage but states no unit price for the overage charged, and beyond the Single plan at $0 first month and $30 per month I found no public renewal prices quoted for the larger tariffs on the captured pages. 1 2 4 10 18 19

Report an error

European sovereignty — proven facts

0 of 6 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Hosting location Not determined — uncited Report an error
Hosting options Not determined — uncited Report an error
Open source Not determined — uncited Report an error
Data processing agreement Not determined ⚠ unverified — uncited Report an error
Transfer impact assessment Not determined — uncited Report an error

Questions about Kinsta

Is Kinsta European?

No. whats-best.ai classifies Kinsta as Rest of world.

Where does Kinsta store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

Does Kinsta have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

What are the best alternatives to Kinsta?

As of 2 Nov 2026, the panel rates Raidboxes (3/5), Infomaniak Web Hosting (3/5) and webgo Webhosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Kinsta alternatives.

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Kinsta? Tell us Report an error on this page

Sources (24)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage (managed WordPress hosting) kinsta.com Checked 1 Nov 2026 Details →
  2. 2 Pricing page kinsta.com Checked 1 Nov 2026 Details →
  3. 3 Features page (security) kinsta.com Checked 1 Nov 2026 Details →
  4. 4 Features page (agencies) kinsta.com Checked 1 Nov 2026 Details →
  5. 5 Features page (migration) kinsta.com Checked 1 Nov 2026 Details →
  6. 6 Support page kinsta.com Checked 1 Nov 2026 Details →
  7. 7 API documentation kinsta.com Checked 1 Nov 2026 Details →
  8. 8 Status page status.kinsta.com Checked 1 Nov 2026 Details →
  9. 9 Privacy policy kinsta.com Checked 1 Nov 2026 Details →
  10. 10 Terms of service kinsta.com Checked 1 Nov 2026 Details →
  11. 11 Data processing agreement (dpa) kinsta.com Checked 1 Nov 2026 Details →
  12. 12 Subprocessor list kinsta.com Checked 1 Nov 2026 Details →
  13. 13 Performance, uptime & infrastructure — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  14. 14 Performance, uptime & infrastructure — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  15. 15 Control panel, WordPress & developer tooling — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  16. 16 Control panel, WordPress & developer tooling — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  17. 17 Security, backups & recovery — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  18. 18 Security, backups & recovery — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  19. 19 Scaling, migration & exit — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  20. 20 Scaling, migration & exit — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  21. 21 Support, domains & email — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  22. 22 Support, domains & email — found from sitemap kinsta.com Checked 1 Nov 2026 Details →
  23. 23 Imprint — found from the homepage kinsta.com Checked 1 Nov 2026 Details →
  24. 24 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →