Web Hosting
STRATO Webhosting
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by STRATO GmbH · www.strato.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
STRATO Webhosting at a glance
- Vendor
- STRATO GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates STRATO Webhosting 2.5/5, the mean of 6 judges. STRATO GmbH, a Berlin company in the United Internet group, offers shared web hosting and WordPress hosting with domains and mailboxes. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
STRATO GmbH, a Berlin company in the United Internet group, offers shared web hosting and WordPress hosting with domains and mailboxes. Sovereignty scored highest at 7–8: a German contracting entity, hosting in TÜV- and ISO 27001-certified German data centres, a published Article 28 processing agreement with audit rights, and a subprocessor list with locations — though that chain includes SiteLock LLC in the USA for malware handling and Dropsuite in Singapore for mail archiving. The lowest band, 4–5, covers performance and reliability, security and backups, and scaling and portability: we found no public information on per-tariff CPU or RAM, a status page, or vendor backup frequency, retention or self-service restore — the terms place backup copies on the customer — and the captured pages give different figures for availability, 99,99 % guaranteed on the homepage against at least 99 % in the annual average in the terms. Management and developer tools scored a flat 5, support and service 5–6, pricing transparency 6–7 with side-by-side intro and renewal prices but unpriced add-ons. No criterion divided the judges by more than a point.
Speaks for it
- Sovereignty scored 7–8 on a Berlin contracting entity within the United Internet group, TÜV- and ISO 27001-certified German data centres, a published Article 28 processing agreement with audit rights, and a subprocessor list with locations.
- SSH, SFTP, WP-CLI, Git, phpMyAdmin and one-click installs for WordPress, Joomla!, Drupal and Typo3 are all documented.
- Every tariff shows introductory and renewal prices side by side — Hosting Basic at 1 €/Mon. für 12 Monate danach 9 €/Mon., Einrichtung: 0 € — marked as including VAT.
- A 30-day money-back guarantee and a one-month cancellation period are published.
- Over 300 domain endings come with DNS self-management and subdomain management, plus included mailboxes with a multi-stage spam and virus filter.
Held against it
- The terms place the duty of regular backups on the customer, and we found no public information on vendor backup frequency, retention or self-service restore.
- We found no public information on CPU or RAM per webhosting tariff, a public status page, or a service credit when availability is missed.
- The captured pages give different figures for availability — 99,99 % guaranteed on the homepage against at least 99 % in the annual average in the terms.
- Add-ons remain unpriced: PHP Extended Support is a paid special service switched on automatically with no published price, and the 24/7 hotline, restores and service fees carry no amounts.
- The documented manual migration explicitly does not work with the managed WordPress packages.
Best for
- You need a German provider whose compliance documentation you can review — a published Article 28 agreement, published technical measures and a subprocessor list with locations — for a data protection assessment.
- You run one or a few WordPress sites and want one-click installation, automatic updates for core, themes and plugins, and SFTP or SSH access from a single login.
- You want to compare the first-year and renewal price side by side, with the setup fee and cancellation terms, before committing.
- You want domains, mailboxes and DNS self-management in one account, with phone and email support at stated hours on weekdays 8–20 and weekends 10–18:30.
Avoid if
- You rely on the provider for backups — the terms state the customer creates regular backup copies, and only manual routes via phpMyAdmin, an FTP client or plugins are documented.
- You need an availability commitment backed by compensation — the terms commit to at least 99 % in the annual average, and we found no public information on a service credit when availability is missed.
- You are moving an existing WordPress site into a managed WordPress package — the migration guide states the manual process works with the hosting packages but not with the managed packages.
- Your compliance rules bar processors outside the EU — the subprocessor list includes SiteLock LLC in the USA and Dropsuite in Singapore.
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 2 of 5 |
| Control panel, WordPress & developer tooling | 2.5 of 5 |
| Security, backups & recovery | 2 of 5 |
| Scaling, migration & exit | 2.5 of 5 |
| Support, domains & email | 2.5 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Performance, uptime & infrastructure
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
Per-tariff webspace, SSD database counts and unlimited traffic are published, HTTP/2 with MySQL/MariaDB is stated, PHP runs current through 8.5 with automatic updates, and hosting is georedundant in German data centres. The captured pages give different figures for availability — 99,99 % guaranteed on the hosting page and at least 99 % in the annual average in the terms — and we found no public information on CPU or RAM per hosting tariff, a CDN, an object cache, or a public status page with incident history. 1 9 14 17
The Small-Business Owner
The hosting pages name SSD storage, databases, domains and SSL certificates per tariff, HTTP/2, container-based hosting with a claim of up to three times faster loading, current PHP up to 8.5 with automatic updates, and georedundant German data centres. The captured pages give different figures for guaranteed availability — 99,99 % on the hosting page and at least 99 % in the annual average in the terms — and we found no public information on CPU or RAM per tariff, a CDN, or a public status page where I could see outages. 1 9 17 14 3
The Shop Operator
The tariffs state webspace, SSD databases, domains and SSL per plan, HTTP/2, unlimited traffic, SSD container hosting and current PHP up to 8.5 with automatic updates — but we found no public information on CPU or RAM per webhosting tariff, a page cache or Redis, a CDN, a status page or a service credit; caching appears only as one of six optimization tips. The captured pages also give different figures for availability: the product page promises "99,99 % garantierte Verfügbarkeit" while the terms guarantee "mindestens 99 % im Jahresmittel". 1 3 9 13 14 17
The Freelance App Developer
The tariffs give me real numbers — 50 to 200 GB Webspace, 2 to 75 SSD databases at 2 GB each, unlimited traffic — plus HTTP/2, current PHP up to 8.5 with automatic updates and paid extended support for older versions, and German data centres described as georedundant with DDoS protection. But there is no CPU or RAM figure per webhosting tariff, we found no public information on server-side caching, a CDN or a public status page, and the captured pages give different figures for availability — 99,99 % guaranteed on the homepage against at least 99 % in the yearly average in the terms. 1 3 9 13 14 17
The Data Protection Officer
Each tariff lists its storage, SSD databases, domains and SSL certificates, with HTTP/2, MySQL/MariaDB, geo-redundant German data centres, and PHP kept current automatically plus a paid extended support that keeps outdated PHP versions alive. The captured pages give different figures for availability — 99.99 % guaranteed on the hosting page against at least 99 % in the annual average in the terms — and we found no public information on per-tariff CPU or RAM, an SLA with a service credit, a public status page or server-side caching. 1 2 9 14 17
The Skeptic
Webspace, SSD databases and domains per tariff are published, HTTP/2 and georedundant German data centres are stated, and PHP runs up to version 8.5. We found no public information on CPU or RAM per webhosting tariff, on a public status page with incident history, or on a service credit when availability is missed. The captured pages give different figures for availability — the homepage promises 99,99 % guaranteed, the terms commit to at least 99 % on annual average — and a promise without compensation is not a service level agreement. 1 9 14 17
Control panel, WordPress & developer tooling
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
One-click installers cover WordPress, TYPO3, Drupal and Joomla, SSH, SFTP, WP-CLI and Git are listed, automatic updates for core, themes and plugins are described, staging appears as a managed benefit and phpMyAdmin is reachable from the customer login. We found no public information on panel-level roles for freelancers, a client project view with handover and billing transfer, a public API or command line for the panel, cron jobs or log access — the agency workflow I need is not in the evidence. 1 3 15 17
The Small-Business Owner
One-click installers for several named systems including WordPress, Joomla and Drupal, SFTP on all packages, SSH, WP-CLI and Git, phpMyAdmin reachable from the customer login, and automatic updates for WordPress, themes and plugins are documented, with easy staging named as a managed benefit. We found no public information on cron jobs, team members with access rights, log files or a public API, so the day-to-day for one WordPress site is covered but nothing more is shown for a team. 1 3 4 17 15
The Shop Operator
SSH, SFTP, WP-CLI, Git and one-click installs for Typo3, Drupal, Joomla! and WordPress are documented, phpMyAdmin sits behind the customer login, and managed WordPress lists automatic updates for core, themes and plugins plus staging. We found no public information on cron jobs, panel-level team roles or log access, or a public API or command-line tool for the hosting itself. 1 3 4 15 17
The Freelance App Developer
SSH, Git and WP-CLI are named as included tools, SFTP is available on every plan, phpMyAdmin sits in the customer login, PHP versions can be switched (8.3 and 8.5 documented), and one-click installs cover Typo3, Drupal, Joomla! and WordPress. That covers my daily basics, but we found no public information on Composer, cron jobs, a public API or a CLI, and staging appears only as a listed benefit without detail — day-to-day work stays panel-first rather than scriptable. 1 3 4 14 15
The Data Protection Officer
One-click installation of several named CMS (WordPress, Joomla!, Drupal, Typo3) from the customer login is documented alongside SSH, SFTP, WP-CLI and Git, phpMyAdmin for databases, automatic updates for WordPress, themes and plugins, managed updates for security plugins, and staging named among the managed benefits. We found no public information on cron jobs, panel roles for team members, log access or a public API for the panel. 1 3 4 15 17
The Skeptic
SSH, SFTP, WP-CLI and Git, phpMyAdmin, one-click installers for named CMS, automatic WordPress updates, a staging benefit and search-and-replace via a recommended plugin are all documented. We found no public information on cron jobs, log access, team roles in the customer login, or a public API and command line for the panel. Managed extras appear as a feature list, but rollback of updates and push-to-live staging are not described. 1 3 4 15 17
Security, backups & recovery
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
Free SSL on every WordPress installation, DDoS protection, two-factor login, daily malware scans and ISO 27001-certified data centres are stated. But the terms put backup creation on the customer, the documented backup path is manual via phpMyAdmin and an FTP client or a plugin like BackWPup, and we found no stated frequency, retention or self-service point-in-time restore — for my two WooCommerce shops that is a manual night shift, not a recovery plan. 1 4 9 17
The Small-Business Owner
Free SSL for every WordPress installation, DDoS protection, two-factor login, daily malware scans, SiteLock Scan + Repair and ISO 27001 certified data centres are documented. The terms state that the customer creates regular backup copies, and the guides describe manual backups via phpMyAdmin and an FTP client or plugins; we found no public information on vendor backup frequency, retention or a restore that support could run for me, which is exactly what I need when the site breaks. 1 9 4 5 17
The Shop Operator
Free SSL, DDoS protection, daily malware scans, SiteLock Scan + Repair, two-factor login and ISO 27001-certified data centres are documented, and container-based hosting points at isolation. But the terms state "Der Kunde erstellt regelmäßig Sicherungskopien von allen Daten", backup is documented as manual work with phpMyAdmin, an FTP client and plugins, and we found no public information on automated vendor backups with a retention period or self-service point-in-time restore — for me that is the heart of this criterion. 1 4 5 9 17
The Freelance App Developer
On protection the pages are solid: free SSL for every WordPress installation, two-factor login, DDoS protection, daily malware scans with SiteLock Scan + Repair, and ISO 27001-certified data centres. The backup side is thin for my taste — the terms put regular backups on the customer, and the documented route is manual via phpMyAdmin and an FTP client; we found no public information on vendor backup frequency, retention or a self-service restore. 1 4 5 9 17
The Data Protection Officer
Free SSL per installation, daily malware scans with SiteLock scan and repair, DDoS protection, two-factor login to the customer account and ISO 27001-certified data centres are stated. The terms place the duty of regular backups on the customer, with only manual backups via phpMyAdmin, FTP or WordPress plugins documented; we found no public information on vendor backup frequency, retention, storage location or self-service restore, and the malware service runs through a subprocessor in the USA. 1 5 9 10 11
The Skeptic
Daily malware scans, DDoS protection, two-factor login to the customer account, free SSL, container-based hosting and ISO-27001-certified data centres are stated. On backups the pages go quiet: frequency, retention and customer self-service restore are not documented, and the terms put the duty on the customer, who is to create regular backup copies of all data. A backup regime I have to run myself through phpMyAdmin and a third-party plugin is not a managed backup. 1 4 5 9 15
Scaling, migration & exit
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
The main limits per tariff — webspace, SSD databases, domains, SSL certificates — are published, upgrades without a provider change are offered, migration in is covered by detailed Duplicator and manual guides (with the note that the manual route does not work for the managed packages), and the one-month cancellation period is stated. We found no public information on downgrades, domain transfer out, or full export including mailboxes. 1 9 18 21
The Small-Business Owner
The four hosting tariffs come with their main limits stated (webspace, databases, domains, SFTP accounts), migration guides using free plugins such as Duplicator, UpdraftPlus and Clone are published, files and databases export with standard tools, and cancellation is one month's notice with a termination right when prices change. The manual migration guide is stated to work with the hosting packages but not with the managed WordPress packages, and we found no public information on domain transfer out or a migration service done for me. 1 18 9 15
The Shop Operator
Upgrades "ohne Anbieterwechsel" for webshop and marketing tools, per-tariff limits, unlimited traffic, export via phpMyAdmin and SFTP, a one-month cancellation period and DPA rules on return or deletion of data are documented, and root, managed and dedicated servers sit in the same catalogue. The migration guide itself notes the manual move "funktioniert... allerdings nicht mit den gemanagten WordPress Paketen", and we found no public information on a migration service with its scope or on domain transfer out. 1 4 9 10 18 21
The Freelance App Developer
The main limits are stated in numbers per tariff (webspace, databases, domains, traffic), migration in is covered by detailed guides using standard plugins such as Duplicator, UpdraftPlus and Better Search Replace, export runs through phpMyAdmin and FTP, and the contract cancels with one month's notice. We found no public information on tariff downgrades, domain transfer out, or the deadline for deleting data after the contract ends. 1 4 9 18 21
The Data Protection Officer
The main limits per tariff are published (webspace, databases, domains, SFTP accounts, SSL certificates), upgrades can be added without changing provider, cancellation runs on one month's notice, and migration in is covered by detailed guides using standard plugins such as Duplicator, UpdraftPlus and Clone — with the statement that manual migration does not work with the managed WordPress packages. The processing agreement promises deletion or return of data at contract end, but we found no public information on a deletion deadline, domain transfer-out fees or tariff downgrades. 1 4 9 10 18
The Skeptic
The limits per tariff are stated in numbers, export runs through phpMyAdmin and SFTP in standard formats, the cancellation period is one month, and a detailed Duplicator guide covers moving in. But the documented manual migration explicitly does not work for the managed WordPress packages, we found no public information on domain transfer out or on downgrades, and after termination data are deleted by default with return available for a fee. 1 4 9 10 18
Support, domains & email
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
Support runs by phone and email with stated hours on weekdays and weekends, an extensive FAQ exists, and over 300 domain endings, mailboxes with a multi-stage spam and virus filter and DNS self-management come in the same account. The captured pages give different pictures of round-the-clock availability — the homepage advertises 24/7 support while the feature page lists a 24/7 hotline as a bookable add-on alongside limited hours — and we found no public information on response times, help with hacked sites, or a partner programme for agencies. 1 2 5 21
The Small-Business Owner
A German phone number with hours of 8 to 20 on weekdays and 10 to 18.30 at weekends, an extensive FAQ, over 300 domain endings with DNS self-management, and an integrated multi-stage spam and virus filter are documented; the captured pages give different pictures of around-the-clock help, one showing 24/7 customer support and another a bookable 24/7 hotline. We found no public information on response times, mailbox sizes or help with a hacked site, which is what I would need the day the mail stops. 2 1 18 20 5
The Shop Operator
Phone and email support with stated hours (weekdays 8–20, weekends 10–18:30), a help centre, over 300 TLDs with DNS self-management, mailboxes with a multi-stage spam filter plus a bookable mail archive are documented. The captured pages give different figures for around-the-clock help — the homepage claims "24/7 Kunden-Support" while the contact page lists business hours and sells the 24/7 hotline as an add-on — and we found no stated response times or an agency or partner programme. 1 2 5 9 18 19
The Freelance App Developer
Phone (030 300146099) and email support come with stated hours — weekdays 8-20, weekends 10-18:30 — plus an optional paid 24/7 hotline, an extensive FAQ, over 300 TLDs with DNS self-management, and mailboxes with a multi-stage spam and virus filter. The captured pages give different figures for support availability (the homepage advertises 24/7 support while the WordPress page lists business hours with a bookable 24/7 hotline), and we found no public information on guaranteed response times or an agency programme. 1 2 5 15 19
The Data Protection Officer
Phone and email support with stated hours on weekdays and weekends, an extensive FAQ, setup assistance, over 300 domain endings with DNS self-management and subdomain management, mailboxes with a multi-stage spam and virus filter and an optional mail archive are documented. The captured pages give different figures for availability — 24/7 support is advertised on the hosting page, while the WordPress feature page states weekday and weekend hours with a bookable 24/7 hotline — and we found no public information on response times, a chat channel or a partner programme. 1 2 5 15 19
The Skeptic
Phone and email support with stated hours — weekdays 8–20, weekends 10–18:30 — an extensive help centre, over 300 domain endings with DNS self-management and subdomain management, and included mailboxes with a multi-stage spam and virus filter are documented. The captured pages give different figures for support availability: the homepage advertises 24/7 support while the product pages list limited hours with a paid 24/7 hotline add-on. We found no public information on response times, an agency programme, or mailbox sizes. 1 2 5 15 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
Contracting entity and parent are German (STRATO GmbH, Berlin, within the United Internet group), hosting is stated in German, TÜV-certified data centres without routing outside the EU, a data processing agreement under Article 28 with published technical measures and audit rights exists, and the subprocessor list names companies with their locations. Two links in the chain sit outside the EU — SiteLock in the USA for malware detection and removal, Dropsuite in Singapore for mail archiving — with standard contractual clauses stated for the Swiss Plesk entry but no stated safeguard shown for the US and Singapore entries. 1 5 7 10 11 20
The Small-Business Owner
STRATO GmbH in Berlin is the contracting entity within the United Internet group, hosting runs in German, georedundant data centres, a data processing agreement under Article 28 GDPR is published, ISO 27001 certified data centres are stated, and the subcontractor list names its processors with locations. Most processors sit in Germany, but SiteLock in the USA handles malware detection and removal and Dropsuite in Singapore the mail archiving software, so the chain is visible though two processors sit outside the EU. 1 5 7 10 11 17
The Shop Operator
STRATO GmbH is the Berlin-registered contracting entity inside the European United Internet group, data centres are stated to be in Germany and TÜV- and ISO 27001-certified, a data processing agreement and the technical measures are published, and subprocessors are listed with their locations. Most of that chain is German, but SiteLock (USA), Dropsuite (Singapore) and Plesk and Virtuozzo (Switzerland) appear on it, and both the privacy policy and the DPA state that third-country transfers with GDPR safeguards are possible. 5 7 8 10 11 17 20
The Freelance App Developer
STRATO GmbH in Berlin with United Internet AG as parent, hosting described as in Germany in TÜV-certified and ISO 27001-certified data centres without detours outside the EU, a published Art. 28 data processing agreement with audit and inspection rights, and a subprocessor list naming companies and locations. It is not sovereign end to end, though: that list includes SiteLock in the USA for malware handling and Dropsuite in Singapore for mail archiving, and marketing data hashed with SHA-256 goes to Meta, Google, LinkedIn, TikTok and Reddit — with safeguards stated rather than avoided. 5 7 8 10 11 20
The Data Protection Officer
STRATO GmbH is a Berlin-registered German company in the United Internet group, hosting in TÜV- and ISO 27001-certified German data centres with geo-redundancy, and publishes an Art. 28 GDPR data processing agreement (version 3.5, 18 March 2024) with the technical measures online, audit and on-site inspection rights, breach notification, and deletion or return of data at contract end. Subprocessors are listed with addresses, mostly in Germany, but the list includes SiteLock in the USA for malware removal and Dropsuite in Singapore for mail archiving with only the general Art. 44 ff. GDPR safeguard stated, and group-wide data exchange with IONOS Group SE and United Internet AG is disclosed. Hashed marketing data is also shared with Meta, LinkedIn, TikTok, Reddit and Google. 5 8 10 11 20
The Skeptic
A German contracting entity in Berlin under a German parent, United Internet, German TÜV- and ISO-27001-certified data centres, a published Art. 28 processing agreement with audit rights, and a subprocessor list with locations — more of the chain documented than most. But the chain reaches outside the EU: malware detection and removal runs through SiteLock LLC in the USA, mail-archiving software through Dropsuite in Singapore, and group-internal data exchange with IONOS and United Internet companies is stated. The data centres are named by country only, not by location. 5 7 10 11 20
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
The tariff pages show first term and renewal side by side — "1 €/Mon. für 12 Monate danach 9 €/Mon.", setup "0 €" — with inclusions like the permanent domain and SSL certificate listed, VAT-inclusive prices and a one-month cancellation period, so the second-year cost of a client site is readable. What keeps it from full computability: the PHP Extended Support is a paid service switched on automatically with no price shown, the 24/7 hotline and service fees such as contract handover are unpriced, and we found no VAT treatment stated for business customers. 2 9 14 15 18 19
The Small-Business Owner
Every hosting and WordPress tariff shows the first-term price and the renewal price side by side with the setup fee — Basic 1 €/Mon. für 12 Monate danach 9 €/Mon. Einrichtung: 0 € — plus „Preise inkl. MwSt.“, one domain permanently included and one month's notice to cancel. Two costs I cannot compute from the pages: the PHP Extended Support is described as a paid special service automatically enabled for customers with no price shown, and service fees for contract transfer, reactivation and re-invoicing are named without amounts; we found no public information on what a restore or extra backups cost. 17 18 15 14 9
The Shop Operator
Every tariff shows the introductory and renewal price side by side (Plus: "1 €/Mon. für 12 Monate danach 9 €/Mon."), setup fees are stated, prices are marked "Preise inkl. MwSt.", inclusions per plan are listed and the one-month cancellation period is published. The add-ons I would want to price are unpriced: PHP Extended Support is "eine kostenpflichtige Sonderleistung" that is enabled automatically with no price shown, and the 24/7 hotline, the SLA levels and the service fees carry no figures. 2 9 14 15 18
The Freelance App Developer
Prices are shown for the first term and on renewal side by side — hosting Basic at "1 €/Mon. für 12 Monate danach 9 €/Mon." with 0 € setup, domains such as.support at "3,25 €/Mon. für 12 Monate danach 4,25 €/Mon." with 2,50 € setup — marked "Preise inkl. MwSt.", with a one-month notice period and a 30-day money-back guarantee. Gaps remain for a buyer computing real cost: the PHP Extended Support is described as a paid service that is automatically enabled with no published price, service fees for contract transfer or reactivation are named but unpriced, and we found no public information on the cost of a restore or extra backups. 1 9 14 15 18
The Data Protection Officer
Every hosting tariff shows the introductory price and the renewal price side by side — for example Hosting Basic 1 €/Mon. für 12 Monate danach 9 €/Mon., Einrichtung: 0 € — with setup fees, one included domain, SSL and unlimited traffic stated, prices marked as including VAT, and the one-month notice period, the four-week price-change notice with a special termination right and the 30-day money-back guarantee published. Some add-ons remain unpriced: the PHP Extended Support is described as a paid special service enabled automatically, service fees for contract transfer, reactivation and repeated invoicing carry no stated amounts, and the optional 24/7 hotline shows no price. 1 2 9 14 15 18
The Skeptic
Every tariff shows introductory and renewal prices side by side — "1 €/Mon. für 12 Monate danach 9 €/Mon." — with setup fees, one included domain, VAT-inclusive prices and a 30-day money-back guarantee stated. But the extras stay dark: PHP Extended Support is a paid special service switched on automatically with no price published, and the 24/7 hotline, restores, additional backups and the service fees for contract transfer or reactivation are named without amounts or not priced at all. 1 9 14 15 17
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about STRATO Webhosting
Is STRATO Webhosting European?
Yes. whats-best.ai classifies STRATO Webhosting as EU-Made.
Where does STRATO Webhosting store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does STRATO Webhosting have a free plan?
Yes. STRATO Webhosting has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to STRATO Webhosting?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: STRATO Webhosting alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options, Legal entity, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 53 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 22 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (web hosting, with pricing) www.strato.de Checked 1 Nov 2026 Details →
- 2 Features page (WordPress hosting) www.strato.de Checked 1 Nov 2026 Details →
- 3 Features page (PHP hosting) www.strato.de Checked 1 Nov 2026 Details →
- 4 Features page (WordPress backup) www.strato.de Checked 1 Nov 2026 Details →
- 5 Security / trust page www.strato.de Checked 1 Nov 2026 Details →
- 6 Help centre www.strato.de Checked 1 Nov 2026 Details →
- 7 Legal notice www.strato.de Checked 1 Nov 2026 Details →
- 8 Privacy policy www.strato.de Checked 1 Nov 2026 Details →
- 9 Terms of service www.strato.de Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) www.strato.de Checked 1 Nov 2026 Details →
- 11 Subprocessor list www.strato.de Checked 1 Nov 2026 Details →
- 12 Performance, uptime & infrastructure — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 13 Performance, uptime & infrastructure — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 14 Control panel, WordPress & developer tooling — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 15 Control panel, WordPress & developer tooling — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 16 Security, backups & recovery — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 17 Security, backups & recovery — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 18 Scaling, migration & exit — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 19 Scaling, migration & exit — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 20 Support, domains & email — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 21 Support, domains & email — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 22 Self-hosting / on-premises installation docs — found from the homepage www.strato.de Checked 1 Nov 2026 Details →