Web Hosting
WP Engine
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by WPEngine, Inc. · wpengine.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
WP Engine at a glance
- Vendor
- WPEngine, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates WP Engine 2.5/5, the mean of 6 judges. WP Engine is managed WordPress hosting from WPEngine, Inc., and the bench scores it highest on management and developer tools at 6 to 7: staging environments, Git/CI/CD workflows, SSH access, tested automatic updates and a REST API with a live playground are documented. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
WP Engine is managed WordPress hosting from WPEngine, Inc., and the bench scores it highest on management and developer tools at 6 to 7: staging environments, Git/CI/CD workflows, SSH access, tested automatic updates and a REST API with a live playground are documented. Support and service follows at 5 to 7 on 24/7 chat everywhere, phone from Business upward and a dedicated account team on Enterprise, with performance and reliability and security and backups at 4 to 6. Pricing transparency is weakest at 2 to 3: the introductory offer covers new Essential customers only, product renewal pricing is subject to change, and Enterprise is quoted individually. Sovereignty sits at 3 to 4 — the contracting party is a US company under the EU-U.S. Data Privacy Framework with Federal Trade Commission oversight, and judges found no public information confirming data-centre locations or subprocessors. Scaling and portability is flat at 4: migration in is documented, the way out is not. The captured pages give different uptime figures, 99.99% and 99.95%, and no judge disagreement cleared the reporting bar.
Speaks for it
- Staging environments, Git/CI/CD workflows, SSH access and automatic, tested updates of core, themes and plugins are documented.
- A REST API covering accounts, sites and environments is public and comes with a live playground.
- Support is 24/7 chat on every plan, with phone added on Business and priority support plus a dedicated account team on Enterprise.
- Daily automated backups with restore points, free SSL, firewalls, malware scans and automatic patches are on the record.
- The SLA pays a credit of 5% of monthly fees per full hour of downtime beyond the target, capped at 100%, claimable within 30 days.
Held against it
- The captured pages give different figures for the uptime commitment — 99.99% on the Business plan page, 99.95% in the SLA — and the vendor may update the SLA in its sole discretion.
- We found no public figures for renewal prices, minimum terms, setup fees or add-on prices, and Enterprise is quoted only as a custom solution.
- We found no public information on backup retention, off-site backup copies, point-in-time restore or two-factor login to the panel.
- The contracting party is WPEngine, Inc. of Austin, Texas, under the EU-U.S. Data Privacy Framework with Federal Trade Commission oversight and disputes routed to TRUSTe in the United States, and we found no public information confirming data-centre locations or individual subprocessors.
- We found no public information on full export, domain transfer out, cancellation terms or data deletion after the contract ends.
Best for
- You run WordPress sites and want the platform to handle updates, staging and deployment — management and developer tools scored 6 to 7, the bench's strongest cluster.
- You want around-the-clock support — 24/7 chat on every plan, phone from Business upward, and a dedicated account team with priority support on Enterprise.
- You are an agency — an agency partner programme with built-in client management tools is documented, and support scores reach 7.
Avoid if
- You need a predictable price over the contract — product renewal pricing is subject to change, the introductory offer is not valid for upgrades or renewals, and Enterprise is quoted only as a custom solution.
- Your procurement requires a European contracting entity or confirmed data residency — the contracting party is a US company under the EU-U.S. Data Privacy Framework, and we found no public information confirming data-centre locations.
- You need one authoritative uptime number — the captured pages give different figures, 99.99% and 99.95%, and the vendor may update the SLA in its sole discretion.
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 2.5 of 5 |
| Control panel, WordPress & developer tooling | 3.5 of 5 |
| Security, backups & recovery | 2.5 of 5 |
| Scaling, migration & exit | 2 of 5 |
| Support, domains & email | 3 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Performance, uptime & infrastructure
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
Server-level caching, a CDN and active monitoring are documented, and there is a real SLA paying back 5% of monthly fees per hour of downtime capped at a month's fees — though the captured pages give different figures for the commitment, 99.99% on the Business plan and 99.95% in the legal SLA, which may be updated in the vendor's sole discretion. Free SSL is included from the lowest tier. I found no public information on resources per plan, PHP versions, or a status page with incident history in the captured pages, which is what I would want before moving sixty client sites. 1 2 7
The Small-Business Owner
Server-level caching, CDNs, active monitoring and free SSL are documented, and there is a written uptime SLA with a service credit of 5% of monthly fees per full hour of downtime; the captured pages give different figures for the uptime promise (99.99% on the plans page for Business, 99.95% in the legal SLA). I found no public information on how much storage or RAM each plan gets, which PHP versions run and for how long, or a public status page with incident history, so I cannot place it higher. 1 2 7
The Shop Operator
Server-level caching, a CDN and active monitoring are documented, free SSL is included, and there is an SLA of 99.95% availability with a credit of 5% of the monthly fee per full hour of downtime — though the Business plan page quotes 99.99%, so the captured pages give different uptime figures, and the European maintenance window is expressed in North American Central Time. What I miss as an operator: no CPU, RAM or storage figures per plan, no PHP version policy, and no public status page with incident history on the pages I read, so I cannot size the platform for a tenfold Black Friday weekend. 1 2 7
The Freelance App Developer
Server-level caching, CDNs and active monitoring are documented, PHP and MySQL are described as managed, and there is a real SLA with credits of 5% of monthly fees per full hour of downtime — though the captured pages give different figures for the uptime commitment, 99.99% on the plans page and 99.95% in the SLA itself. I found no public information on resource numbers per tariff such as CPU, RAM or storage, selectable PHP versions, HTTP protocol support or a public status page. 1 2 5 7
The Data Protection Officer
Server-level caching, CDNs, active monitoring and free SSL are documented, and there is an uptime service level agreement with a credit of 5 per cent of monthly fees per full hour of downtime; the captured pages give different figures for the target, 99.99 per cent on the plans page and 99.95 per cent in the agreement. We found no public information on CPU, RAM or storage per tariff, selectable PHP versions, HTTP versions, or a public status page with incident history. 1 2 7
The Skeptic
Server-level caching, CDNs and active monitoring are documented, and there is a real payout behind the uptime promise: a credit of 5 % of monthly fees per full hour of downtime beyond the target, capped at 100 %, claimable within 30 days — though the captured pages give different figures for the target itself (99.99 % uptime SLA on the Business plan page, 99.95 % in the SLA), and the vendor may update the SLA in its sole discretion. We found no public information on CPU, RAM or storage per tariff, PHP version lifecycle, or a public status page with incident history, so the infrastructure behind the number stays unaudited. 1 2 7
Control panel, WordPress & developer tooling
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
Staging, Git with CI/CD workflows, an SSH gateway, tested automatic updates of core, themes and plugins, a migration plugin, and a REST API over accounts, sites and environments with a live playground — that is most of the toolchain my fifteen people live in. The agency pitch mentions built-in client management tools and a partner programme. I found no public information on per-project roles for freelancers, transferring a site with its billing to the client, a command-line tool or Composer in the captured pages. 1 5 6
The Small-Business Owner
Core, themes and plugins are updated automatically and tested; staging environments, Git, SSH access and a REST API for account, sites and environments with a live playground are all documented, plus a Smart Plugin Manager and built-in client management tools for agencies. I found no public information on database web tools, team roles, or cloning a site, but for keeping one WordPress site alive this is well above basic. 1 2 5 6
The Shop Operator
Staging environments, Git/CI/CD workflows with local push-to-production, an SSH gateway, automatic and tested updates of core, themes and plugins, and a public REST API for accounts, sites and environments with a live playground are all documented. We found no public information on Composer support, a command-line tool, granular team roles, white-labeling or an update rollback, and agency client management is named only as "built-in client management tools" without detail. 1 5 6
The Freelance App Developer
The developer core I rely on is documented: SSH gateway, Git version control, staging environments, local push-to-production, and a REST API with a live playground covering account, sites and environments, plus automatic WordPress core, theme and plugin updates and agency client-management tools. I found no public information on Composer, cron jobs, a command-line tool, or the API covering databases, domains and backups, so it falls short of the top anchor for my scripted workflow. 1 5 6
The Data Protection Officer
Managed automatic updates of core, themes and plugins, staging environments, Git and CI/CD workflows, an SSH gateway, a site migration plugin, and a REST API with a live playground covering accounts, sites and environments are all documented, alongside an agency partner programme with client management tools. We found no public information on Composer, a command-line tool, roles per project, database administration in the panel, or log access. 1 5 6
The Skeptic
The managed-WordPress toolset is well documented: core, themes and plugins are automatically updated and tested, staging environments and Git/CI/CD workflows exist, SSH access and local push-to-production are named, and a REST API with a live playground covers account, sites and environments. We found no public information on a command-line tool, Composer support, per-project roles or an update-rollback flow, which is what would separate a strong toolset from a complete one. 1 5 6
Security, backups & recovery
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
Daily automated backups with restore points, free SSL, firewalls, malware scans and automatic patches are documented, plus a bug bounty route for outsiders and managed WAF and DDoS on the Enterprise tier. For my clients' shops I would need backup retention, a second storage location, point-in-time restore of single files and two-factor login named. I found no public information on any of those in the captured pages, nor a certification of the hosting operation. 1 2 3 5
The Small-Business Owner
Daily automated backups with restore points, firewalls, malware scans, automatic patches, free SSL, Global Edge Security and a public bug bounty programme are all documented. I found no public information on how long backups are kept, whether a restore is self-service or done by support for me, or on any ISO 27001-type certification, so the question of who puts my site back the same day stays unanswered. 1 2 3 5
The Shop Operator
Daily automated backups with restore points, a documented backup and restore area, free SSL, malware scans, firewalls and a Global Edge Security offering are stated, plus managed WAF and DDoS on the Enterprise tier and a public bug bounty programme. For my recovery test — yesterday's database back within the hour — the retention period is not stated, and we found no public information on off-site backup copies, point-in-time restore of single files or tables, two-factor login or security certifications. 1 2 3 5
The Freelance App Developer
Daily automated backups with restore points, free SSL, firewalls, malware scans, automatic patches, Global Edge Security, managed WAF and DDoS on the top tier, and an Intigriti bug bounty programme are all documented. I found no public information on backup retention, point-in-time or single-file restore, two-factor login to the panel, or certifications of the hosting operation, which keeps it at the middle anchor. 1 2 3 5
The Data Protection Officer
Daily automated backups with customer restore points, firewalls, malware scans, automatic patches, Global Edge Security, a managed WAF with DDoS protection on the Enterprise tier and a bug bounty programme through Intigriti are documented. We found no public information on backup retention, where backups are stored, point-in-time or single-file restore, two-factor login to the panel, or an ISO 27001 or comparable certification — the retention and second-location questions are what I would press first for practices handling patient appointment forms. 1 2 3 5
The Skeptic
Daily automated backups with restore points, free SSL, firewalls, malware scans, automatic patches, Global Edge Security, Managed WAF and DDoS on Enterprise, and an Intigriti bug bounty are all on the record. What is missing is what I ask for first: backup retention, whether a restore is self-service or billed, two-factor login, off-site backup copies and any certification are undocumented on the captured pages. 1 2 3 5
Scaling, migration & exit
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
Getting sites in is well covered: a migration plugin, a manual migration guide, and managed site migrations on the Business tier, with signals for moving up such as traffic above 50k monthly visits. The other half of the story is what lets me sleep. I found no public information on per-plan limits, full export on the way out, domain transfer, cancellation terms or data deletion after termination in the captured pages. 1 2 5
The Small-Business Owner
Migration in is well covered — a site migration plugin, manual migration guides and managed site migrations on Business plans — and the pages name traffic above 50k monthly visits as a signal to move up. I found no public information on published plan limits, on exporting files and mailboxes out, or on cancellation periods and what happens to my data after the contract ends. 1 2 5
The Shop Operator
Moving in is well covered with a migration plugin, manual migration guides and managed migrations from the Business tier, and the Enterprise tier lists always-on options for peak traffic — what my Black Friday needs, though at custom-quoted cost. We found no public information on tariff limits per plan, upgrade or downgrade mechanics, full export including mail, domain transfer out, or cancellation terms; the only sizing signal is a sales hint at "traffic above 50k monthly visits". 1 2 5
The Freelance App Developer
Migration in is well covered — a dedicated site migration plugin, a manual migration guide, and managed migrations on Business plans — with a numeric signal at 50k monthly visits for when to move up a tier. I found no public information on tariff up- and downgrades in the panel, per-tariff resource limits, export of files and databases, domain transfer out, cancellation terms or data deletion; the plans footnote only says taxes and overages may apply and renewal pricing is subject to change. 1 2 5
The Data Protection Officer
Migration in is well covered, with a migration plugin, manual migration guides and managed site migrations on the Business tier, and the page names the signals for moving up a plan. We found no public information on tariff limits, upgrades and downgrades in the panel, export of files and databases with standard tools, domain transfer out, cancellation terms, or the deadline for deleting site data after the contract ends. 1 2 5
The Skeptic
The way in is well documented: a site migration plugin, manual migration guides, managed site migrations on Business and hands-on migration and onboarding on Enterprise, plus a paid WP Migrate add-on for moving databases and media. We found no public information on per-tariff resource limits, upgrades or downgrades in the panel, domain transfer out, cancellation periods, or deletion of data after the contract ends — the entire exit side is dark from a buyer's point of view. 1 2 5
Support, domains & email
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
Chat 24/7 on every plan, phone 24/7 from Business upward, a searchable help centre with developer docs, an agency partner programme, and a dedicated account team on Enterprise — the human side looks right for an agency. No response times are stated per channel. I found no public information on mailboxes, domains or DNS in the same account in the captured pages, so a buyer wanting one login for hosting and mail should check first. 1 2 4 5
The Small-Business Owner
Business plans get 24/7 chat and phone support, the pages promise expert help available anytime, and there is a searchable help centre, developer docs, priority 24/7 support at Enterprise level and an agency partner programme with exclusive benefits. I found no public information on mailboxes with my own domain, webmail or spam filtering, and nothing on response times per channel or support in German, which I would need before signing. 1 2 5
The Shop Operator
Chat runs 24/7 on every plan and phone from Business upward, the help centre is searchable with developer docs alongside, and the Enterprise tier adds priority 24/7 support and a dedicated account team; the agency partner programme advertises benefits. We found no public information on stated response times per channel, help with hacked or broken sites, or mailbox features such as size, aliases and filtering — domains appear only as a support category. 1 2 5
The Freelance App Developer
Around-the-clock support is documented — 24/7 chat on Essential, 24/7 chat and phone on Business, priority 24/7 support and a dedicated account team on Enterprise — alongside a searchable help centre, a support-scope article, developer docs and an agency partner programme. I found no public information on response-time commitments, or on domains, mailboxes and mail features bookable in the same account. 1 2 5
The Data Protection Officer
Chat around the clock on every tier, phone around the clock from Business upward, expert help, a searchable help centre with developer documentation, a dedicated account team and priority support on Enterprise, and an agency partner programme are documented. We found no public information on response times per channel, support languages, or mailboxes with stated size, aliases and spam filtering in the same account. 1 2 5
The Skeptic
Chat is available 24/7 on every plan with phone added on Business, Enterprise adds priority support and a dedicated account team, and there is a searchable help centre, developer docs and an agency partner programme. We found no public information on response times per channel, support languages, or mailboxes, webmail and DNS management, so the email half of this criterion cannot be assessed and the around-the-clock expert help carries no stated time commitment. 1 2 5 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
The contracting entity is WPEngine, Inc. of Austin, Texas, named as data importer in its own DPA, and the company leans on the EU-U.S. Data Privacy Framework with FTC oversight and US-based dispute resolution. A data processing agreement and a sub-processor list page are published, but the captured pages name no data-centre locations or individual subprocessors. European data centre regions are mentioned in passing, yet there is nothing here I could hand a German client as proof of where their data sits. 8 10 11
The Small-Business Owner
The contracting entity is WPEngine, Inc. of Austin, Texas, named as data importer in its own data privacy addendum, with transfers relying on the EU-U.S. Data Privacy Framework under oversight of the US Federal Trade Commission. A privacy policy and a data processing addendum are published, but I found no public information on where the servers and backups sit or which subprocessors are used, so the whole chain stays opaque to a German customer. 8
The Shop Operator
A data processing addendum is published and the vendor acts as processor for end-user data, but the contracting entity is WPEngine, Inc. under a US compliance chain: EU-US Data Privacy Framework certification overseen by the US Federal Trade Commission with a US-based dispute provider. We found no public information confirming data centre locations, where backups are kept, or the subprocessors and their locations, so I cannot verify where my German customers' orders and personal data sit. 8
The Freelance App Developer
The contracting entity is WPEngine, Inc. of Austin, Texas, which certifies under the EU-U.S. Data Privacy Framework with U.S. Federal Trade Commission oversight and names itself as the data importer under its own published data processing addendum, with disputes routed to TRUSTe in the United States. A data processing addendum is available and the vendor description mentions European data centre regions, but I found no confirmed details on an EU contracting entity, an EU representative, or subprocessors and their locations. 8
The Data Protection Officer
The contracting entity is WPEngine, Inc., a US company that presents itself as the processor for end-user personal data, relies on the EU-US Data Privacy Framework under Federal Trade Commission oversight with a US-based dispute resolver, and publishes a data processing agreement. We found no public information among the confirmed facts on where the servers and backups are located, which subprocessors are involved and where they sit, or ISO 27001 or BSI C5 certification of the data centres. For clinics and law firms I cannot clear this chain on these pages alone, as the transfer route runs through a US importer under the Framework rather than a European entity. 8
The Skeptic
The contracting party is WPEngine, Inc. of Austin, Texas, a US company whose Data Privacy Framework compliance sits under the oversight of the US Federal Trade Commission; a data processing addendum is published, the processor and controller roles for end-user data are defined, and the vendor states it does not sell personal information. We found no public information on data centre locations, backup residency, or the subprocessors and their locations, so a European buyer cannot verify where sites and backups sit or which entities in the group can reach them. 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
The plans page lays out what each tier includes — daily backups, 24/7 chat, free SSL and SSH on Essential, phone support and managed migrations on Business — and Enterprise is custom-priced. The fine print says first year pricing is valid for new customers purchasing Essential plans only, product renewal pricing is subject to change, and taxes and overages may apply during checkout. No monthly figure, minimum term or setup fee was captured, and the add-on products carry Buy now buttons without captured prices, so I cannot compute what year two costs — exactly the number an agency like mine plans around. 2
The Small-Business Owner
The plans page works with first-year pricing and coupons 'valid for new customers purchasing Essential plans only', warns that 'Taxes and overages may apply during checkout' and that 'Product renewal pricing subject to change', with Enterprise on a custom quote only. For a firm like mine that needs the same invoice year after year, I cannot compute from these pages what I would pay on renewal, and I found no public information on minimum terms, setup fees or VAT treatment. 2
The Shop Operator
The plans page lists tier features and an introductory first-year price for new Essential customers, but the small print states "Product renewal pricing subject to change" and "Taxes and overages may apply during checkout", and Enterprise is quoted individually as a custom solution. Minimum term, setup fees and the cost of restores, extra backups or migration are not documented on the captured pages, so I cannot compute my real cost over a three-year contract from what I read. 2
The Freelance App Developer
The plans page lists what each tier includes (daily backups, free SSL and SSH, managed WP, PHP and MySQL on Essential; isolated resources, managed migrations and an uptime SLA on Business) and a first-year offer restricted to new Essential customers, but the footnote states taxes and overages may apply during checkout and product renewal pricing is subject to change. Enterprise is custom-priced with no figure listed, and I found no public information on minimum terms, setup fees or renewal prices, so a buyer cannot compute the cost over a contract from these pages. 2
The Data Protection Officer
Tariffs with their included features are published and an introductory first-year offer is disclosed with its restrictions — new Essential customers only, taxes and overages may apply, product renewal pricing subject to change — while Enterprise is priced only on request. We found no public figures for the renewal price, minimum term, setup fees, or the cost of the listed add-ons and restores, so the cost over a contract is not computable from what was captured. 2
The Skeptic
The pricing page shows tier structure, per-tier feature lists, purchasable add-ons and first-year offer conditions — new customers, Essential only, redeemable once, "Taxes and overages may apply during checkout", and "Product renewal pricing subject to change" — with Enterprise priced only as a custom solution. No actual price figure for any plan appears in the captured pages, and minimum term, setup fee, VAT treatment and cancellation terms are undocumented, so the cost over a contract cannot be computed from public pages. 2 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about WP Engine
Is WP Engine European?
No. whats-best.ai classifies WP Engine as Rest of world.
Where does WP Engine store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does WP Engine have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to WP Engine?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: WP Engine alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 23 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (managed WordPress hosting) wpengine.com Checked 1 Nov 2026 Details →
- 2 Pricing page wpengine.com Checked 1 Nov 2026 Details →
- 3 Security / trust page wpengine.com Checked 1 Nov 2026 Details →
- 4 Features page (agency partner programme) wpengine.com Checked 1 Nov 2026 Details →
- 5 Support page wpengine.com Checked 1 Nov 2026 Details →
- 6 API documentation wpengineapi.com Checked 1 Nov 2026 Details →
- 7 Service level agreement wpengine.com Checked 1 Nov 2026 Details →
- 8 Privacy policy wpengine.com Checked 1 Nov 2026 Details →
- 9 Terms of service wpengine.com Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) wpengine.com Checked 1 Nov 2026 Details →
- 11 Subprocessor list wpengine.com Checked 1 Nov 2026 Details →
- 12 Security, backups & recovery — found from sitemap wpengine.com Checked 1 Nov 2026 Details →
- 13 Self-hosting / on-premises installation docs — found from the homepage wpengine.com Checked 1 Nov 2026 Details →