BUDGET HOSTING, WITHOUT THE GUESSWORK
Buy the protection that does a job.
Cheap shared hosting can be enough for a small static website. The decision changes when the host also holds customer accounts, orders or sensitive records.
OUR REAL-WORLD BASELINE
Low cost does not mean nothing is included.
The reference Starter plan advertises 15 GB NVMe storage, one CPU core, 2 GB memory, SSL, proactive malware scanning and daily offsite backups. These are advertised plan features, not an independent security audit.
Its annual offer is $31.30 upfront, renewing at an advertised $5.22/month equivalent. The $1.99/month headline requires a three-year initial term ($71.69 upfront), renewing at $4.53/month equivalent. Promotional pricing and rounding may change.
Sources: Hawk Host: Budget shared-hosting reference (external) ↗
Small hosting bill.
Your biggest security improvement may be
one less database to maintain.
When to skip, consider, or budget for help.
| Your situation | Spend decision | What actually helps |
|---|---|---|
| Static brochure + external checkout | Usually skip the bundle | Included HTTPS, strong accounts, clean off-host copy and link checks. Confirm any applicable payment scanning separately. |
| Maintained WordPress | Consider paid help | Someone who patches, tests, restores and removes malware. A WAF is an additional layer. |
| Old or unsupported WordPress | Fund repair first | Update/migrate safely or replace it. A scanner does not fix abandoned code. |
| Store retains customer records | Budget for operations | Managed maintenance, monitoring, access control, independent backups and a response owner. |
| Sensitive clinical records | Change the architecture | Appropriate private services and required agreements; ordinary hosting add-ons do not create a compliant clinical system. |
| Required external PCI scan | Meet the actual requirement | Correct scope and an approved scanning vendor. It need not be sold by your host. |
Sources: WordPress: Hardening WordPress (external) ↗ · PCI Security Standards Council: FAQ 1604: outsourced payments and ASV scans (external) ↗ · HHS: Covered Entities and Business Associates (external) ↗
KNOW THE RENEWAL BILL
Hosting budget sandbox
for 1 year; add-ons excluded
Illustrative budget, not a checkout quote. Excludes domain, tax, design, labor, payment fees and Zoom. Multiyear hosting is prepaid; the first-year equivalent is not the upfront bill.
Ask what “security” includes.
Does the add-on only scan, or does it also remove malware? Does anyone patch plugins? How quickly do they respond? Can you restore an entire account? How long are backups retained? Are backup copies isolated from a compromised login?
A firewall filters some requests. A scanner detects some problems. A backup supports recovery. A managed service supplies labor. These are useful, different things.
A shared account is a shared boundary.
Several sites under the same writable account may affect each other. Do not leave an abandoned WordPress copy beside your new static site. Keeping a separate recovery copy also protects against account loss and a backup that contains the same compromise.
Use SFTP where available, protect registrar and host access, and restrict administrator accounts. “Unlimited bandwidth” is not a promise of unlimited compute or immunity to outages.