The choice of web hosting is rarely based on the displayed price or the number of features listed on a commercial page. It hinges on specific technical parameters, often hidden behind marketing language, and on regulatory requirements that most mainstream comparisons do not address. Here, we detail the points that truly differentiate reliable hosting from hosting that will encounter problems at the first surge in traffic.
RTO and RPO: the backup metrics your host doesn’t highlight
Almost all hosting offers mention automatic backups. This mention is not enough. Two operational indicators allow for a concrete comparison of the quality of a backup policy: RTO (maximum downtime) and RPO (maximum amount of data deemed acceptable to lose).
A host that offers daily backups stored on the same server as your site provides an RPO of 24 hours at best, and a potentially indeterminate RTO if the server goes down. We recommend systematically checking three elements before signing.
- Are the backup copies stored on infrastructure physically separate from the main server? Without geographical separation, a hardware failure can take down both the site and the backups simultaneously.
- Is the retention period documented in the contract? Some offers only keep a single rolling snapshot, making it impossible to restore to a state prior to the previous day.
- Can restoration tests be performed by the client? A backup that has never been tested has no operational value. It should be possible to trigger a restoration in a staging environment.
If you delve into these technical aspects, you will find web hosting tips on Tech Mafia that usefully complement this analysis framework.
NIS2 Compliance and Web Hosting: a contractual criterion
The European directive NIS2 has changed the game for many professional sites. It broadens cybersecurity obligations well beyond just critical infrastructure operators. In France, its transposition was still underway in 2026, but the requirements it imposes are already being applied as a benchmark for good practices in the relevant sectors.
Specifically, the criteria to examine in a host are no longer limited to raw performance. NIS2 requires checking the logging of security events, documented incident management, business continuity, patch management, and supply chain security.
For companies in the financial sector, the DORA regulation adds an extra layer: it requires specific contractual clauses with IT service providers, including the host. Ignoring these obligations when choosing hosting exposes you to concrete legal risks, not just technical ones.
What this changes in the selection grid
We observe that the majority of web host comparisons focus on bandwidth, disk space, and monthly price. These criteria remain relevant, but they are now insufficient for a professional site subject to regulatory obligations. Before comparing offers, you must first determine if your activity falls within the scope of NIS2 or DORA, and then filter hosts based on their ability to provide the corresponding contractual guarantees.
Server Resource Isolation: Shared, VPS, and Cloud Are Not Equal
A shared server shares CPU, memory, and bandwidth among dozens, sometimes hundreds, of sites. The problem is not the principle of sharing, but the lack of guarantee on the minimum resources allocated. A server neighbor experiencing a traffic spike can degrade your site’s performance without you having any leverage.
A VPS guarantees a fixed allocation of RAM and CPU, making it predictable. The cloud adds elasticity: resources adapt to demand, but billing follows. For a site with stable traffic, a VPS often costs less. For a site with marked seasonal peaks, the cloud avoids paying for unused resources for the rest of the year.
Server Location and Latency
A host that offers servers in France reduces latency for a French-speaking audience and simplifies GDPR compliance. The physical location of the data center is not a marketing detail. It directly influences page load times, and thus the site’s SEO ranking.
Maintenance Contract and Technical Support: Read the Real Commitments
Technical support available “24/7” doesn’t mean much if the average response time is not contractualized. We recommend looking in the general conditions for the SLA (Service Level Agreement) that specifies the guaranteed availability rate and the compensations provided in case of failure.
A displayed availability rate of 99.9% corresponds to about eight hours of cumulative downtime over a year. A rate of 99.99% reduces this margin to less than an hour. The difference between these two figures translates directly into lost revenue for an e-commerce site.
- Check if the SLA covers only the network or also the application infrastructure (database, web server).
- Identify the priority support channel: ticket, phone, chat. A host that only offers ticket support with a 48-hour response time is not suitable for a critical site.
- Examine the security patch management policy: does the host apply them automatically, or is it your responsibility?
A reliable host documents its commitments in an SLA accessible before purchase, not in a buried FAQ. If the SLA is not freely consultable, it is a sufficient warning signal to move on to the next offer.
The choice of web hosting boils down to a question of matching your actual constraints (regulatory, technical, budgetary) with the verifiable guarantees of the host. The criteria visible on commercial pages cover only a fraction of the subject. It is the contractual commitments, the testable backup policy, and compliance with current regulatory frameworks that differentiate the offers.
