Shared hosting makes sense for informational sites or small WordPress sites with little traffic, because it's inexpensive and the provider manages the server. A VPS makes sense when you need guaranteed resources, full control of the server or need to run applications like n8n, databases or custom systems, but it requires someone to manage it. For sites that rarely change, static hosting with a CDN is usually the fastest and most secure option of all.
- On shared hosting, the server's resources are split among many customers.
- A VPS gives you reserved resources and root access, along with the responsibility of managing it.
- A static site on a CDN is usually faster and more secure than any WordPress site.
- Keep email separate from web hosting: if one fails, the other keeps working.
- The domain and hosting accounts should be in your company's name.
- No hosting plan replaces having your own backups stored off the server.
What hosting is and why there are so many types
Hosting is the server where your site's files live, along with the database and applications if there are any. When someone types your domain, that server responds. Hosting types differ in three ways: how many resources are reserved for you, how much control you have and who handles maintenance.
Most small businesses in Mexico start with shared hosting because that's what gets sold alongside the domain. For many sites, that's fine. The trouble starts when the site grows, when features are added that the hosting doesn't handle well, or when nobody ever checks the PHP version or the backups.
Choosing hosting isn't about picking the cheapest or the most powerful; it's about picking the one that matches what your site does today and who will maintain it. That second question matters more than it seems.
Comparison: shared, VPS, managed and static
| Type | How it works | Pros | Cons |
|---|---|---|---|
| Shared | Hundreds of sites on the same server, with a cPanel-style control panel | Inexpensive, no technical administration, email and SSL included | Shared resources, process limits, little control, variable performance |
| VPS | A virtual machine with reserved CPU, RAM and disk | Stable performance, root access, you can install whatever you need | You or your provider must handle security, updates and backups |
| Managed WordPress | Servers optimized for WordPress only | Caching, updates and backups included, specialized support | WordPress only, plugin restrictions, costs more than shared |
| Static with a CDN | HTML files served from a global network, such as Netlify or Cloudflare Pages | Very fast, almost no attack surface, scales effortlessly | No database or admin dashboard; forms handled through external services |
| Cloud (AWS, Google Cloud, Azure) | Flexible pay-as-you-go services | Scale, lots of options, regions in Mexico | High complexity, hard-to-predict billing |
There's one more: the dedicated server, an entire physical machine just for you. For a small business, it's rarely justified over a properly sized VPS.
When shared hosting is enough
- An informational site with a few pages: services, contact, location.
- A simple WordPress site with low to medium traffic and few plugins.
- Nobody on your team or at your vendor is going to manage a server.
- You don't need to run additional applications.
If you go with shared hosting, make sure the provider offers currently supported PHP versions, a free SSL certificate, isolation between accounts so a neighbor's infection can't reach you, automatic backups and servers with good latency to where your customers are. One detail few people check: the per-account process and memory limits. When your site hits them, it doesn't go down completely, but it slows to a crawl right when traffic peaks, such as during a Buen Fin or Hot Sale campaign (Mexico's biggest online shopping events, similar to Black Friday).
When you need a VPS
- Applications beyond the website: n8n for automation, an in-house CRM, a custom system with a database, an API.
- Stable performance for an online store with steady traffic.
- Control over versions and configuration: a specific PHP version, Node.js, Redis, job queues.
- Several projects that are best kept together and isolated with containers.
- Data you want on your own infrastructure for compliance or confidentiality reasons.
We use VPS servers with Docker to run self-hosted n8n, custom systems and client databases, with encrypted backups sent to a different provider. We explain why n8n benefits from its own server in the guide to n8n vs. Zapier vs. Make, and for in-house systems, see our software development service.
The hidden cost of a VPS: managing it
An unmanaged VPS is riskier than shared hosting. With root access, everything is your responsibility:
- Security updates for the operating system and installed software.
- A firewall that leaves only the necessary ports open.
- SSH access with keys, with no password login and no login as the root user.
- SSL certificates with automatic renewal, for example through Let's Encrypt.
- Monitoring of uptime, disk, memory and CPU, with alerts.
- Automatic backups stored off the server, with test restores.
If you don't have someone to do this, there are managed VPS plans where the provider handles the basics, or you can hire out the maintenance. What doesn't make sense is getting a VPS "because it's better" and leaving it unattended. For backups, follow the rule in the guide to business backups.
The option many people overlook: the static site
For websites of service businesses, professional firms, clinics, builders or restaurants, which update their content a few times a year, a static site is often the best option. It's generated as lightweight HTML, CSS and JavaScript files and served from a content delivery network (CDN) with servers in many cities.
- Speed: there's no database to query on every visit, which helps a lot with the metrics in the guide to Core Web Vitals.
- Security: with no exposed admin dashboard or plugins, most of the typical attacks on WordPress disappear.
- Low running costs and the capacity to handle traffic spikes without changing plans.
Forms are handled with external services like Formspree or with automations that send the lead to WhatsApp or the CRM. Content is edited from data files or a serverless content management system. That's how we build sites in our web development service, including the rescue of Hidrantes y Rociadores del Norte, which went from a hacked WordPress site to a static site with zero incidents over the following 12 months.
Email and domain: keep them separate from hosting
Many businesses have their email on the same shared hosting as their website. It works until something breaks: if the site is hacked and the server starts sending spam, your legitimate email lands in your customers' spam folders; if you switch hosting providers, migrating mailboxes is a headache.
- Email on a dedicated service, such as Google Workspace or Microsoft 365, with SPF, DKIM and DMARC configured.
- Domain at a reliable registrar, in your company's name, with auto-renewal and two-step verification.
- Managed DNS on a service like Cloudflare, which can also act as a CDN and firewall.
That way, changing web hosts is just a matter of pointing the domain to another server, without touching email. More ways to protect these accounts in the guide to small business cybersecurity basics.
An example from Torreón: separating each piece
An electrical supply distributor in Torreón had everything on a single shared hosting account: the WordPress site with its catalog, email for 18 people and a PHP ordering system a previous vendor had installed there. Every time the ordering system generated heavy reports, the site slowed down and some emails took hours to arrive.
The solution wasn't "bigger hosting," but separating responsibilities:
- The site moved to static hosting on a CDN, with the catalog generated from a data sheet and a quote form that goes straight to WhatsApp.
- Email moved to a dedicated service with SPF, DKIM and DMARC.
- The ordering system and automations were installed on a VPS with containers, monitoring and encrypted daily backups stored off the server.
Each piece ended up on the type of hosting that suits it. If one fails, the others keep working, and the day a provider needs to change, you swap out one piece without touching the rest.
How to choose in five questions
- What runs on the server? Just an informational site: static or shared. WordPress with a store: managed or VPS. Your own applications: VPS.
- How much traffic, and how variable is it? Big spikes favor static with a CDN or reserved resources.
- Who maintains it? Without a technical person, avoid an unmanaged VPS.
- Where is your audience? If it's in Mexico, look for good latency to Mexico or use a CDN; there are already cloud regions in Querétaro. If it's in the US or Canada, pick servers or CDN locations close to them.
- Whose name is everything in? Accounts, domain and access should belong to your company, documented in your password manager.
If you don't know what you have today or whether it's worth switching, the SEO and GEO audit checks your site's speed and technical health in minutes, and the website quote calculator points you in the right direction if you're thinking about a rebuild.
