Written by 4SYSTEMPublished on Updated on
9 min read
WordPress hosting is chosen based on its compatibility, its limits and your ability to take over the site after an incident. For an association with public pages and members area, also check what changes when visitors connect: a cache intended for the public does not meet all uses. Before subscribing, ask for written responses and a restoration demonstration, not just an âoptimized WordPressâ statement.
Select an offer whose resources, access and backups you understand, then validate its restoration in a separate environment.
Starting from uses and responsibilities
Start with a simple folder: domain name, active extensions, theme, public and private functions, uploaded documents, forms and sent messages. Note the processing operations sensitive to an interruption: connection, membership renewal, publication or export. Also specify who can access the hosting account and who makes the decision to restore.
Describe the moments of solicitation without inventing a traffic forecast: opening of registrations, sending of a communication, simultaneous work of managers. These situations will be used for testing, rather than an arbitrary number of visitors.
Finally determine what you agree to lose in the event of recovery, in particular recent changes to member folders. The following grid constitutes a selection method, not a technical certification nor an official rule of WordPress.
Hosting WordPress: check PHP, database and HTTPS
For the specific offer considered, ask for the PHP version that can actually be activated and the database engine. WordPress recommends PHP 8.3 or higher, MariaDB 10.11 or higher, or MySQL 8.0 or higher, as well as support for HTTPS.[1] A promise of general compatibility does not replace this confirmation.
Check these values ââin the panel and in the system information of WordPress: a version announced for the platform is not necessarily the one assigned to your site.
Then check that your extensions work with the selected version. A PHP selector in the panel is useful if you can test a change and revert to the previous configuration. Also ask what PHP extensions are available and how the host handles retired versions.
For HTTPS, specify the issuance and renewal of the certificate, then check the redirections and the absence of resources loaded in HTTP. Connection encryption does not decide who can view member documents.
Read the shared limits before testing
Shared resource sharing: the word âunlimitedâ therefore does not sufficiently describe the behavior of your site. Have the limits applicable to the account specified: PHP memory, processor, simultaneous processes, disk space, number of files and database connections.
Above all, ask what happens at the limit: slowdown, error, processing stop, notification or support intervention. Message sendings and scheduled tasks should also be documented. An import of members or a backup may fail while public pages remain accessible.
Test the representative functions on a pre-production adapted to the target offer. Check the cache: Custom pages and private documents should not be served as shared public content. Confirm any necessary exclusions. Without a representative test, you have a hypothesis of capacity, not a validation.
Protect the members area and keep usable traces
WordPress recommends that PHP applications run under the account's own user rather than the server's default shared user; ask how this separation is ensured.[1] This measure does not replace the protection of the members area.
Request an explanation of access rights to private files. A downloadable document without authentication by its direct URL remains exposed even if the page which references it requests a connection. Check this URL with an offline browser.
Request access to PHP error logs and web server logs: location, retention period, export and consultation rights. They must allow an incident to be examined without depending solely on support.
For member data, ask for hosting and storage locations, authorized stakeholders and data processing, deletion and restitution clauses. Have this contractual scope examined by your competent representative: a French localization or HTTPS is not sufficient to establish regulatory compliance.
Backup out of account and prove restore
A complete restore of a WordPress site requires the database and files; downloading the site directory generally does not save the database.[2] So ask what is really included: media, themes, extensions, configuration and export of all useful tables.
Specify how the files and the database are associated with the same checkpoint: their consistency counts as much as their presence in the archive.[2]
Distinguish the copy offered by the host from a copy that can be retrieved outside the account. WordPress recommends keeping backups in different locations.[2] For your selection, require that an authorized person can retrieve an independent copy if access to the primary account is unavailable.
A âone-clickâ restore is autonomous only if you have the necessary rights, choose the recovery point and know the overwritten scope. If assistance is mandatory, ask for the contact channel, support times and intervention conditions, without assuming a delay.
Test in an isolated space, with a base separate from production. For a manual restoration, restore the files then import the backup into this database, usual order described by WordPress. If the database connection credentials change, update wp-config.php before any copy execution.[2] Control connection, member rights and media. Keep the date, backup used, actions and anomalies. To then organize regular maintenance, consult the guide maintenance and checks.
The questionnaire to send, with the expected proofs
You can send this message as is: âWe are evaluating your offer for an associative WordPress site with members area. Please respond for the offer in question, distinguishing between included functions, options and support interventions. »
| Item | Question to send | Proof requested |
|---|---|---|
| Versions | What versions of PHP and MariaDB or MySQL can be activated, and what PHP extensions are available? | Documentation of the offer and capture of the applicable setting. |
| Resources | What ceilings and reactions to overruns apply to PHP processing, the database and scheduled tasks? | Written limits and example notification. |
| HTTPS | Who renews the certificate and how to detect a failure? | Procedure and access to monitoring. |
| Insulation and cache | How do you isolate the account and exclude member content from the shared cache? | Technical explanation and settings available for consultation. |
| Newspapers | What logs can we view, export and store? | Anonymized example and access terms. |
| Backups | Are the database and files saved together and exportable outside the account? | Covered inventory, retention, export procedure and independent location. |
| Catering | Can we restore alone in a separate space? If not, how does support work? | Demonstration, required rights and written conditions. |
| Data and output | Where is the data processed, by whom and how to recover it initially? | Contractual clauses and usable export procedure. |
Classify each response as documented, to be tested, or absent. A screenshot shows a setting; only running a test demonstrates that your team can use it.
Decide on a tested folder, not on a label
Apply the checks in this order: PHP and base compatibility, HTTPS and private access, resources and logs, then independent recovery and restore. A blocking incompatibility stops the comparison; an incomplete response calls for additional proof, not a favorable assessment.
Fictitious example: the âAtelier des membersâ association publishes news and reserves documents for members. She is considering a shared one. Public pages are displayed, but the private download remains accessible without connection. The offer is not validated for this use until the effective protection has been corrected and retested.
Another point in the same file: support announces backups, without providing an export outside the account. The association requests an independent copy solution and tests its recovery. It then checks for a member connection, an authorized download and the failure of the same anonymous access on the restored version.
Record the decision: retained, retained under explicit reservation or dismissed, with associated proof, liability and remaining condition. Do not launch the members area while a blockage affecting confidentiality or recovery remains. This decision applies to the scope tested, not to future availability.
WordPress prioritizes updating core, plugins, and themes for security.[4] Assign this responsibility before subscribing.
Frequently asked questions
Can I keep the association's emails with the current host?
Site migration alone does not require moving mailboxes. Identify the service that receives the emails and the corresponding DNS settings before making any changes. Ask who preserves these settings during the hosting change. Check messages sent by WordPress separately: they may use a service other than members' mailboxes.
Can a staging contain the real member data?
To choose an offer, choose a set of fictitious data reproducing the useful functions. If an actual copy is essential, define who accesses it, how it is protected, and when it will be deleted. Also check that this copy does not trigger emails to members or external operations. Pre-production must not become a forgotten second production space.
Does a so-called managed offer cover associative extensions?
Do not deduce the scope of intervention from the word âmanagedâ alone. Ask if the service provider works on your extensions, the theme and conflicts between components, or only on the server. Make it clear who decides on an update and a rollback. Unassigned liability must be clarified before subscription, especially for functions reserved for members.
Conclusion: ask for proof before subscribing
Send the questionnaire to the proposed host, then arrange a trial restoration with the person who will operate the site. Keep the answers and the record in your decision file. If you need to clarify the responsibilities between hosting and operation, you can consult the web services of 4SYSTEM. The objective is to choose an offer that is verifiable and usable by your team.
Sources
- Requirements : WordPress.org (accessed 2026-10-08)
- Backups : Advanced Administration Handbook | Developer.WordPress.org (accessed 2026-10-08)
- Security : Advanced Administration Handbook | Developer.WordPress.org (accessed 2026-10-08)
