The word managed needs a written boundary.
Every website runs somewhere, but infrastructure alone does not decide who watches it, releases updates, restores data or communicates when something goes wrong. Those are operational responsibilities and they vary between providers.
A useful managed hosting proposal names the systems covered, the routine work included, the route for incidents and the exclusions. It should also explain which service levels are commitments and which are operating aims.
What should managed website hosting include?
At minimum, expect a clear hosting environment, secure deployment route, domain and certificate responsibilities, monitoring, backup and restoration arrangements, supported software updates, incident reporting, account ownership and an exit process. Any response times, uptime or recovery commitments should be stated precisely in the agreement.
The layers hidden inside a managed hosting plan.
A provider may bundle these layers or price them separately. What matters is knowing where each responsibility sits.
Infrastructure and environments
The production platform, region, runtime, storage and any staging environment should match the website architecture. Record limits, scaling assumptions and who can access configuration.
Domains, DNS and certificates
Someone must manage domain records, renewals and HTTPS certificates without making the business dependent on an inaccessible personal account. Ownership should remain visible.
Deployment and rollback
Changes need a repeatable route from source to production, with checks and a way to return to a known working state. Clarify whether content and code deployments follow different routes.
Monitoring and alerting
Monitoring may cover basic availability, certificate expiry, errors, resource use or performance. The plan should say which signals trigger action and who receives them.
Backups and restoration
Backups should cover the relevant source, content, configuration and data. A separate copy and a tested restore route matter more than a reassuring backup label.
Updates and vulnerability handling
Supported runtimes, frameworks, dependencies and management systems need an update route. Urgent security issues may require a different process from routine maintenance.
Turn broad promises into operating terms.
Words such as secure, monitored and reliable are not measurable by themselves. The agreement should explain the practical service behind them.
Coverage
Name the websites, environments, domains, integrations and software covered. Distinguish the provider's service from third-party platforms it cannot control.
Availability and response
If uptime, acknowledgement or recovery targets are offered, check the measurement window, exclusions, support hours, incident severity and remedy. Do not infer a guarantee from marketing copy.
Security responsibility
Hosting security is shared. The platform, application, accounts, content users and connected services each have controls and owners. Ask how access and changes are recorded.
Communication
A good incident route explains how issues are reported, what updates you receive, who can authorise disruptive action and how the final cause or follow-up work is recorded.
Keep ownership visible from the first day.
Managed should reduce operational burden without making the website impossible to understand or move.
Account access
Record who owns and administers the domain, hosting, source repository, analytics and external services. Use role-based access and remove accounts when responsibilities change.
Data and source
Know how to obtain current source, content, media, database exports and configuration. The exit route should not depend on reconstructing the live site from screenshots.
Recurring costs
Separate provider fees from infrastructure, domain, licence and usage charges. Explain which costs can change with traffic, storage or third-party pricing.
Transition plan
Set expectations for notice, handover, migration assistance, final backups and the date on which monitoring, retention and support responsibilities end.
Questions to ask a managed hosting provider.
Ask for answers in writing and make sure they match the risk and importance of the website to your business.
Infrastructure
Where is the website hosted, which environments are included and who controls the account?
Deployment
How are changes released, tested and rolled back if a deployment causes a problem?
Monitoring
Which availability, certificate, error or performance signals are watched, and who receives alerts?
Backups
What is copied, how often, where it is stored, how long it remains and when restoration was last tested?
Updates
Which software and dependencies are maintained, how are urgent fixes prioritised and what sits outside the plan?
Incidents
How is a problem reported, what information is provided and which response or recovery commitments are contractual?
Ownership and exit
Who owns the domain, source, data and accounts, and how can the service be transferred at the end?
Sources and further reading.
These primary sources inform the guidance above. Your project may need additional legal, security or accessibility advice for its own context.
Vulnerability management: update by default
UK National Cyber Security Centre: Guidance on timely software updates, testing, staged rollout and rollback planning.
Small Business Guide: prepare for incidents
UK National Cyber Security Centre: Guidance on identifying critical systems, making backups and testing that information can be restored.
Buy responsibility, not only server space.
The value of a managed service is the defined operating route around the infrastructure. Ask for the alerts, updates, recovery steps and people behind the label.
Managed hosting questions.
What is managed website hosting?
Managed hosting combines the infrastructure used to serve a website with an agreed layer of operational responsibility. Depending on the plan, that can include deployment, domain and certificate support, monitoring, updates, backups, recovery and a named route for technical issues.
Is managed hosting the same as website maintenance?
Not necessarily. Hosting keeps the website available on infrastructure; maintenance keeps its software, dependencies and configuration current; support handles requests and incidents. A provider may combine them, but the agreement should distinguish each responsibility.
Does a backup guarantee that a website can be restored?
No. A useful backup needs the right data, a separate location, an understood retention period and a tested restoration process. Ask what is backed up, how often, how restore access works and whether recovery has been verified.
Who should own the website domain and hosting accounts?
The agreement should make ownership and access explicit. Businesses should understand who controls the domain, DNS, hosting, source code and third-party services, and how those assets can be transferred if the relationship changes.
What happens when managed hosting ends?
The exit route should cover notice, final charges, transfer of source and data, account or domain access, backup availability, migration assistance and the point at which monitoring and support stop. Agree this before the service begins.