Servers & Hosting/Comparison
Shared hosting, VPS or managed: who patches what
Every hosting model splits security work between you and the provider. We compare shared hosting, unmanaged and managed servers, platforms as a service and static hosting by who patches, isolates and restores.
sha256("/servers/shared-hosting-vps-managed/")Most security incidents on small websites are not sophisticated. A plugin went unpatched, a backup never ran, a test login was left open. Which of these lands on your desk depends on the hosting model you choose. Each model draws the line between your duties and the provider's in a different place, and the safest choice is the one where you can actually keep your side of that line.
Five hosting models in brief
Shared hosting puts many customers on one server. The provider runs the operating system, web server, PHP and usually mail; you upload files and manage your CMS. Isolation between accounts depends on the provider's setup, from separate system users and PHP processes per account to container-like cages. You have little control, but also little to patch.
An unmanaged (virtual private server) gives you a virtual machine with root access. The keeps you apart from other customers, which is strong isolation, but everything inside is yours: operating system updates, firewall, SSH, web server, database, backups and monitoring.
A managed VPS or managed server is the same kind of machine with the provider doing the operating system work. Contracts differ widely. Some providers patch only the operating system, others also maintain the web stack and watch for intrusions. Read the service description, not the marketing page.
With (PaaS) you deploy application code, and the provider builds, runs and patches the containers or servers underneath. There is no machine to log in to. You still own your dependencies, your secrets and access to the platform account.
Static hosting serves pre-built HTML, CSS and JavaScript, often through a . With no server-side code and no database, there is very little to attack on the hosting side. The risk moves to your build pipeline and to the accounts that can publish.
How we scored
The matrix rates each model for a small business site or web application. Higher is always better, so a high score for know-how means you need less of it.
- Patching handled for you: how much of the operating system and software stack the provider keeps up to date.
- Isolation from neighbours: how well other customers are kept away from your data and resources.
- Control: how freely you can choose software, versions and security settings.
- Low know-how needed: how little system administration skill the model demands.
- Backups and restore: how much backup work is included and how easy a restore is.
- Small attack surface: how little exposed software you are responsible for.
- Low cost level: relative running cost, without prices.
Shared responsibility at a glance
The UK National Cyber Security Centre describes cloud security as a , and the idea fits every hosting model. One rule holds everywhere: the provider never configures your application, your accounts or your data for you.
| Task | Shared | Unmanaged VPS | Managed server | PaaS | Static |
|---|---|---|---|---|---|
| Operating system and kernel updates | Provider | You | Provider | Provider | Provider |
| Web server and runtime | Provider | You | Depends on contract | Provider (base image) | Provider |
| CMS, plugins, dependencies | You | You | You, unless contracted | You | You (build tools) |
| Firewall and network rules | Provider | You | Shared | Provider | Provider |
| Backups | Provider, check retention | You | Usually provider | Varies, check databases | Your repository |
| Restore test | You | You | You | You | You |
| Accounts, MFA, access keys | You | You | You | You | You |
Provider duties vary by plan. Check the service description, especially for backups and the web stack.
Typical failure modes
- Shared hosting: an outdated plugin, or an old site you forgot in the same account, is used to plant spam or malware in every site of that account.
- Unmanaged VPS: the server runs for two years without updates, SSH still accepts passwords and the database port is reachable from the internet.
- Managed server: you assume the provider covers the application, the provider assumes you do, and the CMS stays unpatched.
- PaaS: an API key is committed to the repository, or a former team member still has deploy rights.
- Static hosting: the publishing account or a CI token is compromised and the site is replaced, or an embedded third-party script is altered.
Isolation deserves a closer look on shared hosting. The NCSC guidance on separation between customers notes that the strength you need depends on whether customers can run their own code. On shared hosting they can, since every account runs PHP or similar, so ask your provider how accounts are separated and keep sensitive data out of cheap shared plans.
Backups: the line people forget
Hosting backups mainly protect the provider's service, not necessarily your data. Check how long they are kept, whether you can restore a single file or database, and whether a restore needs a support ticket. A backup stored in the same account as the site can be deleted by whoever takes over that account.
Keep at least one copy elsewhere, under credentials the hosting account cannot reach, and restore it once in a while to prove that it works. This applies to every model in the table, including static hosting, where the repository and build configuration are what you must not lose.
Choosing the model you can actually run
If nobody on your team will log in to a server every week, an unmanaged VPS is the riskiest option here, however flexible it is. Shared hosting or a managed plan moves the patching to people who do it all day. If your site can be static, static hosting removes most of the attack surface at once. A PaaS suits developers who want to ship code without running servers, as long as someone owns secrets and team access.
On cost, shared and static hosting are usually the cheapest, and many static hosts have a free tier. Unmanaged servers are affordable because you supply the labour. Managed servers cost the most, since you pay for the provider's time, and that time is exactly what a small team often lacks.
The safest hosting model is the one whose duties you can actually keep.
Sources and further reading
General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.
