While a site takes a few hundred visits a day, almost any hosting plan will do. The problem appears the day a campaign, a trading season or a well-ranked article multiplies the requests. The server then decides whether your pages appear or your visitors meet an error, and the question stops being the monthly price. It becomes one of architecture.
The four families of offer — shared, VPS, dedicated and cloud — are not a ladder from worst to best. They answer different load profiles, and the wrong choice costs you either money you did not need to spend or availability you cannot buy back. Two further subjects get left until it is too late: where the data sits, and how you get out again.
What hosting actually changes when traffic rises
Hosting acts first on server response time, measured as TTFB (Time to First Byte). Google's documentation treats 0.8 seconds or less as good and above 1.8 seconds as poor, at the 75th percentile of page loads (web.dev, Google documentation consulted in September 2026). TTFB is not a Core Web Vital in itself, but it eats into the one that matters most on load.
The three current Core Web Vitals are LCP (largest element rendered, good at 2.5 seconds or less), INP (responsiveness, 200 milliseconds or less) and CLS (visual stability, 0.1 or less), all at the 75th percentile, mobile and desktop separate (web.dev, Google documentation consulted in September 2026). INP replaced FID in 2024. The consequence is blunt: if the server takes 1.5 seconds to answer, almost nothing is left for a decent LCP.
The reverse is equally true. Excellent hosting does not rescue a bloated theme or a plugin that calls an external API on every page view. The subject has to be worked from both ends, which is the point of a proper website speed exercise.
Shared, VPS, dedicated and cloud: what separates them
Compare them by load profile, not by price.
| Type | Principle | Suits | Main limit |
|---|---|---|---|
| Shared | Hundreds of sites share one machine. | Brochure sites, blogs, modest and steady traffic. | Capped resources and noisy neighbours: a spike turns into 5xx errors. |
| VPS | Isolated virtual machine, guaranteed resources, root access. | Established dynamic sites, staging, internal applications. | Capacity limited to what you rent; administration is yours. |
| Dedicated server | A whole physical machine reserved for your services. | Heavy but predictable load, large databases. | No immediate elasticity, hardware failure to plan for. |
| Cloud | Resources on demand, billed by usage, often across several zones. | Irregular traffic, seasonal peaks, fault tolerance. | Variable bill and operational complexity if nothing is capped. |
One confusion comes up repeatedly: a VPS does not sit above a dedicated server. A VPS is a slice of a machine, a dedicated server the whole machine. At comparable budget the dedicated box gives more raw power, the VPS more flexibility. Cloud stands apart not for power but for elasticity.
According to Eurostat, 52.7% of European Union enterprises with at least ten persons employed bought paid cloud computing services in 2025, 7.4 percentage points more than in 2023 (Eurostat, published 3 February 2026). Those figures cover every use of cloud services, not only website hosting.
A CDN helps, but it is not a host
A content delivery network copies your files to servers spread around the world and serves each visitor from the nearest one. It cuts latency, absorbs part of a spike, takes images, CSS and JavaScript off the origin, and usually adds protection against denial-of-service attacks.
What it does not do, short of advanced configuration, is serve genuinely dynamic pages. Baskets, customer accounts and internal search go back to the origin — and on an online shop, that uncached share is the part that produces revenue. A CDN does not compensate for an undersized backend; it hides the problem until the day it matters.
What to investigate before you sign
Real capacity and elasticity
Plans routinely advertise unlimited traffic or bandwidth. The terms of service almost always add a fair use clause plus limits on concurrent processes, requests per second or disk input and output. Ask what happens when you exceed them — throttling, a 503, extra billing, suspension — and how long doubling capacity takes. In a well-configured cloud, seconds; on a dedicated server, days.
Support and service commitments
A 99.9% SLA allows roughly 8 hours 45 minutes of downtime a year; 99.99% allows about 52 minutes. What matters more is how downtime is defined (does a slow page count?), how it is established, and what the compensation is worth: a credit proportional to the subscription rarely covers the real loss. On support, check the real hours and the contractual time to first response.
Backups: restoring is what counts
A backup is only worth what its restore is worth. Two questions settle the specification: how much data you can afford to lose, which sets the frequency, and how quickly the site must be back, which sets the restore target. Check that backups sit off the production server, include the database, and can be restored by you without raising a ticket. One rehearsed restore a year beats any sales page.
Security and maintenance
The more traffic a site takes, the more attractive a target it becomes. Look at the patching policy, isolation between accounts, the web application firewall and logging. Then check the split of responsibilities: on an unmanaged VPS or dedicated server, operating system updates are yours. That is the most common route to a hacked WordPress site.
Measurement
Insist on access to server logs and load metrics: processor, memory, response time. On the visitor side, follow Core Web Vitals on field data rather than lab scores, and take a baseline before any migration. Log access is also what makes a technical SEO audit factual rather than speculative: server errors show up there first.
Data location, GDPR and the right to leave
The GDPR does not require hosting in any particular country, or even inside the European Union. It regulates transfers to a third country, which must rest on an adequacy decision, standard contractual clauses or another mechanism in the regulation. Hosting or a subprocessor outside the EU counts as a transfer, including where the only exposure is remote access (CNIL, the French data protection authority, on transfers outside the EU). Under the UK GDPR the structure is the same: a transfer out of the UK needs its own legal basis.
For the United States, the European Commission adopted an adequacy decision in July 2023, the EU-US Data Privacy Framework, still listed among its adequacy decisions (European Commission, adequacy decisions). Two earlier arrangements were struck down by the Court of Justice, so keep the point live in your record of processing activities. National schemes can add guarantees for sensitive data — France's SecNumCloud qualification targets protection against extraterritorial legislation (ANSSI, cloud page) — but their scope is national.
The last point is the exit, and it has finally been legislated. The Data Act (EU regulation 2023/2854) has applied since 12 September 2025 and governs switching between providers of data processing services (European Commission, Data Act page). Switching charges remain billable until 12 January 2027, after which Article 29 prohibits them. National regulators may move faster: in France, Arcep capped data transfer charges on switching at zero euros and adopted guidelines on switching charges on 2 July 2026 (Arcep, statement of 2 July 2026). Check what your own provider's offer covers.
A method for deciding
- Measure the peak, not the average. What sizes a plan is requests per second in the busiest hour. If the peak comes from paid campaigns, whoever handles your traffic management knows when it will land.
- Estimate the dynamic share. At identical traffic, a site served from cache and a site where every page is personalised have nothing in common.
- Set your targets. Target TTFB, acceptable data loss, acceptable downtime, maximum monthly budget: four numbers that eliminate half the market.
- Test before you switch. Stand up a copy at the candidate provider and compare response times under comparable load, not on an empty homepage.
- Prepare the exit on the way in. Export formats, access to backups, notice period, migration assistance: put them in the contract while you still have leverage.
One last reflex. If you are changing host because the site is slow, confirm the slowness comes from the server. A badly indexed database, a plugin calling an external API on every render or an over-ambitious theme produce the same symptoms — and will follow the site.
Common questions
How many visitors can shared hosting take?
There is no universal threshold: it depends on page weight, the share served from cache and concurrent requests, not on monthly visits. The warning signs are concrete — 503 errors at peak hours, response time degrading when traffic rises, or an email about excessive resource use.
VPS or dedicated server: which should I choose?
A VPS is an isolated virtual machine on a shared host; a dedicated server is a whole physical machine. At comparable budget the dedicated server gives more raw power and suits heavy but predictable load, while a VPS resizes more easily. Administration falls to you unless the plan is managed.
Can a CDN replace good hosting?
No. A CDN serves static files from a point close to the visitor and absorbs part of a spike, but dynamic pages — basket, account, internal search — go back to the origin server. It reduces latency; it does not fix an undersized backend.
Does the GDPR force me to host inside the EU?
No, it does not impose a location. It regulates transfers to third countries, which need an adequacy decision, standard contractual clauses or another mechanism provided for in the regulation. National qualification schemes can add guarantees for sensitive data, but their scope is national.
What server response time should I aim for?
Google's documentation treats a TTFB of 0.8 seconds or less as good and above 1.8 seconds as poor, at the 75th percentile of page loads. It is not a Core Web Vital in its own right, but it consumes part of the budget you need for an LCP under 2.5 seconds.
Will changing cloud provider cost me exit fees?
Under the Data Act, applicable since 12 September 2025, switching charges remain billable until 12 January 2027 and are prohibited afterwards. Check what your provider's offer covers, since the rules apply to data processing services as the regulation defines them.