Managed hosting is a form of IT outsourcing, often called managed services. ANSSI, the French national cybersecurity agency, which published a guide on the subject back in 2010, describes companies and public bodies choosing to hand all or part of an IT activity over to a third party. In web hosting, you mostly come across two forms: the managed server, where the host administers the machine you rent, and a managed services contract with a company that runs your servers, wherever they are.
What managed hosting covers
The scope depends entirely on the contract. A common baseline includes installing and updating the operating system and server software (web server, PHP, database), uptime monitoring with on-call staff, backups, firewall management and incident response. Some plans add performance tuning, certificate management or updates to the application itself.
On a VPS or a dedicated server, managed hosting makes up for the main drawback of these options: the administration that falls on you. An unmanaged server can, for example, apply security patches on its own (Ubuntu's unattended-upgrades package does it every day), but nobody is watching the disks, the logs or memory exhaustion.
The risks identified by ANSSI
ANSSI groups the risks of outsourcing into three areas: loss of control over the information system, remote interventions and shared hosting. In practical terms, the provider holds powerful access to your servers; you need to know who connects, from where and how. The guide recommends relying on a security assurance plan, which sets out the provider's commitments.
Contract clauses to check
- Scope: the operating system only, or WordPress and its plugins too?
- Availability and response times: quantified commitments, on-call hours, penalties; see uptime and SLAs.
- Backups: frequency, retention period, storage location, restore tests. A 3-2-1 backup requires at least one copy outside the provider.
- Personal data: when the site handles data of people in the EU, the provider is a processor under Article 28 of the GDPR. The contract must require it to act only on your instructions, to protect the data and to delete or return it at the end of the contract. Our article on GDPR and WordPress security covers these obligations in detail.
- Reversibility: how you get your data, configurations and access back if you switch providers.
For WordPress
A managed server doesn't secure WordPress for you, unless the contract says so explicitly. The provider maintains PHP and the operating system, but a vulnerable plugin, a weak password or a forgotten administrator account are still your problem. Ask who applies WordPress updates, who receives security alerts and who steps in after a hack: the procedure for cleaning up a hacked site requires clear coordination between you and the provider.
Common mistakes
Assuming everything is included, never testing a restore, or sharing a single administrator account with the provider instead of named accounts that can be revoked. Finally, cheap managed hosting that stops at restarting services is no substitute for real operations work.