HostGator: a Texas host owned by Newfold Digital, cPanel shared hosting and US servers
HostGator is one of the big names in American shared hosting, and its name often comes up in searches by French-speaking readers. Before choosing, you need to know which HostGator we are talking about, where the servers are, how much renewal costs and how good the backups and security are. This article answers based on HostGator’s official pages, without testing on our part, and suggests a safe way to get started.
It is part of our comparison of web hosts for WordPress. Disclosure: we have no account with HostGator, no affiliate links, and HostGator does not pay us.
HostGator at a glance: which HostGator?
This article describes hostgator.com, the American host. According to its “About” page, HostGator started in 2002 and claims Texas roots, in Austin and Houston. Endurance International Group acquired it in 2012, according to the IPO filing Endurance submitted to the SEC. Since February 2021, HostGator has belonged to Newfold Digital, created from the acquisition of Endurance by the Clearlake Capital fund and its combination with Web.com; Newfold also owns Bluehost.
HostGator Brasil (hostgator.com.br) is a different story: a Latin American business of the same group, with its Brazilian headquarters in Florianópolis, its own plans in reais and, since October 2025, servers at Oracle Cloud in São Paulo, according to the Brazilian outlet Baguete. The prices and features in this article do not apply to the Brazilian site.
- Data centers: “most” servers are in Provo (Utah) and Atlanta (Georgia), according to HostGator’s help center, and customers cannot choose. Dedicated servers are presented as hosted in the United States.
- Language: website, interface and documentation in English; we found neither a French version nor support in French.
- Size: HostGator reports more than 2.5 million hosted sites.
For a French site, this is the main point: the data is hosted in the United States, with no option to choose Europe. For a site that processes personal data, this weighs in the GDPR analysis (transfers outside the European Union), to be reviewed with your advisor.
HostGator’s WordPress plans and their prices
Shared hosting (“Web Hosting”) has four plans: Hatchling, Baby, Business and Pro. The “WordPress Hosting” page offers Baby, Business and Pro at the same prices, with reserved virtual CPUs (2 to 5 vCPU). Then come VPS plans, unmanaged or managed, and dedicated servers. The reseller offer is no longer sold to new customers.
Hatchling costs $10.99 per month at renewal ($3.75 as the introductory price, for 36 months). The terms state that plans then renew automatically “at the regular rate”. The table gives that renewal price, shown on each card. Prices are in dollars and excl. tax: VAT is not included and is added for a customer in the European Union.
| Plan | Type | Starting price | Sites | Storage | Key limits |
|---|---|---|---|---|---|
| Hatchling | Shared | $10.99/month (renewal, 36 months) | 10 | 10 GB SSD | About 40,000 visits per month, chat support only |
| Baby | Shared or WordPress | $16.49/month (renewal, 36 months) | 20 | 20 GB SSD | Chat and phone, 2 vCPU in the WordPress version |
| Business | Shared or WordPress | $21.99/month (renewal, 36 months) | 50 | 50 GB SSD | Weekly backups, 3 vCPU in the WordPress version |
| Pro | Shared or WordPress | $29.69/month (renewal, 36 months) | 100 | 100 GB SSD | Weekly backups, 5 vCPU in the WordPress version |
| NVMe 2 to NVMe 16 | Unmanaged VPS | $4.68/month (renewal, 24 months) | Depends on resources | 50 to 450 GB NVMe | 1 to 8 vCPU, 2 to 16 GB of RAM, root access |
| NVMe 32, 64, 128 | Dedicated server | $191.79/month (renewal, term not displayed) | Depends on resources | 1 TB and up | 8 cores and up, cPanel and WHM |
The jump at renewal is significant: Hatchling goes to $10.99 per month ($3.75 as the introductory price), Baby to $16.49 ($4.50). For VPS plans, the page shows several different price blocks for the same configuration: check the amount in the cart.
Technical setup: cPanel, PHP and included tools
| Item | What HostGator documents |
|---|---|
| Control panel | HostGator customer portal and cPanel for hosting |
| Web server | Not named; the PHP version is set in the .htaccess file, which is therefore read |
| PHP | 8.2 by default since June 2023, 8.3 available, set per folder or domain in cPanel |
| Cache | Static content caching and object caching advertised on all shared plans |
| CDN | Cloudflare with Argo Routing |
| HTTP/3 | Not specified |
| SSH, WP-CLI, staging | Included from Hatchling up; SSH limited to the account, port 2222 |
| Support | 24/7 chat; phone from Baby up; in English |
Backups call for the same caution as at Bluehost, with which HostGator visibly shares its policy. HostGator’s help center presents them as a “courtesy” service: only one week kept, for accounts under 20 GB and 100,000 inodes, restore through support for a one-time fee. HostGator recommends CodeGuard, a paid backup service, for important data. In fact, the plan cards only show weekly backups from Business up.
Security at HostGator: promises and documented reality
- Firewall and DDoS: the plan cards advertise a web application firewall and DDoS protection on all plans, without detailing the technology. The Cloudflare CDN adds upstream protection.
- Malware: the cards promise scanning, detection and removal (“AI-powered” from Baby up). The help center more modestly describes a free SiteLock scanner that checks the first five visible pages of the site, without automatic removal; automatic removal and the SiteLock firewall are presented there as paid options. The two sources do not match: ask support what is included.
- Isolation: the help center mentions a “jailed” SSH limited to the account; account isolation is not described further.
- Updates and HTTPS: “managed WordPress updates” and a free Let’s Encrypt certificate advertised.
- Customer account: two-factor authentication by code sent by email, with no documented authenticator app.
Documented incidents
- August 2013: on August 2, the failure of two network switches in a data center near Provo took down a large share of HostGator, Bluehost, HostMonster and JustHost sites during the day, according to Data Center Knowledge. Endurance attributed it to routine network maintenance.
- January 2019: researcher Paulos Yibelo reported a CSRF flaw at HostGator that allowed changing profile data, including the password reset email address, TechCrunch reported. Endurance confirmed the fix, without saying whether it had been exploited.
Other hacks are mentioned on unreliable sites; we found no trace of them in primary sources or recognized press outlets.
To go further: our comparison of web application firewalls for WordPress and our guide to hardening PHP on a hosting account.
HostGator’s strengths and weaknesses
| Strengths | Weaknesses |
|---|---|
| Ten sites from Hatchling up, standard cPanel | Servers in the United States, no choice of data center |
| SSH, WP-CLI and staging from the entry-level plan | Website, interface and support in English only |
| Cloudflare CDN included | Renewal 2 to nearly 4 times more expensive than the introductory price |
| 24/7 chat, phone from Baby up | Courtesy backups, one week, paid restore |
| Full range up to dedicated servers | Plan security promises broader than the help center; two-factor authentication by email |
HostGator and WordPress hosting at Bluehost belong to the same group and look very much alike: same promises, same backup policies. Bluehost, however, offers a French website, prices in euros and data centers in Paris or Frankfurt. WordPress hosting at Hostinger also offers a data center in France and a French website.
Who is it for?
- Site targeting a North American audience: the server location becomes an advantage.
- Freelancer or small agency comfortable with English: many sites per plan, cPanel, SSH and staging.
- Developer: an unmanaged VPS with root access, or a dedicated server with cPanel.
- Less suitable: a French site with personal data, a user who wants support in French, a store without external backups.
Getting started: installing and securing WordPress at HostGator
- Enable two-factor authentication on the customer portal (code by email) and protect the mailbox that receives these codes with its own two-factor authentication.
- Install WordPress from the portal or cPanel, with an administrator username other than “admin” and a unique password.
- Choose the PHP version in cPanel (MultiPHP): 8.3 if your plugins support it.
- Make sure the Let’s Encrypt certificate is active and that the site redirects to HTTPS.
- Set up an automatic external backup following the 3-2-1 backup rule: HostGator’s policy is not enough.
- Test updates and changes on the staging site (why a staging site), and check the file permissions if you move an existing site.
- Close XML-RPC if you use neither Jetpack nor the mobile app (the risks of XML-RPC), and enable two-factor authentication on WordPress.
WP Masquerade on HostGator: compatibility and settings
According to HostGator’s documentation, shared hosting runs cPanel and reads .htaccess files, without naming the web server. Based on how WP Masquerade works, on Apache or LiteSpeed, the plugin folder returns 404 to bots without any setting, thanks to the .htaccess it writes in its folder; check the result by opening the folder’s address, and confirm the server type with support. Pro’s file address aliases require pasting the generated block at the top of the site’s .htaccess, before “# BEGIN WordPress”. On a VPS or dedicated server, you add the rules to your server configuration.
- Cache: HostGator’s static content cache and object cache are not purged by WP Masquerade. Clear the caches after enabling the masking and exclude the new login address from every cache layer; if that cannot be configured, ask support.
- Cloudflare: HostGator’s CDN is Cloudflare. WP Masquerade Pro restores the real visitor address behind Cloudflare in Automatic mode, trusting only the official ranges (see WP Masquerade and Cloudflare and Cloudflare in front of WordPress). Purge the Cloudflare cache too.
- Overlaps: the portal’s two-factor authentication protects the hosting account; WP Masquerade Pro’s protects the WordPress login. Keep both. If you add a security plugin that also closes XML-RPC or moves the login, enable these features in only one tool.
What WP Masquerade adds: fewer WordPress traces for bots, a custom login address with wp-login.php returning 404, XML-RPC closed and, with Pro, two-factor authentication, login limiting and alerts. It is not a firewall, a malware scanner or a backup. Test it on staging first; details per server are on our WP Masquerade compatibility with hosts and caches page.
Our take on HostGator
HostGator offers cPanel shared hosting that is generous in sites and tools (SSH, WP-CLI, staging, Cloudflare) from the entry-level plan. For a French site, its limits weigh heavily: servers in the United States with no choice, everything in English, dollar prices that triple at renewal and courtesy backups. It mostly suits a project focused on North America; otherwise, compare with GoDaddy’s WordPress plans and European hosts.
All the hosts are gathered in our ranking of web hosts for WordPress, and the protection of WordPress itself in our selection of the best WordPress security plugins.
Key takeaways
- HostGator (hostgator.com) is American, owned by Newfold Digital; HostGator Brasil is a separate business with its own plans.
- Servers mainly in Provo and Atlanta, with no choice of data center.
- Introductory prices over 36 months; at renewal, Hatchling costs $10.99 per month excl. tax.
- Courtesy backups: add an external backup.
- With WP Masquerade,
.htaccessis read; behind the Cloudflare CDN, Pro restores the real visitor address.
Sources
- HostGator Help: How Often Are Backups Performed? (external link, opens in a new tab)
- HostGator Help: How Do I Get and Use SSH Access? (external link, opens in a new tab)
- HostGator Help: SiteLock Complimentary Malware Scanner FAQ (external link, opens in a new tab)
Other sources consulted: official pages of the hosting provider and software vendors, trade press articles.
