Free SSL, daily backups, unlimited websites — what's really included?
Every UK hosting plan page lists the same features in the same order. "Free SSL." "Daily backups." "Unlimited websites." They look identical across ten different providers — but the reality behind each label varies enormously. Here's what you're actually getting.
Free SSL certificate
What's advertised: Secure your site for free — padlock in the browser, HTTPS enabled.
What it usually means: A Let's Encrypt certificate, auto-issued and auto-renewed. This is perfectly good for nearly all websites — the same technology used by millions of major sites. The browser padlock looks identical to a paid certificate.
The asterisks:
- Some hosts still push paid "premium SSL" certificates (EV or OV) aggressively. For most sites, Let's Encrypt is identical from a security standpoint.
- On some hosts, SSL activation requires a manual step from you. If you don't do it, your site launches over HTTP.
- Auto-renewal can fail silently on shared hosting if your domain's DNS isn't pointed at the host. Check that your cert renews correctly.
- Wildcard SSL (covers all subdomains) may cost extra on some plans.
Verdict: Free SSL is genuinely free and genuinely useful. Just confirm it auto-renews and activates automatically.
Daily backups
What's advertised: Your site is backed up every day, included free.
What it varies on enormously:
- Retention period: 7 days is typical; some hosts only keep 1 day. "Daily backups" with 1-day retention means if you notice a problem after 48 hours, the backup is already gone.
- Storage location: On the same server, same data centre, or off-site? The only backup that protects against catastrophic server failure is one stored separately.
- Restore method: Self-service in your control panel (good), or "submit a ticket and wait" (bad). Some hosts charge a fee per restoration.
- What's included: Files only? Files + databases? Email? Confirm all of it is covered.
Verdict: Don't rely solely on your host's backup. Keep your own copy using a plugin (UpdraftPlus for WordPress) or a manual download to local storage. Backups you control are backups you can trust.
Unlimited websites
What's advertised: Host as many domains and websites as you like on one plan.
What it actually means: You can add multiple domains and point them to separate website directories. Technically true — but the resource limits of the plan are shared across all of them.
The hidden constraint: Every extra site you add competes for the same CPU, RAM and storage allocation. Hosting 10 WordPress sites on a £5/month shared plan means each one gets roughly a tenth of the available resources. If any of them get genuine traffic, you'll run into throttling quickly.
Verdict: "Unlimited sites" is a valid feature if you're hosting small, low-traffic projects. For anything with real usage, treat each active site as needing its own plan or a proper VPS.
Free domain
What's advertised: Get a free domain name when you sign up.
The gotcha: The domain is typically free for the first year only. Renewal prices vary: .co.uk domains renew at £8–£15/year from most hosts — but some hosts charge £20–£30+ for domain renewals, padding their margins.
Also check: does the domain registration include free WHOIS privacy? Without it, your name and address are publicly visible in the domain registration record (WHOIS). Most UK registrars now include this free following GDPR, but confirm it.
Verdict: A free domain is useful but check the renewal price before committing. If it's inflated, register your domain separately with a reputable registrar (Namecheap, 123-reg, Mythic Beasts) and just point it at your host.
Free CDN
What's advertised: A Content Delivery Network serves your site faster to visitors globally.
What you usually get: Integration with Cloudflare's free tier, which hosts configure for you. Cloudflare's free CDN is genuinely good and meaningfully speeds up sites for international visitors.
The nuance: Some hosts integrate Cloudflare poorly (caching too aggressively and breaking dynamic content, for example) or use a lesser CDN. "Cloudflare-powered" or "Cloudflare integration" is more meaningful than a vague "free CDN" claim.
Verdict: A real CDN is a meaningful feature. If the host uses Cloudflare or a named enterprise CDN, take it seriously. "CDN" on its own is worth investigating before treating as a differentiator.
Free security / malware scanning
What's advertised: Your site is protected with security scanning, firewalls and malware removal.
The spectrum of what this covers:
- A web application firewall (WAF) that blocks common attack patterns — genuinely useful.
- Passive malware scanning that emails you if it finds something — useful, but you still have to clean it up.
- Active malware removal by the host — a significant benefit, typically found only on managed WordPress hosting.
- DDoS protection — usually Cloudflare-based at the free tier level.
Verdict: A WAF and regular scanning are worthwhile. Understand whether the feature is passive monitoring or active protection. "Security included" without specifics usually means basic scanning only.
One-click installs
What's advertised: Install WordPress, Joomla, Magento or 400 other apps in one click.
What you actually get: An integration with Softaculous, Installatron or a proprietary installer. These work well for initial setup — WordPress is installed and accessible within two minutes. The quality varies in how well they handle updates and staging.
The limitation: "One-click install" does not mean "zero ongoing effort." You still need to keep WordPress and its plugins updated. The installer won't do that for you unless the host specifically includes automatic update management (as managed WordPress hosts do).
Professional email
What's advertised: Email accounts at your domain (you@yourbusiness.co.uk) included free.
What varies: The sending and storage limits (covered in the plan reading guide), and crucially — how good the webmail interface is. Most shared hosts use Roundcube or Horde, which are functional but dated.
If your business depends on email, consider running your domain email through Google Workspace (£4.60/user/month) or Microsoft 365 (£3.80/user/month) and using your host purely for web hosting. The deliverability, interface, and mobile app experience are significantly better.
Money-back guarantee
What's advertised: 30-day money-back guarantee — no risk.
What to check:
- Does the refund cover the domain registration fee? Usually not — domain fees are almost always non-refundable.
- Is it a full refund or a pro-rated refund?
- Some "30-day" guarantees are actually 14 days once you read the terms.
- Is there a minimum cancellation notice period? Some hosts require 30 days' notice, which eats into the guarantee window.
Verdict: Money-back guarantees are useful for testing a host risk-free. Read the specific terms to understand exactly what gets refunded.
The pattern to watch for
The features hosts advertise most loudly are often the ones where the real-world quality varies most between providers. "Free SSL" and "unlimited storage" are safe claims because their asterisks are invisible at first glance. Focus your due diligence on backups, renewal pricing, and support quality — the things that matter when something goes wrong.