Your hosting renewal has arrived and it is not the number you remember agreeing to. Or the site went down on a Saturday and nobody picked up. Or an agency you no longer work with still holds the login. Here is the short answer from the other side of it, the side that runs the servers rather than sells them.
A small business website in Singapore is almost never short of server. It is short of somebody doing the work. So judge a host on four things, in this order: who installs the security updates, who takes the backups and whether anyone has ever restored one, how quickly a human answers when the site is down, and how easily you could leave. Shared, cloud and managed, the three shapes you are being asked to choose between, are mostly three answers to those four questions. Storage and bandwidth are the things the plan tables compare, and they are the things a brochure site almost never runs out of.
Two more things worth knowing before you compare plans. The advertised price and the renewal price are two different products, so the number worth comparing is what three years costs, not what the first month costs. And hosting your website in Singapore is a speed and preference decision, not a legal one: under the PDPA what matters is your contract with the host and the protection they give the data, not the country the server sits in. That second point is further down, with the Commission’s own wording, because it is the one most likely to change what you buy.
One thing to declare before any of it. We build and host business websites, so we are not a neutral party here. We have no hosting plan on this site to sell you, no price to quote you and no uptime figure to wave at you, and you will not find a ranked list of hosts below with a winner on it. What you will find is the set of decisions we walk clients through, which is a different thing and a more useful one if you are choosing.
The Singapore prices quoted below are the ones CLDY published on its own web hosting page on 25 September 2026, and they are there as one worked example of how hosting is priced here, not as a recommendation. Every other price moves the same way. Check the live page of whichever host you are actually considering before you act on a number.
What a small business site actually needs from a host
Start by sizing the job honestly, because the plan tables are built to make it look bigger than it is. A company website with a dozen pages, a contact form and a few hundred visitors a day is a light load for any server you would rent today. Storage is very unlikely to be your problem. Nor is bandwidth. The specification column that the comparison tables spend all their space on is the column that matters least to you.
What does run out is attention. Four things decide whether your site is fine in three years, and a host either does them or leaves them with you.
1. Somebody installs the security updates. A WordPress site is a stack of software that gets patched constantly, and the gap between a patch being published and it being applied is the window somebody walks through. Ask a host a blunt question: do you update WordPress, its theme and its plugins, or do you only patch the server underneath them? If the answer is the second, the job is yours. There is nothing dishonest in that, as long as you know it and somebody is doing it.
2. Somebody takes the backups, and somebody has restored one. A backup line on a plan page tells you almost nothing on its own. Ask four things: how old the newest backup is, how long it is kept, whether it is stored somewhere other than the same server, and how long a restore takes. Ask for a restore to be demonstrated once, on a copy, before you need it.
3. A person answers when the site is down. Support is the part of a hosting plan you buy and hope never to use, so it is the part people check last. The question is not whether the page promises 24/7 support. It is what actually happens at 9pm on a Sunday when the site is white and you do not know why: a ticket queue, a chat window staffed by somebody reading a script, or a human who can look at the server.
4. You can leave. The easiest way to end up paying a renewal you resent is to find out at renewal time that leaving is hard. That means knowing who holds the domain name, whether you can download a full copy of the site and its database yourself, and what the contract says happens when the arrangement ends. There is a section on this further down, because it is the one that catches people.
Two of those four are not our opinion of what good practice looks like. Singapore’s Cyber Security Agency sets out the security measures for its Cyber Essentials mark in five categories, and two of the five are Update (“Update software on devices and systems”) and Backup (“Back up the organisation’s essential data and store them separately and securely”). CSA’s own page for the scheme says small and medium enterprises “are also prime targets for cyberattacks”. Your hosting arrangement is what decides whether those two categories are being handled by somebody or by nobody.
Shared, cloud and managed: what actually differs
These three words are marketing labels, not defined technical terms. Two plans carrying the same word can be very different products. So read them as rough families, take the description below as what each word usually points at, and check the specification of the actual plan in front of you rather than the label on it.
What genuinely separates them is not the hardware. It is how much of the work stays with you, and what happens when another site on the same machine has a bad day.
| The label | What you are really renting | Who updates WordPress | It suits | The catch |
|---|---|---|---|---|
| Shared | A slice of one machine that many other websites also sit on, plus a control panel to manage it. | You, or whoever built the site. The host usually patches the server underneath, not the software you run on it. | A brochure site with light traffic, where somebody in-house or an agency already looks after the site itself. | Your neighbours’ load and your neighbours’ security are partly your problem, and support is usually a ticket queue. |
| Cloud | Capacity you can raise without moving the site, usually sold as plan tiers rather than as a machine. | Still you, on most plans, unless the plan says otherwise in writing. | A site with real traffic swings, or one that has already outgrown its plan twice. | On a small plan, “cloud” often buys a bigger slice and a better network, not a different job. Paying for headroom a brochure site never uses is a common overspend here. |
| Managed WordPress | Labour. Updates, backups, a staging copy to test on, and a support desk that knows WordPress specifically. | The host, on a stated schedule. That is the entire point of the shape. | A business with no in-house IT that would rather the work simply happened without being chased. | It costs more every month and saves you nothing visible until the month something breaks. Get what “managed” covers in writing, because the word carries no fixed meaning. Our guide to what a managed WordPress plan actually covers draws that line task by task. |
Read down the third column and you have the real decision. You are not choosing a server. You are choosing whether the update and backup work is bought with the hosting, bought separately, or not bought at all. We sell the middle option as website care, and plenty of businesses are perfectly well served by the first or the third instead. What does not work is assuming it came free with a shared plan.
If you would rather see the choice as a vendor-by-vendor list, we keep one at website hosting providers in Singapore. Read it after you have settled which of the three shapes you actually want, not before, or you will be comparing prices across products that are not the same product.
Does your website have to be hosted in Singapore?
No, not as a rule. The Personal Data Protection Act does not work by postcode, and a Singapore data centre is not the thing that makes you compliant with it.
Two plain definitions first, because the official wording uses both. “Personal data” means information that identifies a person, so the name and email address sitting in your contact form enquiries counts, and almost every business site collects some. A “data intermediary” is the law’s word for a company that handles that data on your behalf, which is exactly what a host does when it holds your website and its database.
Here is what the Personal Data Protection Commission, the regulator, says in its Advisory Guidelines on the PDPA for Selected Topics, revised 23 May 2024, in the chapter on cloud services. Three points, in its own words.
The duty stays yours. When using cloud services, “the organisation is responsible for complying with all obligations under the PDPA in respect of personal data processed by the cloud service provider (‘CSP’) on its behalf and for its purposes”. Putting the site on somebody else’s server moves the machine. It does not move the responsibility.
Your host picks up duties of its own, and they follow the data abroad. Where the provider handles personal data for you under a contract “which is evidenced or made in writing”, it “is considered a data intermediary and subject to the Protection, Retention Limitation and Data Breach Notification Obligations under the PDPA”. The Commission then says those duties “extend to personal data that it processes or hosts for the organisation in data centres outside Singapore”. In plain words: a written contract is what turns your host into a party with its own legal obligations, and those obligations do not stop at the border.
What location does affect is the transfer rule, and that rule is about protection, not geography. An organisation using a provider “is responsible for complying with the Transfer Limitation Obligation in respect of any overseas transfer of personal data”, and the Commission adds that this applies “regardless of whether the CSP is located in Singapore or overseas”. It then describes how an organisation may be taken to have met that duty: by making sure personal data “may only be transferred to overseas locations with comparable data protection laws, or that the recipients (e.g., data centres or sub-processors) in these locations are legally bound by similar contractual standards”.
So the sentence worth taking away is this one. A Singapore server does not make you compliant, and an overseas server does not make you non-compliant. What is being looked at is whether you have a written contract with your host, what protection that contract secures, and whether you took reasonable care choosing the company you handed the data to.
Which turns “must it be in Singapore” into three questions you can actually act on.
- Get the hosting arrangement in writing. Not a sales email, not a WhatsApp thread. The Commission’s duties on a host attach to a contract “evidenced or made in writing”, so without one, you have handed a company your customers’ data on a handshake.
- Ask where the data centres are, including any company your host uses underneath itself, and put the answer into the contract. The Commission’s own worked example is a business that decides which countries it is willing to store data in and “includes a clause in the contract to state so”.
- Ask what the host is certified to. The Commission names two security standards a host can be certified against, ISO27001 and Tier 3 of the Multi-Tiered Cloud Security certification scheme, as things that “could provide assurance of the CSP’s ability to comply with the Protection Obligation of the PDPA”. A host that holds one will tell you in a sentence. A host that goes quiet has answered you anyway.
There is still an honest reason to prefer a server near your visitors, and it is speed rather than law. Every request from a browser has to travel to the server and back, and distance adds time to that trip. Whether it adds enough time for anyone to notice on your particular site is something you can measure rather than assume. So if the site feels slow, test it before you move it and find out where the time is actually going. If it is an oversized image or a heavy plugin, changing the server will not touch it.
Why the renewal costs more than the first year
Because the advertised price and the renewal price are two different products. Sometimes the host prints both numbers on the same page, right next to each other. The second one is the one worth reading.
Take one real Singapore example. On CLDY’s own web hosting page on 25 September 2026, its second cloud web hosting plan was listed at “FROM S$14.4 /MO”, and printed directly beside it were the words “Discounted from S$24/mo”. The two larger plans in the same range carried the same pairing: S$28.80 against S$48, and S$43.20 against S$72. The business tier started at S$18.75 against S$25. That page does not say the higher figure is what you pay at renewal, and neither do we. What it does show is that the host publishes two numbers for the same plan, and that on those three plans the undiscounted number is about two thirds higher than the advertised one. That last calculation is ours, not the provider’s: 24 divided by 14.40 is 1.67.
That is the mechanic to look for. The advertised rate is a discounted rate. Somewhere behind it there is an undiscounted rate, and the two questions that matter are when you start paying it and how much it is. Ask both, of whichever host you are actually considering, and get the answer in writing.
It has a second half that rarely appears on the hosting page at all. A domain name is renewed separately from the hosting, at its own price, by whoever registered it. A first-year offer that includes a free domain includes one free year of it. So a year-two bill can be larger for two unrelated reasons at once, and it is worth working out which of them moved before you take it up with anybody.
Work out the three year cost before you sign anything. It takes about ten minutes and it is the only number that lets you compare two hosts honestly.
- Write down the advertised monthly rate, and find out what term you must commit to in order to get it, and whether that term is payable up front. A rate quoted as “from S$x a month” is often a monthly-looking way of describing one lump-sum bill.
- Ask the host in writing what the same plan costs per month once that term ends. Do not accept “it depends” and do not accept a link to a page that can change.
- Multiply the advertised rate by the number of months the discount actually runs for.
- Add the renewal rate multiplied by however many months are left to reach thirty six.
- Add what is billed separately: the domain renewal, an SSL certificate if it is not included, extra backup storage, and any setup or migration fee.
- Divide the total by thirty six. That is what the plan costs you per month. Compare hosts on that number and on nothing else.
Do it with two hosts side by side and you will sometimes find that the cheaper headline is the dearer plan. That is the number worth arguing about with a supplier, and the first month is not.
When moving host is worth the disruption
A move is about a half day of work and a week of watching, in our hands, so it wants a reason better than a cheaper headline. The reasons that justify it are the four from the top of this page, not the price.
What actually happens in a move is less dramatic than people expect, and it is worth knowing so you can tell whether whoever is doing it is being careful. The files and the database get copied to the new server. The copy is opened on a temporary address and checked properly: the contact form sends, the enquiry emails arrive, anything that takes payment still takes payment, the logins work. Before the switch itself, the setting that tells the rest of the internet how long to remember your site’s current address gets lowered, so the change spreads quickly instead of lingering. Then the address is pointed at the new server, and the old one is left running for a week or two while the last stragglers catch up.
Done in that order, visitors should not see the site go dark, because both copies are live while the change works its way round. The things that break are the quiet ones: a contact form that silently stops delivering, or an email address that lived on the old server and nobody remembered to move. That is why the checking matters more than the copying.
There is one more thing to settle before any of that, though, and it is not technical.
Who owns your domain and your site files?
Ask the question now, while nothing is wrong. It is a much harder conversation to start the week you want to leave.
The confusion is that four separate things feel like one thing, and different companies can hold each of them. They are the domain name, the DNS records that point that name somewhere, the hosting account the site lives in, and the site itself: its files, its database and its backups. A business can own its domain and still be unable to move, because somebody else holds the login to the account it is registered in.
Four questions settle it, and each one has a short answer or a problem.
Whose name is on the domain registration? It should be the company, not an individual who once worked there and not the agency. This is the one that goes wrong quietly, because everything keeps working for years until the day it needs to change.
Who can actually log in to the registrar? Being named as the owner and being able to sign in are two different things. If only one supplier can log in, your ownership is a piece of paper.
Can you take a full copy of the site today, without asking? Files and database, downloadable by you or by someone you appoint. If the answer is that it has to be requested, find out how long a request takes and whether there is a fee, and get that in writing.
What does the arrangement say happens when it ends? The regulator asks this question too. The Personal Data Protection Commission’s Guide to Managing Data Intermediaries lists, among the things an organisation’s contract with a supplier should deal with, the “timely return or irreversible destruction, deletion or anonymisation of the personal data when it is no longer required for the purpose for which it was provided”. Your customer enquiries are that data, and the end of a hosting arrangement is exactly when it stops being required.
The same guide has a worked example that describes a lot of small businesses precisely: an organisation with one IT vendor managing its public-facing website and a second one providing the hosting for it, holding a meeting at the start so both vendors know the scope of what each is responsible for. Among the things the Commission suggests putting on that agenda is “requiring that the IT vendor who provides hosting for the website securely configures and adequately protects the servers and networks against unauthorised access”. If your site is built by one company and hosted by another, and nobody has ever had that conversation, the gap between them is not covered by either contract.
Ask us these four questions too. Any studio worth handing a website to can answer all four in a sentence each, and a studio that cannot answer them has told you something useful.
Questions we get asked
My host says my data is stored in Singapore. Does that make me PDPA compliant?
No, and the two are separate things. Storing data here does not discharge any obligation by itself. The Commission’s guidance puts the responsibility for complying with the PDPA on you, the organisation, for personal data a provider processes on your behalf, and says the rule on sending data overseas applies “regardless of whether the CSP is located in Singapore or overseas”. A local data centre is a fine thing to have. It is not an answer to a compliance question, and a host that offers it as one is not being straight with you.
If my host is hacked and customer details leak, who is responsible?
In practice, both of you, for different things. The Commission’s guidance says the organisation is responsible for complying with all its PDPA obligations for personal data processed by a provider on its behalf, so the duty does not transfer with the server. It also says that a provider handling that data under a written contract is a data intermediary carrying the Protection, Retention Limitation and Data Breach Notification Obligations in its own right. In plain words, the host must protect the data, not keep it longer than it is needed, and tell you if it leaks. In the Commission’s worked examples of exactly this situation, the organisation’s “due diligence in engaging” the provider is taken into consideration when assessing liability, and the provider “may also be liable for breach of its Protection Obligation”. Which is the practical argument for the written contract and the certification question above: they are the evidence that you took care.
My web designer hosts the site and it has always worked. Is that a problem?
Not by itself, and plenty of good arrangements look like this, ours included. It becomes a problem only in two situations, and both are foreseeable. The first is the day you want to work with somebody else, which is the ownership section above. The second is the day something goes wrong out of hours and you discover that the person who can fix it is one individual with a life. Ask what happens if they are on a flight. A one-line answer is fine. No answer is the finding.
Where to start
Open your current hosting invoice and your WordPress update log, in that order. Between them they answer most of this: what you are paying, what term you are committed to, and whether anybody has touched the software this year. Then do the three year sum on the plan you are on, so that whatever you decide next, you are deciding against a real number.
If you would rather work it through with someone, book a short call with us. We will go through what the site actually needs, which of the three shapes fits it, and what the honest cost of staying or moving looks like over three years. If the answer is that your current arrangement is fine, that is a perfectly good result of a call and we will say so. We build and host business websites, so we are worth asking, and we are also worth asking the four ownership questions above before you hand anybody a site.
Sources
- Personal Data Protection Commission, Advisory Guidelines on the PDPA for Selected Topics (revised 23 May 2024), chapter 9: Cloud Services (PDF)
- Personal Data Protection Commission, Guide to Managing Data Intermediaries (2020) (PDF)
- Cyber Security Agency of Singapore, Cyber Essentials
- Cyber Security Agency of Singapore, CSA Cybersecurity Certification: Cyber Essentials mark, V202503, Table 1 (PDF)