Business website hosting: what to check

Four elements are often confused. The domain name is your address, registered with a registrar for a renewable period. The DNS zone indicates where to send visitors to the site and messages addressed to your email addresses. Hosting is the server that stores and serves your pages. Email may be with a completely different provider. A single provider can manage several of these elements, but they remain separate accounts and separate access.

Start with the domain’s registrant: it should be your business, not a former employee, a freelancer or an agency. ICANN (new tab) states that a transfer to another registrar can only be initiated by the domain name’s registrant, its administrative contact or someone explicitly authorized to act on their behalf. It adds that a unique authorization code helps prevent unauthorized transfers and that contact information must be kept up to date.

In a fictional example, a Sherbrooke renovation company discovers, when it changes hosts, that its domain is registered in the personal name of the freelancer who designed its first site. The project now depends on that person’s cooperation.

Note the registrar, the account used, the person who receives renewal notices and the expiry date. Turn on automatic renewal with an up-to-date payment method, and store the credentials in a password manager rather than in an old email. If a provider manages your DNS zone, ask them for a complete export of its records.

Email deserves special attention. MX records direct incoming mail; SPF, DKIM and DMARC, recommended by the Canadian Centre for Cyber Security (new tab), help receiving servers recognize legitimate messages from your domain. A DNS change that leaves them out can interrupt incoming mail or hurt the delivery of the messages you send.

At Serafex, hosting covers the website. The domain name is not part of the selected offer; the responsibilities and access tied to it are clarified for each project. The hosting card mentions HTTPS and the transfer of the site, not email. If your mailboxes are with your current host, decide what happens to them before any move.

The HTTPS certificate encrypts exchanges between the browser and your site, and the Canadian Centre for Cyber Security (new tab) recommends enforcing it. Check three things: every variant of your address (with or without “www”, over http or https) leads to a single secure address; the certificate renews before it expires; no image or script is still loaded over http.

For performance, Google describes three Core Web Vitals metrics (new tab). LCP measures loading: the largest visible element should display within the first 2.5 seconds. INP measures responsiveness and should stay under 200 milliseconds. CLS measures visual stability and should stay under 0.1. Google states that these metrics are used by its ranking systems, but that a good result doesn’t guarantee a top position and that the most relevant content remains the priority.

The host mainly influences the server’s response time; images that are too heavy, third-party scripts or unnecessary plugins often weigh just as much. Before blaming your provider, check the Core Web Vitals report in Search Console to find the pages involved. The guide to preparing an SEO audit helps you gather these observations.

Security then depends on updates to the server, the content management system, the theme and every plugin. The Canadian Centre for Cyber Security recommends a patching strategy and multi-factor authentication for all accounts, administrators included. It points out that each plugin enlarges the attack surface and that your organization remains legally responsible for the client data processed on its site, even if it doesn’t host the site itself.

So ask who applies each update, who checks the site afterward and who has administrator access. At Serafex, the maintenance work included, such as updates or any backups, is defined in the agreed scope.

A backup that has never been restored is still a hypothesis. In its guide to backing up your information (new tab), the Canadian Centre for Cyber Security recommends a regular full backup, weekly or monthly, and before any major upgrade. It advises keeping an offline copy, applying the 3-2-1 rule (three copies, on two types of media, one of them off-site) and testing recovery regularly. Ask any host these questions:

• What does the backup contain: files, database, settings?
• How often is it made and how long is it kept?
• Where is it stored, and is it separate from the main server?
• Who can start a restore, and under what conditions?
• Can you get a complete copy of your site yourself?

For the Serafex offer, the fact that hosting is offered as a separate service doesn’t, on its own, let you infer a backup frequency or a quantified availability commitment: these points are confirmed in the agreed scope, as with any provider.

Your forms raise another question: where does the personal information collected through a quote request, a job application or a newsletter sign-up go? According to the Commission d’accès à l’information (new tab) (in French), a business that collects information by technological means must publish a privacy policy in simple, clear terms on its website. The title and contact information of the person in charge of the protection of personal information must also be published on the site.

If messages or backups are kept outside Quebec, the Commission specifies that a privacy impact assessment must come before this communication (new tab) (in French): the communication can only take place if the assessment shows that the information will receive adequate protection, and it must be covered by a written agreement. At the time of collection, also inform people that their information may be communicated outside Quebec. A provider that processes this information for you must be bound by a written contract: confidentiality measures, use limited to the mandate, no retention after it ends. Your business remains responsible for the information it entrusts. It must also keep a register of confidentiality incidents and report to the Commission and to the people concerned those that present a risk of serious injury. The guide Law 25 and your website details what your forms and privacy policy must display.

Take inventory of each form: the fields requested, where submissions go (email inbox, site database, external service), the people who read them, how long they are kept and where the servers are located. Remove unnecessary fields. For a particular situation, rely on the Commission’s resources or on a professional.

Google describes how to move your site to a new host without changing page addresses (new tab). Upload a full copy of the site and test it on a temporary hostname protected by a noindex rule. At least a week before the switch, lower the time to live (TTL) of the DNS records to a few hours. Keep the elements that verify your ownership in Search Console. After the change, monitor propagation and the logs, then shut down the old infrastructure once its traffic has dropped to zero.

Add your own checks: HTTPS certificate active on the new server, forms tested until the message is received, DNS zone copied in full, email records included. Don’t cancel the old hosting or old mailboxes before confirming that everything works. If your page addresses change, the migration is different: the guide to preparing a website redesign explains how to plan the mapping of old addresses.

In a second fictional example, a Trois-Rivières bakery changes hosts on a Friday. On Monday, the site displays, but special order requests no longer arrive: the email records were not copied into the new DNS zone. A checklist would have caught the omission.

Before changing hosts, get a written answer to these questions:

Compare amounts over the same period, taxes included: hosting, domain renewal, email per user and maintenance if it is billed separately. Be wary of an introductory price that is valid for the first year only. Also read the commitment period, the cancellation notice and what happens to your files at the end of the contract.

At Serafex, hosting is offered as a separate service, for each site, with HTTPS and the transfer of the site. Ask for details on what this transfer covers for your existing site. Building a site is a separate offer, quoted for your project. The plans and their terms show these items separately, and the website design, redesign and hosting page describes how the project unfolds. Hosting includes neither a domain, nor ongoing content changes, nor unlimited maintenance.

Let’s review your website hosting together.