An agency hosting decision is a portfolio decision. A single site can tolerate a bespoke setup; twenty sites cannot. Every difference in PHP version, plugin stack, backup routine, and access model becomes a support cost that repeats across the portfolio. The host is only one part of the operating model, but it determines how much of that repetition you can automate.
This playbook is for agency owners, operations leads, and technical directors who need hosting to support client work rather than become the work. It covers portfolio segmentation, isolation, access, staging, billing, and the host models that fit each tier.
- Segment by risk. Stores and enterprise clients get isolated infrastructure; brochure sites can share a well-managed server.
- Standardize the stack. A small supported plugin set lowers the cost of every site.
- Own access deliberately. Role-based accounts, documented ownership, and a tested offboarding process.
- Price the labor. Hosting is a pass-through; care plans are a service business.
- Automate the checklist. Updates, backups, uptime checks, and reports should not depend on memory.
- Keep an exit path. For the client and for the agency.
Segment the portfolio before choosing a host
| Tier | Examples | Hosting model | Isolation |
|---|---|---|---|
| A / Revenue-critical | WooCommerce, membership, enterprise brand | Managed production tier or dedicated cloud | Dedicated server/container |
| B / Growth | Lead-gen, content sites with campaigns | Managed plan or 4 GB cloud server | Per-site container or small server group |
| C / Care plan | Brochure sites, low-traffic local businesses | Shared cloud server with per-site isolation | Application-level isolation, separate DBs |
| D / Build-only | One-off projects, client-owned hosting | Client account with delegated access | Per client contract |
A single host rarely fits all four tiers. Many agencies use a managed platform for Tier A, a cloud panel for B and C, and a documented handoff for D. The important decision is not the brand; it is the operating model per tier and the boundary between them.
Isolation is a security decision, not a billing one
One shared server for every client is cheap and convenient until a compromised plugin on a low-value site can read another client's database. Application-level isolation helps, but it is not the same as separate infrastructure. At minimum, separate the database and file system per site, restrict panel access by role, and put the highest-risk clients on their own server.
Backups should be per site, encrypted, and restorable without touching another client. Test a restore on a Tier A site quarterly. A backup that only exists inside the host's account is not an exit strategy; keep an independent copy for the clients who need it.
Hosting is one layer. The agency's margin and reputation depend on the other three.
The host models, by agency type
Cloudways is the value/control choice: a simpler panel, five cloud providers, and low per-server pricing. It is a good fit for agencies with a developer who can manage updates and cache rules, and server-level isolation keeps each client's application separate. It is not a white-label client portal, and support stops at the application boundary.
Kinsta is the managed choice: less operational work, a clean staging workflow, and strong support. It suits agencies that want to spend their time on client work rather than infrastructure, and it is easier to hand off to a less technical team.
WP Engine is the institutional choice: a mature partner network and procurement comfort for enterprise-adjacent clients. Rocket.net is the performance choice for agencies whose clients value speed and edge delivery above platform breadth.
Client access and offboarding
Use role-based accounts, not shared passwords. A client editor should not have server access; an agency developer should not need the client's personal login. Document who owns the host account, who can authorize changes, and who receives incident notifications. If the client owns the account, get delegated access with a named agency role and confirm it survives staff turnover.
Offboarding is a product, not an afterthought. When a client leaves, the agency should be able to export the site, hand over DNS, transfer the host account or provision a new one, and remove access within an agreed window. Put the process in the contract, including unpaid invoices and data retention. A clean exit protects the agency's reputation and reduces the chance of a messy dispute.
Do not let a client's domain, DNS, and host account live in one person's personal email. Use agency-owned service accounts with documented ownership, or client-owned accounts with delegated access. Key-person dependency is an operational risk.
Staging and release discipline
A staging environment is only useful if it resembles production. Standardize the stack, refresh staging from production on a schedule, and test the updates that actually break sites: WooCommerce, page builders, forms, and membership plugins. A visual regression check catches the layout failures that a PHP error log misses.
For Tier A clients, require a staging URL and a rollback plan for every release. For Tier C, a lighter checklist may be enough, but the update process should still be the same shape. The goal is a repeatable release, not a heroic one.
The economics of a care plan
Hosting is a pass-through cost. The care plan is the product: updates, backups, monitoring, security, support, and reporting. Price the labor, not the server. Track hours per site for a quarter, split them into planned maintenance and unplanned support, and set a price that covers the median plus a buffer for incidents.
| Line | Monthly | Notes |
|---|---|---|
| Hosting cost (blended) | $900 | Mixed managed and cloud tiers |
| Maintenance labor (20 sites × 0.5 h × $85) | $850 | Updates, checks, reports |
| Support buffer (10 h × $85) | $850 | Unplanned incidents and requests |
| Delivery cost | $2,600 | Before margin and tooling |
| Care-plan revenue at $250/site | $5,000 | 50% gross margin before tools |
A worked model. The point is to include labor and support in the model; an agency that compares a $28 server to a $250 care plan without counting hours is measuring the wrong margin.
The agency operations dashboard
- Maintenance minutes per site — the cost that scales with the portfolio.
- Staging refresh time — a proxy for release friction.
- Incident MTTR — by tier, with the host vs application boundary noted.
- Backup restore test pass rate — per quarter, per tier.
- Access review completion — clients and team, on schedule.
- Care-plan gross margin — revenue minus hosting, labor, and tooling.
- Client churn and exit time — a clean exit is a retention and reputation signal.
Five agency hosting mistakes
- Putting every client on one server. Cheap until the first cross-site incident.
- Letting each site have a unique stack. The maintenance cost compounds with every client.
- Sharing credentials. No audit trail, no clean offboarding, no accountability.
- Pricing hosting instead of the work. The care plan loses money quietly.
- No exit plan. A client who cannot leave is a client who will eventually sue or complain publicly.
The best host for an agency is the one that makes the repeatable parts boring. If a platform removes a manual step for every site, it is worth more than a cheaper server that adds one. If an operator agency can standardize on a cloud panel, the control and economics can beat a managed plan. Match the model to the team you have, not the team you hope to hire.