WordPress hosting vendor due diligence is the set of written questions you put to a host before signing. It covers how backups get restored, how fast plugin patches land, who can log in as admin, how incidents escalate, where data lives, what the SLA excludes and how you leave. The hosts that answer in writing are the ones worth shortlisting.
What is WordPress hosting vendor due diligence?
It's the part of a vendor review that checks how a host handles the specific ways WordPress sites fail: plugin flaws, shared admin accounts, broken restores and expiring domains. A generic SaaS security questionnaire covers insurance and policies. It rarely asks who can restore one brand site at 6 p.m. on a Friday.
Most procurement teams already own a vendor questionnaire with 150 or more rows. It asks about encryption at rest, business continuity plans and insurance limits. Those rows still matter. The gap is that a WordPress site is a stack of third-party code that changes every week, and the risk sits in that churn. If you want a baseline for what a managed host is supposed to cover before you start comparing, our explainer on what managed WordPress hosting covers in 2026 lays it out.
One rule for the whole process: if a host claims a certification or an audit report, ask to see the report. A logo on a pricing page is a marketing asset. Hold every host, us included, to what it has published and what it will put in the contract.
Why WordPress host due diligence matters to whoever signs off
A host's answers turn into your answers the first time something breaks. When a brand site gets defaced, your CFO or general counsel will ask who had access, when the last good backup was taken and what the outage cost. If those answers live in three support desks, the person who signed the contract spends the week reconstructing them.
Here is a situation we hear versions of often. A marketing ops lead at a company with nine brands inherits sites spread across three hosts, each bought by a different team over six years. One site is defaced on a Friday. On Monday the CFO asks three questions. It takes the lead, an internal developer and an outside agency around 25 hours to answer them, because each host stores logs differently and one keeps none at all. At a blended $95 an hour, that's $2,375 in staff time before anyone counts lost leads or the brand damage.
The vendor side of this risk is growing. According to Verizon's 2025 Data Breach Investigations Report, third-party involvement in breaches doubled to 30% year over year. Your host is a third party with root access to every site you put on it. That's why the questions below belong in the contract stage, and why our enterprise WordPress hosting page leads with audit logs and access control rather than speed scores.
How are backups restored and tested?
Ask how a restore works, who triggers it, how long it takes for one site, and when the host last ran a full test restore. Frequency and retention matter, but a backup that has never been restored is an untested assumption. You want a date, a named process and a restore time you can plan around.
The follow-up questions that separate hosts:
- Are backups stored on a different server, and ideally a different provider or region, from the live site?
- Can you restore one site, or only the database, without touching the other sites on the account?
- Can your team trigger a restore from a portal, or does it need a support ticket?
- How long are backups kept, and can you keep a specific snapshot longer for legal or audit reasons?
The off-server question is the one people skip. We've written about a host's support team deleting every client site on a server, and the backups lived on the same machine. For the full picture of what a backup plan should cover, including retention and restore drills, see our guide to WordPress backup strategy.
How fast does the host patch a critical plugin flaw?
Ask what happens in the first 24 hours after a critical plugin vulnerability is published. A good answer names a mechanism: a firewall rule that blocks the exploit before an update exists, a tested update pushed to affected sites, or both. "We recommend you keep plugins updated" means the patching is your job.
Plugins are where the exposure is. According to Patchstack's 2025 State of WordPress Security report, 96% of the 7,966 new WordPress ecosystem vulnerabilities disclosed in 2024 were in plugins, and only a handful were in core. A company running 20 sites with 25 plugins each has 500 plugin installs to track. Nobody in marketing ops is reading disclosure feeds for all of them.
Ask the host three more things. Do they test updates on staging before pushing them to production? What do they do when a plugin is abandoned or pulled from the WordPress directory? Will they tell you which of your sites run a vulnerable version, by name? Our write-up on how managed hosts handle zero-day WordPress flaws goes into the layers, and a periodic WordPress plugin audit cuts the number of installs you need a host to patch in the first place.
Who has admin access, and how is it logged?
Ask which host staff can reach your sites, what triggers that access, and whether every session is logged where you can see it. Then ask the same about your own side: can you give agencies and contractors scoped roles, and can you remove them in one place when the engagement ends?
According to Verizon's 2024 Data Breach Investigations Report, 68% of breaches involved a non-malicious human element, such as someone falling for a phishing email or making an error. On a multi-site estate, that human element is usually a shared admin password that a former agency still has, or a contractor account nobody removed after a 2022 redesign.
What you're looking for is an access log with names, times and actions that you can export for an audit. "Our engineers only access sites when needed" is a policy statement. A log is evidence. Our enterprise plan includes audit logs and scoped roles for this reason: the ops review needs a record, and the person answering the auditor shouldn't have to piece it together from email.
Does the host enforce two-factor login?
Ask whether two-factor authentication is enforced for every admin account on every site, or only available as an option. Optional 2FA on 30 sites means some of those sites don't have it. Also ask whether the hosting control panel itself requires 2FA, because that account can reach every site at once.
Microsoft reported in 2019 that multi-factor authentication blocks more than 99.9% of automated account compromise attacks. On WordPress, the gap is rarely the technology. It's that each site has its own login, each team sets it up differently, and enforcement depends on a plugin someone installed (or didn't).
The useful question is how 2FA gets turned on across an estate. If the answer is "install a plugin on each site," budget the hours to do it and the hours to keep it updated. We added two-factor login as a single switch in the TopSyde portal so it can be enforced per site without another plugin to maintain.
What happens during an incident, and who escalates?
Ask for response times by severity, the escalation path with roles named, how you'll be notified, and whether you get a written incident report afterward. Also ask whether malware cleanup is included or billed per incident. Many hosts quote a fast first response and a slow, paid fix.
Separate detection from response when you ask. Detection is monitoring: how the host knows a site is down, slow or serving injected spam before a customer tells you. Our guide to WordPress uptime monitoring and incident response covers SLA targets and status pages, and AI-powered WordPress monitoring explains what goes beyond a basic ping.
For reference, here's how we word ours. Monitoring runs 24/7. A site-down ticket is answered within 15 minutes, 24/7. Other tickets get a response in under 2 hours during business hours. Malware detection and removal runs through TopSyde Sentinel, our AI malware engine, as part of hosting. Whatever host you choose, get the equivalent in writing and check that the contract and the marketing page say the same thing.
Where does the site data live?
Ask which country and region hold the live servers, the backups and any CDN caches, and which subprocessors touch the data. Universities, public bodies and regulated companies often have residency rules. A host that can tell you where the server is but not where the backups go has only answered half the question.
WordPress collects more personal data than people expect: contact form entries, comment authors, WooCommerce orders, newsletter signups, even spam that a filter holds for review. Our form spam protection, for example, holds blocked submissions for 30 days so a real message isn't lost. That's personal data sitting on a server, and your privacy team will want to know which country it's in.
If residency is a hard requirement, ask whether you can pin a region per site and whether that pin covers backups. Our post on keeping a Canadian site's data in Canada walks through the questions in detail.
What does the uptime SLA exclude?
Ask for the uptime percentage, how it's measured, the full list of exclusions, the credit you receive, and how you claim it. The exclusions decide what the number is worth. Scheduled maintenance, DDoS attacks, DNS problems and anything "caused by customer code" are common carve-outs.
The math is short. A 99.9% monthly SLA allows about 43 minutes of downtime before any credit applies. A 99.5% SLA allows about 3.6 hours. Credits are usually a percentage of that site's monthly fee, so a day-long outage on a $30/mo plan might return a few dollars. We break down the fine print in your uptime guarantee allows 43 minutes down a month.
Two follow-ups matter for procurement. Is uptime measured by the host's own monitor or an external one? And does the credit require you to file a claim within a short window, often 30 days? Our terms are public on the TopSyde SLA page, which is the format you should ask every host for.
How do you leave with your data?
Ask how you get a complete copy of every site, in what format, at what cost and how quickly. Then ask who controls the domains and DNS, how long data is kept after you cancel, and what happens if the host is acquired or shuts down. Exit terms are cheapest to negotiate before you sign.
A full export means files, database and media for each site, in standard formats any WordPress host can import. Watch for hosts that hold domains in their own registrar account, charge a migration-out fee, or delete data the day a contract ends. The worst case is the one in when your web host shuts down, the site goes with it, where owners had no off-host copy at all.
Keep your domain registrar separate from your host if you can, and keep at least one recent backup somewhere you control. Then a bad vendor relationship becomes a project rather than an outage.
WordPress host due diligence scorecard
Use this to score each shortlisted host. Ask for every item in writing, and weight the rows your auditors or legal team care about most.
| Question | Weak answer | Strong answer | Ask for in writing |
|---|---|---|---|
| Backups and restores | "Daily backups included" | Off-server copies, per-site restore, dated restore test | Restore time per site, retention period |
| Plugin patching | "Keep your plugins updated" | Firewall rules plus tested updates within a stated window | Process for critical disclosures |
| Admin access | "Engineers access only when needed" | Exportable log of every staff session | Sample audit log |
| Two-factor login | "Available via plugin" | Enforced per site and on the control panel | How enforcement is applied |
| Incident response | "Contact support" | Response times by severity, named escalation, written report | Escalation path, cleanup costs |
| Data location | "US data centers" | Region per site, including backups and subprocessors | Subprocessor list |
| Uptime SLA | "99.9% uptime" | Measurement method, exclusions and credit terms published | Full SLA document |
| Exit | "Contact us to cancel" | Free full export, retention window, DNS stays yours | Export format and timeline |
How does TopSyde answer these questions?
We publish our answers so your team can check them before the first call. Pricing starts at $89/mo per site, per-site rates drop as you add sites, and monthly plans start with a 30-day free trial, and yearly plans carry a 30-day money-back guarantee. For the ops review, our enterprise plan adds audit logs, scoped roles and monthly reports.
Here's where each answer lives:
- Spec sheet. The TopSyde spec sheet covers backups, data location, resources and what's included per site.
- Stack. Our hosting stack lists the security layers, including firewall, two-factor login and TopSyde Sentinel for malware.
- SLA. The SLA page has the uptime terms, exclusions and response times, including the 15-minute, 24/7 answer on site-down tickets.
- Enterprise. The enterprise page covers audit logs, scoped roles for agencies and contractors, and the monthly reports you can hand to whoever runs the vendor review.
If your sites are spread across several hosts today, the usual path is to move one or two lower-risk sites first, check the restore and reporting process against your questionnaire, then plan the rest. Send us your vendor questionnaire and we'll answer it in writing, or see pricing to start with one site on the 30-day free trial.
Frequently Asked Questions
What should a WordPress hosting due diligence questionnaire include?
At minimum, it should cover backup restores and testing, plugin patch speed, admin access logging, two-factor enforcement, incident escalation, data location, SLA exclusions and exit terms. Add these to your standard vendor questionnaire, since generic SaaS forms rarely cover WordPress-specific risks. Ask for every answer in writing so it can go into the contract.
How often should a WordPress host test backup restores?
Ask the host to restore a real site to a staging environment at least once a quarter and give you the date and the time it took. Your own team should run a test restore of a critical site at least once a year. A backup that has never been restored can't be counted on in an incident.
Does a WordPress host need SOC 2 to pass a vendor review?
That depends on your organization's policy, and plenty of managed WordPress hosts don't hold one. If a host claims a certification or audit report, ask to see the report itself, often under NDA. Either way, the WordPress-specific questions on restores, patching and access logs tell you more about day-to-day risk.
How do I compare hosts when our sites are spread across several providers?
Send the same written questionnaire to every current host and every shortlisted one, then score them on a single table like the scorecard above. Gaps show up quickly when the answers sit side by side. Consolidating onto one host also gives you a single access log and one escalation path, which shortens the answer the next time leadership asks what happened.
Founder & Lead Developer
20+ years full-stack development, WordPress, AI tools & agents
Colton is the founder of TopSyde with 20+ years of full-stack development experience spanning WordPress, cloud infrastructure, and AI-powered tooling. He specializes in performance optimization, server architecture, and building AI agents for automated site management.
