The free domain offer almost universally applies to the first year only. Renewal is at the registrar’s standard rate — typically $15–$20/year for a .com. Some hosts charge significantly more than market rate on renewals, so compare the renewal price against registrars like Namecheap or Cloudflare Registrar before assuming the “free” domain is a good deal long-term.

Without domain privacy, your name, address, phone number, and email are publicly searchable in the WHOIS database. Many registrars offer privacy protection as a free add-on, but others — particularly GoDaddy — have historically charged for it. It’s often pre-checked in the checkout cart. ICANN rules don’t require registrars to charge for privacy protection, so if your registrar charges for it, that’s a margin play on their part.

Some hosts renew domains at significantly above-market rates — charging $25–$30/year for a .com that costs $8–$10 at wholesale. This is especially common when you register a domain through your hosting company rather than a standalone registrar. The convenience of having everything in one place has a real price.

Transferring a domain from one registrar to another typically costs about one year’s registration fee — but some registrars make this process intentionally cumbersome. GoDaddy in particular has been criticized for adding friction to outbound transfers. Know your domain’s transfer unlock process before you’re in a time-sensitive situation.

Every website needs an SSL certificate to serve traffic over HTTPS. Let’s Encrypt provides free, automatically renewing SSL certificates that are identical in security to paid alternatives for the vast majority of websites. Yet many hosts upsell “premium” SSL certificates for $30–$100+/year during signup — placed prominently next to a scary “not secured” warning designed to make you click buy. Standard domain-validated (DV) SSL from Let’s Encrypt is sufficient for blogs, business sites, portfolios, and most e-commerce. You only need a paid certificate for specific cases: EV (Extended Validation) certificates for organizations that want the verified company name in browsers, or wildcard certificates not covered by your host’s Let’s Encrypt integration.

Backups are not optional — they’re essential. But many shared hosting plans advertise backups loosely, then reveal in the fine print that “backups” means weekly snapshots that you can only access if you pay for a restore. Daily automated backups — the genuinely useful kind — are frequently sold as an add-on. The backup upsell is often presented during checkout as a pre-checked option, relying on inertia to get it added to your cart without deliberate choice.

Some hosts take a particularly frustrating approach: they create backups automatically, but charge you to access or restore them. The backup creation is marketed as a feature; the restoration is the monetization. This is especially common on budget shared hosting. Having a backup that costs $150 to restore is nearly as useless as having no backup at all — you won’t use it except in a true emergency.

Many hosts offer one free migration when you sign up — but that offer often has strict limits: one website, WordPress only, sites under a certain size, or within a specific window after account creation. Additional migrations, or migrations that don’t meet those criteria, can cost $50–$150 per site. If you’re moving multiple sites or a large WooCommerce store, this adds up quickly and is rarely disclosed prominently.

Cloud hosting providers (AWS, Google Cloud, Azure) charge egress fees — fees for moving data out of their infrastructure. For large websites with significant media libraries, switching cloud hosts can cost hundreds of dollars in data transfer fees alone. This is less of an issue with traditional shared hosting but becomes a serious consideration on cloud platforms or object storage (S3, Google Cloud Storage).

“Unlimited bandwidth” is one of the most misleading claims in web hosting. No host can literally offer unlimited bandwidth — servers have physical limits. What “unlimited” actually means is: you won’t be charged per GB, but you will be throttled, suspended, or forced to upgrade to a more expensive plan if you consistently exceed what they deem acceptable usage for a shared plan. This threshold is never clearly defined, which is the point — it gives hosts flexibility to act when economically convenient.

An inode represents a file or directory on the server. Many shared hosting plans cap the total number of files you can have — commonly 100,000–250,000 inodes. This sounds like a lot until you realize that a typical WordPress installation with a few plugins and a year of uploads can approach 50,000 inodes, and a WooCommerce store with product images can blow past 250,000. When you hit the limit, you can’t upload files or receive emails. The solution offered is, of course, an upgrade.

On shared hosting, all sites on a server share its CPU and RAM. If your site experiences a traffic spike or runs a resource-intensive process (large WooCommerce product imports, complex database queries), your host may throttle your site’s performance or temporarily suspend it to protect other users on the shared server. This is usually not disclosed as a cost — but the practical consequence is either degraded performance or pressure to upgrade.

Many plans that advertise “unlimited email accounts” mean unlimited basic email accounts — webmail accessible through a browser, with limited storage, no mobile sync, and no proper IMAP support for apps like Outlook or Apple Mail. Professional email (Google Workspace, Microsoft 365) is a completely separate product that costs extra. This is often only discovered after signup when the customer realizes their “$3/month” hosting doesn’t include functional business email.

Basic hosting email accounts often come with meager storage — 250MB to 1GB per mailbox. For anyone receiving attachments or using email regularly, this fills up quickly. When it does, incoming emails start bouncing — the sender gets an error and you miss the message entirely. Storage upgrade costs vary but add meaningfully to the total over time.

SiteLock is the most notorious upsell in web hosting. It’s a website security product that many hosts — particularly GoDaddy, Bluehost, and Hostgator — bundle into checkout as a pre-selected add-on, often with alarming language about malware and hackers. The entry-level SiteLock plan ($2–$3/month) is largely ineffective; meaningful protection requires their more expensive tiers. For WordPress sites, free security plugins (Wordfence, Solid Security) provide comparable or superior protection at no cost.

CDN (Content Delivery Network) integration is sometimes sold as a premium add-on, despite Cloudflare offering a free tier that is excellent for most websites. Hosts may present their “CloudFlare integration” or proprietary CDN as a premium feature when the free version of Cloudflare is freely available to anyone, regardless of where their site is hosted.

Hosting checkouts — especially at GoDaddy — are infamous for adding marketing add-ons, website builder upgrades, and SEO tools to your cart without clear opt-in. These range from dubious “SEO starter packages” to email marketing tools you didn’t ask for. They’re designed to be missed, not noticed, during a checkout flow where your attention is on the hosting purchase.

Some hosts advertise “24/7 support” on all plans but quietly reserve fast response times, phone support, or dedicated account managers for higher-tier plans. On the base plan, “24/7 support” may mean a ticket queue with 48-hour response times. If your site is business-critical, this distinction matters enormously — you find out about it when something is on fire and you need help immediately.

Some hosts offer “WordPress management” or “managed WordPress” as a premium tier over standard shared hosting. This bundles plugin updates, security monitoring, and performance optimization — things a savvy user handles themselves with free tools, but which genuinely add value for non-technical users who want someone else responsible for keeping the site running.

Most hosts advertise a “30-day money-back guarantee,” but this typically only applies within the first 30 days of your account. If you sign up for a 36-month plan and want to leave at month 18, there is usually no refund for the remaining months — you’ve already paid for the full term. Some hosts offer prorated refunds on longer terms, but many don’t, and the policy is buried in the Terms of Service rather than stated in the plan comparison page.

If you registered your domain through your hosting company and then cancel or have your account suspended for non-payment, the domain may be suspended or locked along with the hosting account — even though domains are technically separate from hosting. This can take your site offline instantly and requires a support interaction to resolve. The situation is especially problematic if you rely on that domain for email.

Most hosts auto-renew plans by default. The renewal charge — at the full, non-promotional rate — hits your card with varying amounts of advance notice. Some hosts send renewal reminders 30–60 days ahead; others send 7-day notices. If you’ve forgotten the renewal is coming (especially on a 3-year plan), the charge can be a significant and unexpected hit to your account. Getting a refund after an auto-renewal is often possible within a short window, but not always.