Choosing a host: cost, lock-in and support
Reading a pricing page properly, egress and request billing, regional availability, SLA and support terms, portability, and a short evaluation checklist.
The price is not the price
| Line item | How it surprises you | Ask before signing |
|---|---|---|
| Egress | Billed per GB out, and media is all egress | What is the included allowance and the overage rate |
| Requests | Billed per million, and a bot flood counts | Is there a floor or protection against spikes |
| Build minutes | Charged on CI in some plans | Included minutes and the rate after |
| Storage | Snapshots, backups and logs all count | What is included and what is extra |
| Database connections | Pooling is a paid feature | Connection limits per plan |
| Support | Free tier with response measured in days | Response time per severity, and who answers |
| Custom domains | Per-domain or per-certificate charges | How many are included |
| Seats | Priced per developer, not per project | How a contractor is billed |
A quick cost model that survives contact with reality
monthly = plan
+ egress_gb * rate
+ extra_requests / million * rate
+ database plan
+ storage_gb * rate
+ support tier
Do this for the current month and for 10x traffic.
If the second number is not survivable, the architecture is wrong,
not the provider - cache at the edge before you buy a bigger plan.- Egress is the line that turns a cheap plan into an expensive one. A video or image-heavy site should be priced on bandwidth first.
- Per-seat pricing is invisible until you add a contractor. Check it early.
- Free tiers usually exclude the features you need for production: a custom domain, more than one environment, or any support at all.
Lock-in, regions and SLAs
| Question | Good answer | Warning sign |
|---|---|---|
| Can I export my data? | A documented API plus a self-service export | Support has to run it for you |
| Is the runtime standard? | OCI container or a supported language version | A proprietary runtime with custom APIs |
| Where are the regions? | The regions your users and your legal team need | One region, or no data-residency documentation |
| What does the SLA cover? | Availability of the service, with a credit | An SLA that excludes the thing you are buying |
| Who answers support? | A named team with a published response target | A community forum and nothing else |
| How do I leave? | Documented migration path and no exit fee | Long minimum terms or data-hostage behaviour |
| Is there a status page? | One with history, not just current state | A page that has never shown an incident |
An SLA credit is a refund, not a remedy. A provider that credits you a day of hosting after a full-day outage has paid you back the amount that was never the cost. Judge the incident history instead: does the status page show real incidents with real post-mortems?
# check the provider's own infrastructure before you trust it
dig +short NS yourdomain.com
curl -sI https://provider.example/ | grep -iE "server|cf-ray|x-served-by"
whois yourdomain.com | grep -iE "registrar|expiry"Evaluation checklist
- Deploy a throwaway version of your actual application, not a hello world. The build step and the process model are where the fit shows.
- Measure a cold start, a deploy and a rollback. An hour of hands-on time answers more than a week of documentation.
- Break something on purpose: kill the process, fill the disk, remove a permission. See how the platform responds and what the logs look like.
- Run the cost model at 10x traffic.
- Check the terms for data processing and data residency against what your customers require.
- Ask support a real question and time the response. That is the response time you will get during an incident.
- Confirm the migration path out before you commit anything production-shaped to it.
⚠️
Do not choose a host from a benchmark you did not run. Published benchmarks measure a hello world on hardware you will not get, with a network path you do not share. Your own deploy of your own application, timed, is the only number that means anything.
FAQ
Should I use the cheapest option?
Use the cheapest option that meets the availability and support requirements. Saving a month of hosting and losing a day of sales is a bad trade, but paying for enterprise support on a hobby project is also a bad trade.
How many providers should I use?
One for compute, one for DNS, one for the database if it matters. Spreading across five providers is not resilience, it is five accounts to secure and five bills to reconcile.
Related
Hosting models compared: VPS, PaaS, containers and serverless Security hardening, cost control and migrations
Last refreshed 2026-09-18.