With unmanaged hosting, the host gives you a server and you look after everything on it. With managed hosting, the host looks after the server for you: updates, security, monitoring and backups. But here’s what catches most owners out: even “managed” hosting usually stops at the server. Your WordPress plugins, theme and content are still yours to maintain, unless you’ve arranged website maintenance as well.
Key takeaways
- Unmanaged hosting is a bare server. You’re the system administrator.
- Managed hosting covers the server layer: operating system, security patches, monitoring and backups.
- “Managed” means different things at different hosts. Ask for the list in writing.
- Very few hosting plans update your plugins and themes. That’s website maintenance.
- Most small businesses need managed hosting plus a maintenance plan, or one provider doing both.
What is unmanaged hosting?
Unmanaged hosting gives you a server, usually a VPS or cloud server, with an operating system installed. Everything after that is your job: installing the web server, securing it, patching it, setting up backups and fixing it when it breaks. It’s cheap, flexible and ideal for developers and system administrators. For a business owner without that skill set, it’s a risk.
What is managed hosting?
With managed hosting, the host’s team runs the server for you. That usually includes operating system and software updates, firewall and security configuration, server monitoring, backups of the server, and help when the server misbehaves. Shared business hosting and managed VPS plans both fall into this category.
Who does what? The comparison owners need
| Task | Unmanaged hosting | Managed hosting | Website maintenance |
|---|---|---|---|
| Server hardware and network | Host | Host | — |
| Operating system updates | You | Host | — |
| Web server and PHP | You | Host | — |
| Server firewall | You | Host | — |
| Server backups | You | Usually host | Often extra off-site copies |
| SSL certificates | You | Usually host | Checked |
| WordPress core updates | You | Sometimes | Yes |
| Plugin and theme updates | You | Rarely | Yes |
| Checking the site after updates | You | No | Yes |
| Malware clean-up | You | Sometimes, often extra | Usually included or discounted |
| Forms, checkout and content fixes | You | No | Yes |
The gap in the middle column is the problem. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins, and only 6 were in WordPress core (Patchstack). A host can keep the server spotless while an out-of-date plugin leaves the site wide open.
Why do owners assume their host maintains the website?
Because the words are similar. “Managed hosting”, “managed WordPress” and “fully managed” sound like everything is handled. Usually, they mean the server is handled, perhaps with WordPress core updates. The website itself, which is where the risk is, still needs an owner.
The cost of that misunderstanding is real. The ASD put the average cost of a cybercrime report for an Australian small business at $56,600 in 2024-25 (ASD).
Which should a small business choose?
- Unmanaged: only if you, or someone you pay, has real server administration skills and time.
- Managed hosting alone: if you’re confident maintaining WordPress yourself, every month.
- Managed hosting plus maintenance: for most businesses whose website brings in work.
Managed WordPress hosting sits in between, and the details vary a lot from host to host. Our guide to managed WordPress hosting shows what to check. If you’re used to a cPanel-style account, see our explainer on cPanel hosting in Australia too.
Questions to ask any “managed” host
- Do you update WordPress plugins and themes, or only core?
- Do you check the site after updates, and roll back if something breaks?
- Where are backups stored, how long are they kept and who restores them?
- Is malware clean-up included, and how much does it cost if not?
- What are your support hours, and can I phone you?
How we split the job
All our hosting is managed. Our team looks after the servers, security, SSL and backups, as described on our managed hosting page. You can compare tiers on our hosting plans page.
For the website itself, our WordPress maintenance services cover updates, checks, security and repairs. Updates run monthly, with high-risk security fixes weekly, and malware scans run daily. Backups run daily, four times a day or hourly depending on the plan, and are kept for 30 days. Together, there’s no gap.
Frequently asked questions
What is managed hosting?
Hosting where the provider runs the server for you, including updates, security, monitoring and backups. It usually doesn’t include updating your website’s plugins or themes.
Is managed hosting worth it for a small business?
Yes, unless you have server skills in-house. Running a secure server yourself takes ongoing time and expertise.
Does managed WordPress hosting update plugins?
Some do, many don’t, and few check the site afterwards. Ask the host exactly what’s included before you assume.
What’s the difference between managed hosting and website maintenance?
Managed hosting looks after the server. Website maintenance looks after the site on it: plugins, themes, content, forms and security inside WordPress.
Can I start unmanaged and switch later?
Yes, but moving a live site takes planning. It’s usually easier to start managed and keep control of the website through a maintenance plan.
Sources
- State of WordPress Security in 2026, Patchstack
- Annual Cyber Threat Report 2024-25, Australian Signals Directorate, October 2025