What Is Included in Managed Hosting

What is included in managed hosting is the list of work the operator does so you do not become the night shift. Monitoring, patching, backups, a restore you have actually run, TLS, and who gets paged at 2am. If those lines are missing from the PDF, you bought a box with a nicer invoice. Ask for the list before you compare monthly numbers.

I run Kief Studio with Brian, from Shrewsbury, Massachusetts. We have been building together since 2012. Our public model is what LTFI is: hire the department, do not install a box. If you and I were on a Zoom with the hosting quote open, this is the translation I would walk before anyone talks price.

What is included in managed hosting, line by line

InMotion Hosting, 22 May 2026, drew a useful floor. Hardware health, uptime, disk, power. OS and kernel patches. Control panel on a stable channel. Network-layer DDoS protection. Hardware replacement. A human who can troubleshoot the box. That is the server layer. It is not the whole company website.

Write six columns. Hardware. Operating system. Application. Content. DNS and registrar. Identity. Then mark who owns each column: you, the host, a freelancer leftover, or a retained operator. Most quotes fill two columns and smile about the other four. Who owns the site, the host, and the login is the same list from the contract side.

Application work is plugins, CMS updates, a broken form on Tuesday. Content is the words and images. DNS is the phone book. The registrar is whose name is on the domain. Identity is who can deploy and how you revoke that key when someone leaves. If the quote says managed and those four still sit in your personal Gmail, the word managed did not move the job.

What is usually extra

Migrations are extra unless the quote says hours and a date. Design is extra. Copy is extra. Plugin archaeology after a freelancer left is extra. A restore test with a date on a page is often extra, which is how you learn the backup was a screenshot of a folder.

Automatic backups without a restore date are a story. Ask for the last successful restore, who ran it, and how long it took. NIST SP 800-34 Rev. 1 treats testing, training, and exercises as a step, not a slogan. I would rather one dated restore than a binder that says daily backups.

TLS certificates expire. Expiry mail has to land in a mailbox someone reads. If that mailbox is the last designer, you will find out on a Monday when browsers start yelling. Put the expiry contact next to the registrar. Walk it once a quarter. Business continuity is architecture is the sibling: a PDF is not a restore.

Questions to put in the RFP

Who monitors the box, and what is the page path at 2am. Who applies OS patches, and on what cadence. Who updates the CMS and the plugins, and who tests the site after. Where do backups live, and what is the last restore date. Whose name is on the registrar, and whose name is on the host invoice. How do you leave with a dump in a week.

Those six questions beat a feature grid. A cheaper monthly number that hides four leftover keys is not cheaper. It is a second job you did not staff. One vendor versus four is the coordination math. Four vendors each think the other one has the certificate mail.

Managed hosting is not the same as owning the workflow

You can rent the box and own the words. You can own the box and still paste customer records into a chat you cannot export. Own versus rent AI is the intelligence version of the same split. Geography is not ownership. Export is ownership.

At Kief Studio the public rule is simple. You keep the registrar. You keep the words. You keep the customer data. We hold the operational login so patch night is not your Tuesday. Clients do not configure the fleet. They get a site that stays up and a person who answers when it does not. Terms live on ltfi.ai. I will not put a price here.

The two-person version of that department is how we run the studio. When a system goes down at 2am, the person who built it is the person who fixes it. kief.dev is the engineering public square. Architecture notes live on briansgagne.com. I write the list. He designs the box the list describes.

A one-page list you can fill at the table

Write the six columns with names, emails, and a last-restore date. If four of the six are the last freelancer, you do not have managed hosting. You have a launch you paid for and a job you kept. Fill the page before you sign. Practice a restore on a quiet afternoon.

I have sat with owners who could show me a beautiful homepage and could not name who patches the CMS. The host dashboard was a personal Gmail. The backup was a folder on someone else's laptop. None of that felt like a crisis until a Saturday. Then it was the only conversation in the room. Price comes after the list. A cheaper number that hides the night shift is not cheaper.

Related reading

• Who owns the site, the host, and the login on a retainer
• What LTFI is, and what you do not install
• Managed website and writing without a ten-person team
• Business continuity is architecture, not a binder
• Partner vetting questions founders skip
• What it costs to leave HubSpot or Webflow

Frequently Asked Questions

What is included in managed hosting for a small business?

At minimum: monitoring, OS patches, backups with a restore date, TLS, and a named person who gets paged. Application updates, content, and the registrar are often still yours unless the quote says otherwise.

Is managed WordPress the same as managed hosting?

No. Managed WordPress is one application layer. The host, DNS, registrar, and identity columns can still be yours, or a leftover freelancer's.

How do I tell a managed quote from a box with a nicer invoice?

Ask for the last restore date, the patch cadence, and who holds the 2am page. If those three are shrugs, you are still the operator.

Should the registrar sit with the host?

No. Keep the registrar in your company email and on your card. A retained operator can hold DNS and deploy keys. They should not be the only name on the domain.

Does hiring LTFI mean I manage the servers?

No. You own name, content, data, and custom code. The studio holds the operational login. You do not configure the fleet.