Every part of the platform
This is the whole thing: the panel you work in, the caching that makes a page fast, the security that is running before your first visitor arrives, and the backups you restore yourself. Almost all of it is on every plan including the smallest — where something starts higher up the range, the card says so.
What you do every day
The panel is ours, and it was written for WordPress rather than adapted to it. Every screen in it does something a WordPress site genuinely needs — and there is nothing in it that does not.
Install WordPress in a minute
Give it a domain, an administrator name, an email address and a password. It creates the database, installs WordPress, requests the SSL certificate and configures the page cache before the login screen is ready for you.
One-click login to any dashboard
Open the WordPress dashboard of any of your sites straight from the panel. Each site keeps its own administrator account, so there is no shared login and no list of passwords to maintain.
Staging, with a way back
Copy a live site to a staging address, make the changes there, and publish them over the live site once they are right. The publish takes a restore point first, so a change that turns out to be wrong is one click from being undone.
On every plan except the single-site plans, WP Starter and Boutique
Clone a site
Duplicate a finished site onto another domain with its theme, plugins, settings and content already in place — rather than assembling the same stack a second time.
File manager
Upload, download, rename, create, compress, extract and set permissions, in the browser. Enough to correct a template or replace a file without setting up an SFTP client first.
phpMyAdmin, already signed in
One click from the panel opens the right database, authenticated. There is no second set of credentials to store, rotate or share with a developer.
A PHP version per website
Every supported version from 8.1 to 8.5 is available, and any single site can be moved between them on its own — so one plugin that is not ready yet does not hold back the rest of the account.
Updates, on your terms
Every out-of-date core, plugin and theme across all your sites in one list, with the option to apply them yourself or let them run automatically. Set it per site: automatic on the brochure site, manual on the one that earns.
Mailboxes on your own domain
Real IMAP mailboxes at your domain, created in the panel, with webmail included. Not forwarding — accounts you can use from a phone or a desktop mail client.
Logs, per website
The access log and the error log for one site, readable in the panel. Usually enough to tell whether an error is coming from the site or from the server before anyone opens a ticket.
Self-service migration
If you would rather not wait for us, point the panel at your existing host and it transfers the site across while you watch it happen.
A temporary address for every site
Every site answers on a HostCrafter address of its own from the moment it is created, so it can be built, reviewed and signed off before your domain points anywhere near us.
Where the milliseconds come from
None of this is a plugin you install and configure afterwards. It is how the server is set up before your site exists.
Our own CDN, in 12 cities
A cache hit at an edge never touches your server at all — the page is already there, in the city nearest the reader. Ours rather than resold, so there is no add-on to buy and no per-gigabyte bill on what it serves. 1 live today, the rest being built.
Multi-level caching
A cached page is answered in milliseconds without starting PHP at all. A caching plugin cannot do that — it has to load WordPress first, and only then decide to serve a cached copy.
Object cache
For everything a page cache cannot hold — signed-in sessions, carts, checkouts — the queries a page repeats are answered from memory instead of going back to the database each time.
On every plan except WP Starter
Compiled PHP held in memory
Your code is compiled once and kept, rather than parsed again on every request. How much is held scales with the plan, so a larger account does not start evicting its own site to make room.
NVMe storage on every node
WordPress reads a large number of small files to answer a single request, and that is precisely the workload where NVMe is furthest ahead of anything else.
PHP workers that are yours
Your site's workers belong to your site. They cost almost nothing while it is idle and start when a visitor arrives, so a quiet site is never subsidising a busy one.
Deliberately uncrowded
We set a limit on how many sites go on a server and stop selling that server once it is reached. It is the least visible thing on this page and it is the reason the rest of it still holds up in month three.
Running before your first visitor
Two layers. The server defends every site on it whether or not you ever open this part of the panel; on top of that you get a rule of your own, per site, which can be stricter than ours.
Attack blocking you set yourself
Per website: how many failed requests one address may make in a minute — anywhere from 4 to 25 — and how long it is then blocked for, from fifteen minutes to a day. Tighten it, loosen it or switch it off for one site without touching the others.
A backstop you cannot switch off
Underneath your own rule, the server blocks addresses that keep failing against any site on it. That layer is not a setting and does not depend on your plan. It is what stops the automated scanner that arrives at three in the morning.
XML-RPC closed, author names not published
Both from the day a site is created. One XML-RPC request can carry hundreds of password attempts, and the public user route in the REST API lists every author's login name — which is half of a working credential, given away. Signed-in users and your own plugins are unaffected.
Malware scanning every night
Every account is scanned nightly, at an hour you choose. Anything found is quarantined rather than deleted, so a false positive costs you a message to support and never a file.
Every site walled off from every other
Its own system user, its own database and database user, its own PHP workers, and its own CPU and memory ceilings. A site that gets busy — or gets compromised — is contained where it is.
Free SSL, and SFTP per site
Let's Encrypt certificates on every domain and subdomain, issued as soon as DNS points here and renewed without anyone being told about it. SFTP is per site, on its own credentials, and each account can only see its own files.
What happens when something goes wrong
Not if — when. What matters then is how long it takes to undo, and whether you have to wait for somebody else to do it.
Nightly backups you restore yourself
Every site, every night, kept for 14 or 30 days depending on the plan. Restore one from the panel yourself instead of opening a ticket and waiting on a reply.
A restore point before anything destructive
The platform takes one automatically before it does something it cannot undo — publishing staging over live, restoring a backup, removing a site — whether or not you thought to take one first.
Free migration, done by us
We rebuild the site here and give you a temporary address to check it on. Your DNS moves only once you have said it is right. Most migrations are finished inside 24 hours.
And the smaller things
- Undo an update that broke something, from the panel
- Change a website's domain without reinstalling anything
- Unlimited subdomains on every plan
- Extra databases, on top of the one each WordPress install is given
- WP-Cron left to WordPress by default, or handed to the server if you prefer
- Bandwidth counted on your own domains only — temporary and staging addresses are not billed
- The theme and plugin file editors, switchable off per site
- SFTP over the standard port, with no FTP or FTPS to leave open by mistake
- 7-day money back, and a renewal price that matches the one you signed up on
Frequently asked questions
Is anything on this page an extra charge?
No. Nothing here is sold as an add-on. Two features start above the entry plans — one-click staging and the object cache — and both say so where they appear. Everything else is on every plan including the smallest.
So what actually changes between plans?
The size of what you are given, not the list of what you can do: how many websites, how much storage, memory, CPU and bandwidth, how many mailboxes and databases, and whether backups are kept 14 days or 30. Plus the two features named above.
Do you use cPanel?
No. We built our own panel for WordPress instead. If you want cPanel for one particular thing it does, ask us on live chat — most of the time our panel does it too, and when it genuinely does not, we would rather tell you that before you buy than after.
Is the security on by default, or do I have to set it up?
On by default. A new website arrives with attack blocking running, XML-RPC closed and its author names hidden from the REST API, and the server's own backstop underneath regardless. The settings in the panel are there to make your rule stricter than the default, or to open one part of it if something you use needs it open.
Managed WordPress, without the guesswork
Pick a plan, or ask us first — we would rather talk you into the right one than sell you the big one.
7-day money back · Free migration · Our own CDN on every plan