NZ web hosting and SSL certificates explained
· 7 MIN READ
NZ web hosting explained for business owners: shared vs managed vs cloud, NZ or offshore servers, SSL certificates, backups, email and what to ask a host.
NZ web hosting is one of those decisions most business owners make once, quickly, and then never think about again until something goes wrong. The site goes down, the SSL certificate expires and visitors see a security warning, or a hack wipes out a year of updates with no backup to restore.
This guide explains the types of hosting, whether it matters if your server is in New Zealand, what an SSL certificate is and why you need one, how backups and email fit in, and the questions to ask before you sign up. It is part of our guide on how to make a website in NZ.
What web hosting actually is
Your website is a set of files and, for some platforms, a database. Hosting is the computer, called a server, that stores those files and sends them to anyone who visits. Your domain name points at that server, so typing your address brings up your site.
If you use a website builder like Wix, Squarespace or Shopify, hosting is part of the subscription and you never deal with it directly. If you have a WordPress or custom site, someone has to choose and manage hosting, and that choice affects speed, security and how much maintenance the site needs.
Shared vs managed vs cloud hosting
| Type | How it works | Good for | Watch out for |
|---|---|---|---|
| Shared hosting | Your site shares one server with many others | Small, low traffic sites on a tight budget | Other sites can slow yours down, and security and updates are mostly up to you |
| Managed hosting | The host looks after the server, updates, security and often backups for a specific platform such as WordPress | Business sites where nobody on the team wants to manage a server | Less flexibility, and restrictions on some plugins |
| Cloud hosting | Your site runs on scalable infrastructure from a large provider, often with a global network in front | Custom builds, sites with variable traffic, apps | Needs someone technical to set up and run unless a developer or platform manages it for you |
| Static or edge hosting | Prebuilt pages served from a worldwide network of servers | Modern custom sites that do not need a traditional server | Requires a site built for it |
For most small business WordPress sites, managed hosting is the sensible middle ground. It costs more than basic shared hosting, but it takes the most common causes of hacked and broken sites off your plate. For costs, check each provider's current NZ pricing, and see how much a website costs in NZ for how hosting fits into the bigger picture.
NZ web hosting vs offshore hosting
Data travels at a finite speed, and New Zealand is a long way from most of the world's servers. A server in Auckland responds to a visitor in Christchurch faster than one in the United States, because every request has a shorter round trip. Australian servers are close behind New Zealand ones.
In practice, distance matters less than it used to. Many hosts and platforms put a content delivery network (CDN) in front of your site, which keeps copies of your pages on servers around the world, including in New Zealand and Australia. With a good CDN, a site hosted offshore can load very quickly here.
- If your customers are in New Zealand and your site is server heavy, such as WordPress without caching, a server in New Zealand or Australia helps.
- If your site uses a CDN or edge hosting, the server location matters much less.
- If you store sensitive personal information, think about where it is held. Under the Privacy Act 2020 you remain responsible for personal information you send overseas, so ask where your host keeps data.
- Local support hours can matter as much as server location when something breaks at 9am on a Monday.
Whatever you choose, measure it. Our free website speed test shows how your site performs, and why website speed matters for NZ businesses explains what to fix first.
What an SSL certificate is
An SSL certificate (technically TLS these days, but everyone still says SSL) lets your site load over HTTPS. It encrypts the connection between your visitor's browser and your server, so nobody in between can read or change what is sent, such as contact form messages or payment details.
You can tell a site has one because the address starts with https and the browser shows a padlock or similar icon. Without one, Chrome and other browsers label the site as not secure, which is enough to make many visitors leave.
Why every site needs an SSL certificate
- Browsers warn visitors away from sites without HTTPS, especially on pages with forms.
- Google has used HTTPS as a ranking signal for years. It is a small signal, but there is no reason to miss it.
- Many modern browser features, including those used by progressive web apps, only work over HTTPS.
- Payment providers require it for anything involving card details.
Types of SSL certificate
| Type | What it checks | Who needs it |
|---|---|---|
| Domain validated (DV) | That you control the domain | Almost every small business website |
| Organisation validated (OV) | That the organisation behind the domain exists | Some larger businesses and corporate sites |
| Extended validation (EV) | A more thorough check of the organisation | Rarely worth it now, as browsers no longer display it prominently |
Certificates expire, and the maximum lifetime keeps getting shorter. That is why automatic renewal matters. An expired certificate puts a full page security warning in front of every visitor until it is fixed. When you launch, also check that the plain http address redirects to https, so nobody lands on the insecure version.
Backups: the part everyone skips
A backup is only useful if it exists somewhere other than the server it is backing up, is recent, and can actually be restored. Ask your host three questions:
- How often are backups taken, and how long are they kept?
- Are they stored separately from the server my site runs on?
- How do I restore one, and is there a charge for help doing it?
If you run WordPress, keep your own backup as well as the host's. If a host goes out of business or suspends your account, its backups go with it.
Keep email hosting separate
Many cheap hosting plans include email. It is tempting, but for a business it is usually a mistake. If your website gets hacked or your host has an outage, your email goes down with it. Moving your website to a new host or developer also becomes harder, because your inbox has to move too.
Instead, use a dedicated business email service such as Google Workspace or Microsoft 365, connected to your own domain. Your website and email then sit independently, and the DNS records for each can be changed without affecting the other. Our guide to domain registration in NZ explains the DNS records involved.
What to ask a host before signing up
- Where are your servers, and do you use a CDN?
- Is a free SSL certificate included, and does it renew automatically?
- How are backups handled, and how do I restore one?
- Who applies security updates to the server and, for managed hosting, to the platform?
- What support do you offer, in what hours, and how do I reach a person?
- What happens if my site gets a sudden spike in traffic?
- Is the account in my name, and can I move my site elsewhere easily?
- What is the renewal price after any introductory offer ends?
Hosting with a website builder
If you are still deciding between a builder and a professionally built site, remember that builders handle hosting, SSL and backups for you. That is a real advantage for a small business with no technical help. Our comparison of website builders in NZ covers the trade offs.
The short version
Choose hosting that matches your site and your team. Builder sites need nothing extra. WordPress sites are usually best on managed hosting. Custom sites suit cloud or edge hosting set up by the developer. Whatever you pick, make sure HTTPS is on and renewing automatically, backups are real, email is separate, and the account is in your name.
If you would rather not deal with any of this, our small business website design service includes hosting setup, SSL and a fast, low maintenance build, with a fixed written quote before we start.