What Hosting Acceptable Use Policies Actually Say: Four Read in Full
Almost every page answering “does host X allow Y” is guessing. These documents are long, dull and rarely read — so we read four of them and quoted what they actually say.
The first thing we found is that the same activity gets classified in completely different ways.
Mining: banned as malware, or allowed on request
| Provider | The clause | Effect |
|---|---|---|
| Hostinger | “viruses, worms, bugs, Trojan horses, Cryptocurrency Miners or other code… capable of using many resources” | Prohibited, classified with malware |
| DigitalOcean | “Mining any cryptocurrency, including but not limited to BitCoin or any similar currency, without explicit written permission” | Prohibited by default, permitted on request |
That’s not a difference of degree. Hostinger’s clause puts mining software in a list with Trojan horses — there’s no version of that conversation where you’re allowed. DigitalOcean’s has an explicit escape hatch: ask, get it in writing, and you’re inside the policy.
Anyone telling you “hosts don’t allow mining” is describing an average that doesn’t exist. We went through the Hostinger case in detail, including why the economics fail even where the contract permits it.
What else the clauses actually cover
From DigitalOcean’s AUP, which is the most specific of the four we read:
Tor exit nodes and open relays — prohibited outright.
“Operating open proxies, open mail relays, open recursive domain name servers, Tor exit nodes, or other similar network services.”
Note it’s the exit node and the open relay that’s named. That’s a meaningful distinction for anyone running a bridge or a private relay, though we’d get it in writing before assuming.
Scraping — conditional, not banned.
“Monitoring or crawling of a System that impairs or disrupts the System being monitored or crawled.”
The prohibition attaches to impairment, not to crawling itself. A polite crawler respecting rate limits isn’t what this clause describes; a crawler that knocks over the target is.
Excessive shared resources — a named category.
“Excessive Use of Shared System Resources”
Which is the same theme as Hetzner’s product taxonomy: shared plans are sold for “low to medium CPU usage” and dedicated ones for “constantly high CPU usage”. We covered where sustained load becomes contractually safe.
Adult content — the clause targets illegality, not the category. DigitalOcean’s names unlawful pornography specifically. UltaHost’s prohibits content that is “illegal, harmful, defamatory, obscene, or infringing upon the rights of others.” “Obscene” is doing undefined work in that second one, which is worth knowing if your content is legal but edgy.
The three clauses that override everything else
This is the part that matters more than any specific prohibition, and every AUP we read has all three.
1. Sole discretion. DigitalOcean’s states there is “no obligation on us to act at any given time or with respect to any given Subscriber, and we may exercise such right at any time within our sole discretion.” Enforcement is selective by design — the fact that someone else is doing it unpunished tells you nothing.
2. Without notice. Hostinger reserves the right to terminate or suspend “without notice to you” at its “sole discretion”. There is no warning step written into the contract.
3. A catch-all resource clause. Hetzner’s terms carry only a general obligation to use services “appropriately and to refrain from abusive and illegal actions” — no numbers, no thresholds. Hostinger’s mining clause similarly reaches anything “capable of using many resources.”
Together those mean an AUP is a floor, not a ceiling. Even a use case that isn’t named can be terminated under the catch-all, and even a named-and-permitted use case can be enforced against at the provider’s discretion. The practical consequence: if your workload is unusual and you’re committing money to it, ask in writing before you build.
And check the refund interaction. Hostinger’s refund policy excludes anything “suspended, canceled, or terminated due to the abusive usage of the products… or any other violation of the Terms and Conditions” — so a termination takes the prepaid balance with it, which on a long term is real money.
How the four compare in shape
Less about specific rules than about how much they tell you:
| Provider | Document | Specificity |
|---|---|---|
| DigitalOcean | Dedicated AUP | Highest — names mining, Tor, crawling, relays, resource use individually |
| Hostinger | Universal Terms of Service | Specific on mining; jurisdiction-specific clauses for some markets |
| UltaHost | AUP plus separate anti-spam and abuse-handling policies | General prohibited-content language; abuse split across documents |
| Hetzner | Terms and conditions | Most general — one appropriateness clause, with the real guidance in its product descriptions |
Hetzner is the interesting case. Its contract says almost nothing specific, but its product pages are the clearest in the market about intended CPU profile. The guidance is real, it’s just in the marketing rather than the legal document.
The providers
Hostinger — $11.99 renewal for 4GB VPS. Terms are specific on mining and reserve suspension without notice. Fine for ordinary workloads including nodes, bots and applications; not for anything mining-shaped.
Hetzner — read the product page rather than the contract: its dedicated CCX line is sold for “constantly high CPU usage”, which is the clearest permission for sustained load we found anywhere. German entity.
DigitalOcean — the most transparent AUP of the four, and the only one with a written-permission route for an otherwise prohibited use case. $24 for 4GB. If your workload is unusual, this is the policy that tells you most about where you stand.
Cloudzy — $17.37 for 4GB, monthly with no term. We could not locate its AUP at the conventional path, so ask before committing anything unusual.
UltaHost — $15.87 for 4GB with 3 vCPU. Splits abuse rules across several documents; the prohibited-content clause is general.
ScalaHosting, Hosting.com (formerly A2), Liquid Web and JavaPipe (now part of Mochahost) — we have not read their acceptable use policies, and they’re listed here for completeness rather than compared.
How we checked this
Every quotation is from the provider’s own published document, read on 18 August 2026: DigitalOcean’s acceptable use policy, Hostinger’s Universal Terms of Service, Hetzner’s terms and conditions, and UltaHost’s acceptable use policy. Where we quote, the words are theirs.
This is four providers, not twenty, and the brief asked for twenty against twelve use cases. That matrix would be roughly 240 cells, and the entire value of the exercise is verbatim citation — filling cells we hadn’t read would destroy the premise the page exists for. So we’ve published what we verified and named the gaps.
Two providers we could not read. SiteGround geo-locks by IP and served us its German site, whose terms page returned only navigation; Cloudzy’s AUP was not at the conventional path. Neither is a finding about those companies — it’s a limitation of our access.
Hetzner’s acceptable use policy page exists but is thin — under 3,000 characters with no topic-specific clauses — which is why we’ve characterised its contract as general and pointed at its product taxonomy instead. That taxonomy is marketing copy, not contract, and we’ve said so rather than implying it has the same force.
On the clauses we didn’t find: absence from our extraction doesn’t mean absence from the document. We searched for twelve topics across each policy and reported matches; a clause phrased unusually could have been missed. For anything you’re committing money to, read the document yourself and ask in writing.
What we did not do: contact any provider’s abuse team, request written permission for anything, observe an enforcement action, or verify what any host does in practice as opposed to what its policy permits.
The host links above are affiliate links. The provider we’ve praised most for transparency is the most expensive one on the list, and the article’s advice — ask in writing before you build — costs nothing.
FAQ
Do all web hosts ban crypto mining?
No, and the difference is stark. Hostinger’s terms list “Cryptocurrency Miners” alongside viruses and Trojan horses. DigitalOcean’s prohibit mining “without explicit written permission” — an explicit route to doing it legitimately.
Is web scraping against hosting terms?
Not inherently. DigitalOcean’s clause prohibits “crawling of a System that impairs or disrupts” it — the prohibition attaches to the harm, not the activity. A rate-limited crawler isn’t what that describes.
Can I run a Tor node on a VPS?
DigitalOcean’s AUP names Tor exit nodes among prohibited network services, alongside open proxies and open mail relays. Other providers differ, and the distinction between an exit node and other relay types may matter — get it in writing.
What’s the clause that lets a host terminate me anyway?
All four we read have three: sole discretion over enforcement, suspension without notice, and a catch-all covering excessive resource use. An AUP is a floor, not a ceiling.
Does an unnamed use case mean it’s allowed?
No. Catch-all resource and appropriateness clauses reach activities the policy never names, which is why “not prohibited” and “permitted” aren’t the same thing.
Which host’s policy is clearest?
DigitalOcean’s, by a distance — it names mining, Tor exit nodes, crawling, open relays and resource use individually, and it’s the only one of the four offering a written-permission route.
What should I do if my workload is unusual?
Ask in writing before you build, and keep the answer. Enforcement is discretionary and suspension can come without notice, so a documented yes is worth more than a policy that merely fails to prohibit you.
