Web Hosting Hidden Fees: What Every Pre-Ticked Box Costs

The hosting plan is $2.99. The checkout total is $180. Nothing has gone wrong — you’ve just been shown five pre-ticked boxes and a term length, and both were designed by someone who does this professionally.

Here’s the arithmetic that makes the point. HostGator publishes its own add-on prices in a help article, which is unusually honest of it and very useful for us. Take three of the most commonly pre-selected add-ons at those published rates:

The Hatchling plan those attach to renews at $158.27 for a year.

The add-ons cost 96% of the hosting. Tick SiteLock Essentials at $95.88 as well and you’re at $248.59 — 157% of the plan price. You’d be paying more for the accessories than the thing.

Now the part that matters: what each one actually does, and what it replaces.

SSL: $89.88 against free

This is the clearest one, so it goes first.

An SSL/TLS certificate is what puts the padlock in the address bar. It is genuinely necessary — a site without one gets flagged as insecure by every browser.

It is also free, and has been for a decade. Let’s Encrypt is a nonprofit certificate authority run by the Internet Security Research Group, a 501(c)(3), and it issues free automated TLS certificates. Its own homepage describes it as “a nonprofit providing free TLS certificates to more than 700M websites.”

Seven hundred million. This isn’t a fringe alternative — it is how the modern web is encrypted.

The certificate a host sells you for $89.88 a year provides, for an ordinary website, the same encryption a browser sees as identical. Paid certificates from commercial CAs do offer things Let’s Encrypt doesn’t — longer validity periods, warranties, organisation-validated variants, and support you can call. If you’re running a bank, that matters. If you’re running a business site or a blog, you’re paying for a warranty you’ll never claim on.

Untick it. Then check your host offers free SSL, because most decent ones now install Let’s Encrypt automatically. If yours charges for basic SSL in 2026, that tells you something about the host that goes beyond this one line item.

Domain privacy: $14.95 for something you may already have

Domain privacy replaces your name, address, email and phone number in public domain registration records with the registrar’s proxy details. Without it, the argument goes, anyone can look up where you live.

Two things have changed that argument, and most checkout pages haven’t caught up with either.

First, several registrars include it at no cost. Namecheap bundles WHOIS privacy free. DreamHost is more explicit still, describing private registration as included “at NO COST (for the life of your domain)” and renewing automatically. When one company charges $14.95 a year for what another gives away permanently, that’s a pricing decision, not a cost.

Second, the underlying data is largely redacted by default now anyway. Since GDPR took effect in May 2018, registrars have redacted registrant personal data — name, organisation, email, postal address — from public registration records, and most applied that globally rather than running separate systems per jurisdiction. ICANN then formally retired WHOIS for generic top-level domains in favour of RDAP, the Registration Data Access Protocol, and its Registration Data Policy took effect on 21 August 2025, concluding a year-long transition and replacing the interim policy that had governed the GDPR era.

So the doomsday scenario the upsell describes — a stranger pulling your home address out of a public lookup — is substantially less available than it was when this product was invented.

Untick it, and register domains where privacy is included. If your registrar publishes your details and charges to hide them, that’s the fee, and it’s avoidable by moving.

Backups: $47.88 for what your host may already run

CodeGuard Basic is $47.88 a year at HostGator’s published rate. It takes automated off-site backups of your site and database, and it works.

The question is whether you’re buying it twice. Hostinger includes free weekly backups on its Premium plan and daily backups on Unlimited. GreenGeeks runs nightly backups. Most credible hosts now include something. And on WordPress specifically, free backup plugins have covered scheduled backups to off-site storage for years.

This is the one I’d think hardest about, and I’ll come back to it — because unlike SSL, “your host already does it” is not always the reassurance it sounds like.

Security suites: $95.88 against a free tier

SiteLock Essentials is $95.88 a year published, and the standalone product runs from $19.99 to $44.99 a month. It scans for malware, and higher tiers add a firewall and removal service.

The free comparison is Cloudflare’s free plan, which puts a CDN, DDoS mitigation and a basic WAF in front of your site at no cost.

It is not identical — Cloudflare filters traffic reaching your site rather than scanning files already on it, so they solve overlapping but different problems.

The honest position: if you’re running a site whose compromise would be expensive, malware scanning has real value, and $95.88 is not an outrageous price for it. But it is being sold at checkout to people buying a $3-a-month plan for a personal site, alongside four other things, with the box already ticked. The product isn’t a scam; the placement is the problem.

Untick it, put Cloudflare’s free tier in front of the site, keep software updated, and revisit if the site becomes something you’d be upset to lose.

The small ones

Domain expiration protection, $9.99/yr. This guards against your domain lapsing. Auto-renew does the same thing for free, and is on by default at most registrars. Untick.

Yoast SEO Premium, $99.99/yr. The free version of Yoast handles what most sites need. Buy it later, from Yoast, if you find a specific reason.

Professional email, $29.99/yr. Fair value if you need it — but check whether your plan already includes mailboxes. Hostinger’s plans include free mailboxes for the first year.

SEO tool subscriptions, $71.40 to $646.20 depending on term. Multi-year SEO tool commitments bought at hosting checkout are, in my view, the least defensible item on any of these pages. You have not yet built the site.

So which one do you keep?

Keep a backup — but be deliberate about which.

Here’s the reasoning, and it’s the one genuine caveat in this whole article. “My host takes backups” and “I have backups” are different statements. Host-run backups often live on the same infrastructure as the site, which covers you for the common case — you broke something, restore yesterday — and covers you less well for the rarer one where the account itself is the problem: a suspension, a billing dispute, a compromise that reaches the panel.

You don’t need to buy CodeGuard to fix that. You need one copy of your site somewhere your host doesn’t control. A free plugin writing to storage you own does it. So does a monthly manual export, if you’ll actually do it.

The verdict, then:

• SSL — untick, use Let’s Encrypt
• Domain privacy — untick, register where it’s free
• Security suite — untick, start with Cloudflare’s free tier
• Expiration protection — untick, turn on auto-renew
• Backups — keep a backup strategy, off-site, not necessarily theirs

The fee that dwarfs all of them

Everything above totals a couple of hundred dollars. The genuinely expensive thing on the page is the term.

Hostinger’s Premium plan advertises $2.99/mo — on a 48-month term, paid upfront, which is $143.52 today — and renews at $10.99/mo. That’s not deceptive; it’s disclosed on the page. But the number people remember is $2.99, and the number they eventually pay is nearly four times it.

HostGator’s Hatchling is the same shape from the other end: $158.27 for a year at the renewal rate, or $10.99/mo if you commit to three years.

Read the renewal column before the promotional one — though as our renewal price comparison found, even that isn’t enough on its own: the host with the second-worst increase has the lowest three-year cost, because its promo runs four years. It’s the same pattern we found in domain renewal pricing, where a $1 first year becomes $22 — and the mechanism is identical. The introductory price buys your attention; the renewal is the product.

Two questions worth asking before you check out:

1. What is the total I am paying today? Not the monthly figure — the multiple of it.
2. What does this cost in year three?

If those two numbers still look good, the plan is genuinely good.

Hosts that include it instead

The cleanest way to avoid checkout upsells is to buy from somewhere that doesn’t have them.

Namecheap built its reputation partly on including WHOIS privacy free rather than charging for it, which is the single most-upsold line item in domain registration. Its hosting is priced in the same spirit.

Hostinger includes free SSL, a CDN, domain privacy, free migrations, mailboxes for the first year, and weekly or daily backups depending on plan — most of this article’s shopping list, bundled. The trade is the long upfront term described above: watch the total, not the monthly — we broke its renewal pricing down term by term, and unusually the longest term really is the cheapest, because the renewal rate barely moves.

DreamHost is the strongest on the domain privacy point specifically, including private registration for the life of the domain at no cost.

GreenGeeks includes nightly backups and free SSL, and is the pick if the renewable-energy angle matters to you.

HostGator’s published add-on chart supplied most of the prices in this article, and it deserves a note in its favour: it publishes them at all, in a help article anyone can read, which is more than many hosts do. The prices are high; the disclosure is good.

If you’re comparing plans on price, best cheap web hosting applies the same renewal-first arithmetic across providers.

How we checked this

The add-on prices — SSL at $89.88/yr, domain privacy at $14.95/yr, CodeGuard Basic at $47.88/yr, SiteLock Essentials at $95.88/yr, domain expiration protection at $9.99/yr, Yoast SEO Premium at $99.99/yr and the SEO tool tiers — are from HostGator’s own published add-on price chart, read in August 2026. The Hatchling renewal figures, including $158.27 for one year and $10.99/mo on a three-year term, are from HostGator’s published hosting price chart. We used one host’s published rates throughout rather than mixing sources, so the percentage comparison is like-for-like. We were unable to screenshot that chart: HostGator’s help pages reject both headless browsers and command-line requests, so unlike every other figure in this article it rests on a single automated read of the page rather than a page we could also photograph. The numbers are its published rates; check them yourself if you’re about to spend on the strength of them.

Let’s Encrypt’s status as a nonprofit certificate authority operated by the Internet Security Research Group, and the “more than 700M websites” figure, are its own published claims. DreamHost’s “at NO COST (for the life of your domain)” wording is from its domains page. Hostinger’s inclusions, plan pricing, 48-month term, upfront payment condition and renewal rates are from its own hosting page.

That ICANN’s Registration Data Policy took effect on 21 August 2025, concluding a transition period running from 21 August 2024, and that it replaced the Interim Registration Data Policy, is from ICANN’s own announcement.

One limit on the privacy section. ICANN’s announcement describes a framework for managing registration data “in line with privacy regulations” but does not itself spell out field-level redaction rules. The specific claim that registrant name, organisation, email and postal address are redacted by default in public records reflects registrar practice since GDPR rather than a quoted ICANN mandate, and practice does vary between registrars and TLDs. If public exposure of your details is a serious concern, check what your own registrar actually publishes for your domain rather than assuming either way.

What we did not do: we did not run a live checkout at each host and photograph the pre-ticked boxes, so which specific add-ons are pre-selected varies by host, plan and promotion and may differ from what you see. The prices are published rates; the selection defaults are not something we can pin down for your basket. We also haven’t tested CodeGuard’s or SiteLock’s restore and remediation quality — the argument here is about placement and price against free equivalents, not a review of either product.

We could not verify Namecheap’s and GreenGeeks’ inclusions at source. Both sites returned challenge pages to our requests. Namecheap’s free WHOIS privacy is long-standing and well documented, and GreenGeeks publishes nightly backups, but we’re relying on secondary knowledge for those two rather than a page we read.

The hosting links above are affiliate links. Every alternative we recommend — Let’s Encrypt, Cloudflare’s free tier, free backup plugins, auto-renew — costs nothing and pays us nothing.

FAQ

Do I need to pay for SSL with web hosting?

No. Let’s Encrypt provides free automated TLS certificates and secures more than 700 million websites. Most reputable hosts now install it automatically. A paid certificate buys warranties and validation levels that ordinary sites don’t use.

Is domain privacy worth paying for?

Rarely, because you can usually get it free. Namecheap and DreamHost include it — DreamHost for the life of the domain — and registrant personal data has been redacted from public registration records by default since GDPR. Pay only if your registrar publishes your details and you can’t move.

Is CodeGuard or SiteLock worth it?

Neither is a bad product, but both are sold at checkout to people whose host already includes an equivalent. Check what your plan covers first. For backups, what you actually need is one copy somewhere your host doesn’t control; for security, Cloudflare’s free tier is the sensible starting point.

What hosting add-ons should I always untick?

SSL, domain privacy, domain expiration protection and premium SEO tools. Each has a free or included equivalent, and the SEO subscriptions in particular are multi-year commitments made before your site exists.

Which add-on is actually worth keeping?

An off-site backup — though not necessarily the one being sold to you. Host-run backups often sit on the same infrastructure as your site, which doesn’t help if the account itself is suspended or compromised.

Why is my hosting renewal so much higher than what I paid?

Because the introductory rate applied to a fixed term, usually paid upfront. Hostinger’s $2.99/mo Premium plan is a 48-month prepayment of $143.52 that renews at $10.99/mo; HostGator’s Hatchling renews at $158.27 a year. Both are disclosed — they’re just not the number you remember.

How much do hosting add-ons cost in total?

At HostGator’s published rates, SSL, domain privacy and CodeGuard together come to $152.71 a year against a Hatchling plan renewing at $158.27 — about 96% of the hosting itself. Adding SiteLock takes it to 157%.