Deciding where your website lives looks like a twenty-pound-a-month expense. It is really a decision about who answers when something goes wrong.

In May 2026 The Independent looked at what a virtual private server is and whether it is safer than shared hosting. Among those quoted is Tomislav Vazdar, founder and CEO of Riskoria, appearing there as professor of cybersecurity and artificial intelligence at the Open Institute of Technology, alongside Luis Corrons of Gen, Richard Ford of Integrity360, Roy Shelton of Connectus Business Solutions and Peter Hawes of LevelBlue.

Three ways a website can sit somewhere

With shared hosting you sit on a machine with a large number of other sites, all drawing power and memory from the same pool. A virtual private server hands you a slice of a physical machine carved into a separate virtual host with resources of its own. Renting the whole machine is the most expensive and the least common arrangement. The price gap is modest: the Independent puts shared hosting at roughly five to fifteen pounds a month and a virtual private server at twenty to fifty.

Vazdar describes the difference in terms of a neighbourhood. When a neighbour gets a traffic surge, you slow down. When a neighbour’s site is compromised, you are in the same neighbourhood. That, he says, is simply the nature of the arrangement. A virtual private server removes both problems, because the resources are yours and the environment is properly isolated. Ford adds that virtualisation has carried data centres since the early 2000s, and that growth in computing power made it viable to run many virtual servers on a single physical host.

Isolation is not the same thing as security

Here sits the line that makes this post worth writing. A virtual private server is structurally safer than shared hosting, but it is not safe by default. Vazdar puts it plainly: on an unmanaged plan the provider gives you root access and largely steps back, and from that moment you own your own security. In practice that means updates to the operating system and everything running on it, firewall configuration, key-based login, backups somebody has actually restored at least once, and logging somebody reads.

Shelton adds that isolation means other customers cannot directly affect your server, while everything still depends on configuration, regular updates and who manages the thing. Hawes goes further: every piece of software you install, security software included, introduces potential vulnerabilities. Without solid internal processes for patching and configuration, a virtual private server can increase your attack surface rather than reduce it, because you are now managing a server and not merely a website.

When it is time to move

Vazdar does not recommend the upgrade to everyone. Shared hosting works perfectly well for personal sites, small business pages, portfolios and modest traffic blogs. It is cheaper, it requires no server knowledge and the provider handles maintenance. For most new projects it is the right starting point, and you will know it is time to look at a virtual private server when things start straining.

The signals he lists are persistently slow traffic, a need for custom server software, compliance obligations around data handling and payment processing. In short, anything where downtime directly costs money. To that we would add the moment a site stops being a shop window and becomes a route to the data of patients, customers or staff. Most sites spend years on shared hosting before they genuinely need the upgrade, and that is perfectly fine.

The confusion that keeps coming back

VPS and VPN look similar and mean different things. Corrons separates them neatly: a virtual private network protects and re-routes network traffic, while a virtual private server is a machine you rent to run websites, services and applications. One is infrastructure, the other a privacy and networking tool. The mix-up is not harmless, because procurement occasionally asks for one and pays for the other.

Why this is not only a question for the IT team

For an organisation covered by the Croatian Cyber Security Act, the choice of hosting falls under measure 8, supply chain security. The provider you entrust with a server becomes part of your exposure, so the same questions apply as to any other supplier: what has been contracted, who maintains what, how incidents are notified and what happens when the contract ends.

With an unmanaged plan one point needs to be clear. Legally and practically, updates, firewall configuration, backups and monitoring are then your obligation rather than the provider’s. An organisation that fails to write this down ends up having paid for a better service and acquired a larger responsibility. An overview of the measures and sub-measures sits on the page about the thirteen measures.

What to settle before signing

First, decide whether the plan is managed or not, and record the decision. Everything else follows from that one point. Second, check what certifications the provider holds for its own processes and where its machines physically sit, because that also determines which authority you speak to if personal data is exposed.

Third, name the person who maintains the machine on your side and the time they are given for it. A server with no named owner is a server that will be running year-old software versions twelve months from now. How suppliers are assessed and what belongs in the contract is described under Cyber Security Act compliance. The full Independent article is available on their site.