Operator's Brief
Drupal vs WordPress — The platform decides the size of the retainer you can defend
The client has a procurement process, a security questionnaire and a communications team, and you are about to sign something that says how quickly you respond.
Straight answer first
Sign the retainer you can actually staff at the hours you are promising: Drupal work tends to arrive attached to institutional clients with fixed response expectations and a security cadence you must meet, while WordPress work arrives with a wider talent pool and easier cover.
Both platforms can be maintained responsibly. The difference for an agency is the contract wrapped around them. A university, a charity or a public body will ask what happens when a security release lands on a Wednesday afternoon, and your answer needs to be an arrangement rather than an intention.
Written by the Hosting Seller staff · Checked 24 August 2026
NVMe
Storage under every account
Free
Domain on annual orders
99.9%
Uptime commitment held
Flat
Price when it renews
The technical comparison is well covered elsewhere and is largely settled: one is a structured content framework and the other is a content management system with an enormous ecosystem. Neither fact tells you whether the client is a good one.
What tells you that is the shape of the obligation. Institutional clients pay well, pay reliably and expect proper process. That is a good business if you have built for it and an uncomfortable one if you have not.
The client on the other end of each
Drupal work disproportionately comes with committees, procurement, accessibility requirements and a communications team who will want a staging environment and a sign-off process. None of that is unreasonable; all of it takes time you must have priced.
WordPress work spans everything from a plumber to a national charity, so the client shape tells you less. That breadth is why it is easier to build a repeatable agency practice around it: the same processes work at several client sizes.
Read the contract before you read the specification. Response times, escalation, reporting and any liability clause tell you more about whether this account will be profitable than the platform ever will.
The security obligation you are taking on
Security releases arrive on a schedule that is not yours. Whatever the platform, the promise you are making is that somebody reads the announcement, assesses it, tests the update on a staging copy and deploys it inside an agreed window.
So build the mechanism before you sign. Who monitors announcements, who tests, who deploys, who signs off, and what happens when that person is on leave. Institutional clients will ask, and a vague answer is often what loses the work.
The platform helps at the edges rather than solving it: staging copies mean you can test before deploying, Imunify360 watches the account continuously, and daily backups with account-level restores mean a bad deployment is recoverable in minutes rather than a crisis.
What a defensible retainer has to include
Four things, at minimum. A stated response time for each severity of issue. A patching window with a named owner. A backup and restore procedure you have actually rehearsed, with a timing you are willing to quote. And a reporting rhythm, because institutional clients need to show somebody internally that the money is doing something.
Then a fifth that agencies forget: an exclusions list. New features, content entry, third-party integrations and training are separate work, and saying so in the contract prevents the slow expansion that turns a good retainer into an unpaid one.
Price the whole thing against hours you have measured rather than hours you imagine. If you have never timed a restore on a real site, you are guessing at the number you will one day be judged on.
Hosting it without promising a specialist you do not employ
Be precise about what you supply. You supply hosting, monitoring, backups, patching within a window and a route to escalation. You do not supply a resident core developer unless one is on your payroll.
The platform underneath gives you defensible things to reference: a 99.9% uptime commitment, real people answering at any hour, free SSL on every site you host, daily backups and per-account restores. Reference what is genuinely committed and nothing further.
For heavier institutional builds, the ladder continues — KVM servers with full root and a dedicated Xeon E-2274G with 32 GB of RAM — so a client outgrowing shared capacity is an upgrade conversation rather than a supplier change halfway through a contract.
Commitments you can quote
Institutional clients ask what is guaranteed, so it helps that the answers are short: a 99.9% uptime commitment, daily backups across every client account, free SSL on every site you host, and real people answering around the clock.
Behind that, the escalation route is yours alone. Your client deals with you, in your words, on your paper, while the supplier stays where a supplier belongs.
- Uptime commitment you can cite
- Daily backups, account-level restores
- Escalation your client never sees
- Room to move up mid-contract
Why Hosting Seller
On every plan, as standard
Commitments in writing
A 99.9% uptime target and round-the-clock cover, which are defensible things to reference in your own contract.
Test before you deploy
Staging copies so a security release is applied to a copy first, on a client who will ask how you tested it.
Restores you have timed
Daily backups with account-level restores, so the recovery figure in your contract is measured rather than hopeful.
Continuous monitoring
Imunify360 watching every client site, which is a much better answer to a security questionnaire than good intentions.
Headroom mid-contract
KVM servers and bare metal on the same account, so growth does not force a supplier change halfway through a term.
Stable pricing
A renewal figure matching the order figure, which matters when the contract you signed runs for three years.
Price Tags Compared
How we compare with the household names
Typical sign-up and renewal prices across the market, set next to ours — the second number most comparison charts leave off.
| Line item | Hosting SellerBest seller | Typical big-brand host | Typical budget host | Typical loss-leader |
|---|---|---|---|---|
| Entry price / mo* | $2.42/mo | $4–$6 | $2–$4 | $1–$3 |
| Price at renewal / mo | $2.42/mo | $10–$15 | $8–$12 | $4–$6 |
| Renewal price on the entry plan is unchanged | ||||
| SSL on every plan | ||||
| Site migration included | ||||
| The entry plan uses NVMe storage | ||||
| Entry plan gets a backup daily | ||||
| Live human support, 24/7 |
*The number in our column is the cheapest plan on our shelf, priced on an annual term and pulled live from the very catalogue that feeds the pricing page, so it cannot drift out of date. Other columns show the ranges shared hosting tends to advertise inside each bracket: introductory rates that normally ask for a one-to-four-year commitment, then climb once that term expires. Naming individual competitors and printing their prices is something we have stopped doing. A figure we cannot re-check on the day you read it has no business sitting in front of you. So compare us with whoever you are genuinely weighing up, and read the renewal line first. That line tells you more than the headline ever will.
First Steps
From choosing to live
- 1
Read the contract before the specification
Response times, escalation, reporting and liability decide whether this account is profitable. The platform is almost a detail by comparison.
- 2
Name the patching owner and the cover
Who reads the announcements, who tests, who deploys and who does it during annual leave. Institutional buyers ask; vague answers lose work.
- 3
Rehearse and time a restore
On a real copy of the client's site. That measured number is the one you quote in the contract and the one you will be held to.
- 4
Write the exclusions list
New features, content entry, integrations and training are separate work. Saying so at signature prevents a year of quiet expansion.
In the Box
Packed with every plan
- A separate cPanel account per client site, with limits you set
- Staging copies for testing security releases before deployment
- Daily backups with restores you can run at account level
- Imunify360 monitoring every client site continuously
- Free SSL on every site you host, reissued automatically
- A 99.9% uptime commitment behind the platform
- Real people answering at any hour, escalating behind your desk
- KVM servers with full root when a build outgrows shared capacity
- A dedicated Xeon E-2274G with 32 GB of RAM for the heaviest institutional work
- Free migration in, and a renewal price matching the order price
Across the Counter
Things people ask us all the time
Should a small agency sign a Drupal support contract?
Only if you can name the person who applies a security release and the person who covers them on leave. Institutional clients are excellent accounts precisely because they expect process, and the process is the deliverable. Without cover, one holiday turns a good contract into a breach.
What does an institutional client expect in a hosting arrangement?
Stated response times by severity, a patching window with an owner, a rehearsed restore procedure with a real timing, and regular reporting. Most of that is organisational rather than technical, which is why agencies who prepare it once win this work repeatedly.
Can a site like this live on the same reseller account as everything else?
Yes, in its own cPanel account with its own limits, and the ladder continues to KVM servers with root and bare metal if the build outgrows shared capacity. Being able to move up without changing supplier matters more on a three-year contract than on any single invoice.
Who is accountable when a security release lands mid-week?
You are, to your client, whatever the internal arrangement. So make the arrangement explicit: who reads the announcement, who tests on staging, who deploys and inside what window. Then hold to it, because this is the specific promise institutional clients check.
Read next
Hosting With Free SSL
Certificates across a client estate, including the renewal failure that hits every site at once.
Cheap Dedicated Servers
Bare metal costed per client account, for the institutional build that outgrows shared capacity.
Drupal Hosting
Drupal accounts on the same reseller shelf, with backups and monitoring on every one.
Secure Hosting
Hardened defaults and per-account isolation for the clients whose security questionnaire is real.
Moving your site to another host? Start with this checklist.
A step-by-step order of work for a move your visitors never spot: which files to copy first, how to carry email across without losing one message, the right moment to repoint DNS, and the two mistakes behind nearly every hour of downtime people ring us about.
Sign what you can staff.
A 99.9% uptime commitment, daily backups, per-account restores and escalation your client never has to know about.
See Drupal Hosting plans