I have started to encounter more and more instances where companies want to get out of the business of hosting websites themselves and since the price of outsourced web hosting has dropped the use of shared and dedicated server hosting has accelerated.  There are many security as well as non-security related factors that should go into the decision on which approach is best for your application and I wanted to summarize them here.

I realize that to many people this is not news, but I am finding all too often that for a large part of the population this is a new insight so I intend to occasionally provide basic info as well as any advanced data that I can provide on both security and the growing practice of hosting sites with 3rd parties.

A 3rd party hosting company can afford to maintain servers at a fraction of the cost that anyone in any other business can manage.  When you sign up for a web hosting company to put your site on their server you are typically looking at a very low price (under $20 per month and sometimes under $5 per month) and in these cases the web hosting company is actually not using a dedicated server for your site.  If they were then they would be out of business very soon.  The fact is that in this situation you are signing up for shared hosting and that means that your website might me one of dozens or even hundreds of other web sites hosted on that same server.  The advantages of this model of course is the price.  You could never get a dedicated server for the same price (they typically run over $100 per month for the bare bones package and can run into the thousands per month depending on the bells and whistles you require).  The disadvantages of shared hosting are more numerous in my opinion than the advantages.  On a Shared Hosting plan you cannot install any software that isn’t already part of the package, you might be sharing the same IP address as many other sites and the server is distinguishing requests by address once they arrive at the server, and most importantly if someone on the same server as you compromises the server with their web application (in the case of dynamic code) then your site is going to be dragged down too.

This isn’t an attempt to completely scare you off of Shared Hosting solutions, but be warned about the disadvantages before you jump at the price.  I use shared hosting of simple sites that I consider low security, for everything else I go Dedicated Server all the way.  I see efforts to save money or time as the most common sources of bad judgement calls that undermine security.