The State of Web Hosting in 2026: Insights from the CloudLinux and WebPros Industry Report

Why This Data Matters to Agencies

Before diving into the findings, Vajda took a moment to address why a room full of agency professionals should care about hosting industry data at all. His argument was direct: hosting providers are agencies' supply chain. The pressures and priorities shaping how hosts operate translate directly into the tools agencies get access to, the prices they pay, and the services that become available to their clients.

He described the hosting industry as going through some particularly important changes at the moment, making this an unusually relevant time to look at the data. Understanding what hosts are dealing with gives agencies a window into where product investment is flowing, where pricing pressure will show up, and where partnership opportunities may be opening up.

The Financial Picture: Growth Without Easy Profit

Revenue Was Up in 2025 The headline number from the report is broadly positive: over two-thirds of hosting providers reported revenue growth in 2025. Only about 7% reported a revenue decline. By that measure, 2025 was a good year for the hosting industry overall.

But Profitability Is Under Pressure Vajda was quick to add a significant qualification: revenue growth does not automatically translate into profit growth. When hosting providers were asked about their biggest threats to profitability in 2026, two concerns dominated the responses and were very close to each other in the data.

The number one threat was price competition, with market forces pushing prices downward.

The number two threat was rising costs across the board, covering software, hardware, energy, and labour. These two forces together create a classic margin squeeze: what hosts can charge is under pressure from one direction, while what it costs them to operate is under pressure from the other.

SaaS Platforms as a Structural Threat Beyond the cost and pricing squeeze, other factors are compounding the profitability problem. Chief among these is competition from SaaS website platforms. Vajda noted that when hosts were asked separately what causes customer churn, SaaS platform competition came in at number two. Platforms like Shopify and Webflow are pulling customers away from traditional web hosting, particularly from WordPress hosting, and this represents a structural shift rather than a cyclical one.

He also flagged increasing complexity of security and compliance requirements as an additional cost and operational burden, further compressing margins from yet another angle.

The Agency Angle on SaaS Competition Vajda drew out an implication specifically for agencies. If you already build and manage sites on Shopify, Webflow, or similar platforms, you are better positioned than many traditional hosts when it comes to SaaS-driven migration, because you can continue doing the work regardless of which platform it sits on. The hosting provider loses the customer; the capable agency may actually gain work or retain it.

He also used this as a signal moment for agencies that currently operate exclusively within the WordPress ecosystem. He described the SaaS platform encroachment data, combined with the emerging wave of AI-driven website building tools, as a signal worth paying attention to. Not necessarily a cause for alarm, but something to monitor and to start exploring how the agency can evolve or benefit from the shifting landscape.

How Hosts Are Responding: Moving Upmarket and Diversifying

VPS and Dedicated Servers Become the Strategic Focus Faced with thinning margins in shared hosting, the industry's dominant strategic response is to move upmarket. VPS (Virtual Private Server) and dedicated server offerings are now the

primary area of focus and investment for hosting providers. Shared hosting is still present and commercially relevant, but the direction of travel is clear.

Competing on Value, Not Price What Vajda found particularly interesting in the data is not just that hosts are moving into VPS, but how they choose to compete once they are there. Only 14% of hosting providers said they primarily compete on price in the VPS market. The large majority are competing on value in various forms: fully managed services, excellent customer support, bundled security tools, performance enhancements, and additional features.

This is a meaningful signal for agencies. It means that the VPS hosting market is trending toward better-featured, better-serviced offerings rather than a race to the bottom on price.

Vajda's practical advice was that agencies using managed VPS plans should keep evaluating their options, because better value bundles will continue to become available and it is worth making sure you are not sitting on an outdated or overpriced plan when something significantly better is on the market.

For agencies that manage their own VPS or dedicated servers, he noted that the underlying tooling and infrastructure is actively improving, with significant investment flowing in from companies like CloudLinux specifically targeting VPS server performance and security.

The Professional Services Opportunity One of the more surprising data points from the report, by Vajda's account, is that 50% of hosting providers are now looking to add professional services to their portfolio. These are the kinds of hands-on, relationship-intensive services that agencies deliver as their core business: site maintenance, content management, performance optimisation, security management, and similar ongoing work.

Vajda explicitly reframed what might look like a competitive threat as a partnership opportunity. His reasoning was that running professional services is a fundamentally different business model from selling hosting plans. Hosting is infrastructure at scale; services are skilled, relationship-driven work. Hosts will discover quickly that building a full service delivery arm from scratch is difficult and different from what they know how to do well.

The opportunity, as Vajda described it, is for agencies to approach hosting providers proactively and propose a delivery partnership: the host brings the customer relationship and can sell the service; the agency delivers the work efficiently using established workflows; revenue is split. The customer also benefits by getting a higher quality of service. He described this as a three-way win.

What Hosts Think Customers Care About Most

Hosts were asked in the survey what they believe are the most important selection criteria for customers, particularly agency customers, when choosing a WordPress hosting provider.

Their top three answers were: Speed and performance Price Support quality Vajda acknowledged that this ordering reflects how the industry currently thinks about what customers prioritise. He also used it to make a pointed observation about security: it does not appear prominently on this list, which he described as a frustration and a concern. In his view, security is treated as an afterthought during normal operations but immediately becomes the most critical issue the moment an incident occurs. He framed a significant part of his professional mission as working to shift this mindset so that the hosting and agency ecosystem takes security seriously as a baseline priority rather than as a reactive concern.

He invited attendees to share in the chat if their own selection criteria differ meaningfully from this list, expressing genuine interest in hearing from the agency community on the point.

The Support Queue and the Services Overlap

The report also asked hosting providers what issues dominate their customer support queues. The top four categories were closely clustered in the data: Email problems CMS issues Site speed and performance Security incidents Vajda pointed out that these are the same categories of problems that agencies deal with regularly on client sites, and that agencies generally know not only how to resolve them but how to prevent them in the first place. He described this overlap as the core business case for host-agency collaboration on professional services.

His logic runs as follows: support tickets are cost centres for hosting providers. Every ticket they handle eats into margin. The best possible outcome for a hosting provider handling a support ticket is to turn that interaction into a sale of a recurring maintenance or managed service plan. An agency can be the delivery engine for exactly that upsell, stepping in as the service provider while the host handles the customer relationship and billing.

Security: An Accelerating Threat Landscape

The Top Security Challenges for Hosts When hosting providers were asked which security challenges create the most overhead and risk, the top two answers were: Vulnerable plugins Malware infections Vajda noted that these two are directly connected: open plugin vulnerabilities are the primary entry point for malware infections in WordPress environments. Address one and you significantly reduce the other.

AI Is Changing the Threat Landscape Fundamentally The security section of the presentation was the one Vajda treated with the most urgency.

His central point was that AI tools are fundamentally and rapidly changing the threat landscape, and the implications have not yet fully landed across the web ecosystem.

He gave a specific example: Anthropic (the company behind the Claude family of AI models) recently announced a model that is so capable at finding software vulnerabilities that it was made available only to a select group of defensive security companies. Vajda's point about this was not about that specific model in isolation, but about what it implies about the trajectory of AI development. Whatever capability exists in a frontier model today tends to become available in open-source models within six to twelve months. At that point, the capability is not limited to a small group of vetted defenders; it is available to any attacker anywhere in the world.

That means that within a relatively short timeframe, tools capable of finding and exploiting software vulnerabilities at scale will be in the hands of malicious actors globally. CloudLinux is already observing this trend in its threat data.

Quantifying the Scale of the Problem To give a concrete sense of the acceleration, Vajda cited CloudLinux's own malware processing data: they saw approximately a 150% increase in the number of malware samples processed over just a few months. He described this as a startling rate of growth that illustrates how quickly the threat volume is expanding.

What This Means for Patching and Plugin Hygiene The direct operational implication is that the old model of weekly or monthly patching cycles is no longer adequate. The speed at which new vulnerabilities are being found and exploited means that the window between vulnerability disclosure and active exploitation has shortened dramatically.

For agencies, Vajda's message was direct: plugin and theme hygiene across your entire client portfolio is now a genuine ongoing business risk, not a routine maintenance item. The cost of getting this wrong is reputational damage, not just a technical incident.

CloudLinux's Response: Imunify and Virtual Patching Vajda described CloudLinux's approach to this problem within their Imunify security product suite. The core strategy is to use the same AI tools that are available to attackers in order to find potential exploits and roll out automatic protections for users before those exploits can be weaponised at scale.

A recent specific release he highlighted is a new web application firewall component built specifically for WordPress, targeting plugin vulnerabilities. The key feature is virtual patching: the system applies a protective layer at the server level that covers a known vulnerability while the site owner or agency administrator has time to properly update the plugin to a patched version. This buys time and reduces exposure without requiring an immediate emergency update.

His advice to agencies was straightforward: if you are on managed hosting, check whether your hosting provider has a comparable capability in place. If you manage your own VPS, look at installing something equivalent directly. The main message, as he put it, was that the industry needs a plan to address this threat category, because the ecosystem has not yet fully internalised what is coming.

If you manage your own VPS, look at installing something equivalent directly.

AI in the Hosting Industry: Adoption, Ambition, and What It Means for Agencies

Where Hosting Providers Currently Stand Hosts were asked where AI is currently showing up in their businesses. The two most common use cases are: Customer support (chatbots, reply suggestions, ticket routing and classification) Customer-facing AI tools (website builders, content creation assistants) A notable data point alongside this is that 27% of hosting providers have not yet implemented AI in any meaningful way. Vajda used this to push back against any assumption that the hosting industry is uniformly ahead of agencies on AI adoption. A full quarter of hosts are still at the starting line.

That said, he was careful not to let this serve as grounds for complacency. His framing was that the gap between AI adopters and non-adopters is widening rapidly, because AI 1.

capabilities are improving fast. The question for any business in 2026 is not whether to use AI but how to extract the most value from it.

What Hosts Want AI to Do Next When hosting providers were asked what areas of AI application would bring the most value to their businesses, the top two answers were: Automated security and malware detection Predictive performance monitoring Vajda read the top answer as a positive signal that most hosting providers understand the security threat acceleration described earlier. It also provides a clear indicator of where product investment will flow across the hosting tooling ecosystem in the near term, which in turn means these capabilities will increasingly show up in the tools agencies already use.

The second answer, predictive performance monitoring, aligns naturally with the established importance of site speed and uptime across every segment of the data.

A Framework for Agencies: AI Inside vs. AI in the Service Menu Vajda closed the AI section with a practical framework he recommended for agencies thinking about how to deploy AI. He split the opportunity into two distinct categories.

AI inside your agency (internal operations) This covers the workflows where AI-powered tools can make your team faster and your delivery cleaner, without necessarily changing what you sell or to whom. Examples he highlighted: Client proposals and scoping: AI can dramatically reduce the time from brief to quote and allow agencies to send more proposals without expanding headcount.

Code generation and review: For agencies doing custom development, AI code tools can accelerate delivery while also catching issues that improve quality.

Client reporting: Monthly or quarterly reports that might previously take a full day per client can now be produced in an hour or less with the right automated workflow in place.

Automated security: Intelligent protection layers that catch the latest threats without requiring manual intervention for every incident, because manual monitoring of the evolving threat landscape is no longer feasible at scale.

Support triage: Auto-classification of incoming client tickets so that the right person sees the right issue immediately, with relevant context already surfaced and potentially a suggested response already drafted.

AI in your service menu (commercial opportunity) 1.

This covers new services you can now sell and existing services whose economics have shifted enough to reach customer segments that were previously not viable. Examples he highlighted: SEO and GEO services: Generative Engine Optimisation (GEO) is emerging as its own service category, reflecting client awareness that visibility in AI-generated search answers matters alongside traditional Google rankings. This can be packaged as a recurring monitoring and optimisation retainer.

Content operations: The unit economics of managed content plans have shifted dramatically. What previously required a dedicated writer per client can now be handled by a single editor covering multiple clients, making managed content viable at SMB price points.

AI-assisted site design and build: Lower-cost SMB site builds that previously did not make economic sense for agencies now may, because AI tools reduce the time involved substantially.

AI-driven performance monitoring and optimisation: Proactive monitoring plans where AI tooling handles the ongoing watch function and human judgment is applied only when something requires it.

Site migration and modernisation: Migrations that used to be complex, time-intensive projects can increasingly be turned into automated workflows, reducing cost and making them easier to sell and deliver.

Vajda's overall prompt was for agencies to ask, in both categories: what is possible now, with AI assistance, that was not doable before? Then start building from that answer.

Four Data-Backed Moves for Agencies: The Recap

Vajda concluded the presentation by distilling the report into four specific, actionable moves he recommended agencies make within the next quarter. He framed these as practical steps grounded directly in the data rather than general strategic advice.

Move 1: Evaluate your hosting plan. With significant investment flowing into VPS offerings and value-added managed services, it is worth auditing whether your current plan is still the right fit. Make sure you have access to the latest tooling and that you are not overpaying relative to what is now available in the market.

Move 2: Open a services conversation with one hosting provider. Pick a host whose customer base resembles yours, in terms of size, geography, or niche. Make contact, whether by email or a call, and start exploring whether a professional services partnership makes sense. Vajda was direct: many hosting providers are actively looking for partners to help them deliver services they are not equipped to deliver on their own.

Move 3: Run a security audit across your client portfolio. Identify what is outdated, what is exposed, what your hosting provider actually covers at the infrastructure level, and

where the gaps are that you need to address directly. Plugin vulnerabilities are the leading operational risk in WordPress environments. The reputational cost of a client site being compromised is the agency's to bear, so this audit needs to happen and a plan needs to be in place to maintain hygiene on an ongoing basis.

Move 4: Automate one internal workflow or launch one AI-assisted service line. If you have the capacity, do both. If not, pick one direction and start there. The core message is that doing nothing is the one unacceptable outcome in 2026. Any one of these moves, by Vajda's reckoning, puts an agency in a better position than none of them.

Make sure you have access to the latest tooling and that you are not overpaying relative to what is now available in the market.

Related Announcements

Full Hosting Trends Report The complete 2026 State of Web Hosting report is approximately 40 pages and covers all of the material from the presentation in greater depth, along with additional data not touched on in the session. It is available to download from the CloudLinux website via a QR code displayed during the presentation and a direct URL.

State of WordPress Agency Survey Vajda announced that CloudLinux has just launched a companion survey specifically targeting WordPress agencies. The survey is designed to help CloudLinux understand how agencies host client sites, what their most challenging workflows are, which services are growing, and how CloudLinux can better serve the agency segment with its products. The survey takes approximately eight minutes to complete and all respondents will receive the full report when it is published. Vajda specifically encouraged summit attendees to participate.

Q&A and Closing

The Q&A portion of the session was brief and somewhat disrupted by technical issues on the host side. The session MC, Andrew, experienced connection problems and was temporarily replaced by co-host Steph. There were no specific audience questions captured in the transcript. Steph thanked Vajda for the presentation and encouraged attendees to use the QR code to take the WordPress agency survey. Vajda thanked the audience and the session concluded.

About the speaker Akos Vajda Marketing Manager, CloudLinux

Akos Vajda is Marketing Manager at CloudLinux, where he works on research and reporting covering the web hosting industry, including the joint CloudLinux and WebPros industry report.