Megaphone Commons

{{last_updated_at}} by {{last_updated_by}}

# Where to host CiviCRM

[Still a work in progress - apologies!]

## Introduction

I'm often asked by clients where to host their CiviCRM.  This guide is intended for both my clients and members of the public to guide their decision.  Hosting charges are a combination of paying for **server resources** and **labor for maintenance**.

## Main questions to ask

* Do you have someone capable of maintaining/upgrading CiviCRM?  If not, you need to *contract with someone who can maintain/upgrade CiviCRM*.  Many include hosting (server resources, maintenance labor, or both) in their package.

* How much data are you storing?  Usually I measure this in "number of contacts", which is a good-enough proxy.

* Are you OK with a site that can be sluggish at times?

* Do you have unusually high security/privacy concerns?

* Do you have someone available who is able to maintain the underlying server - e.g. update the operating system, monitor backups, etc.?

* Do you have someone available who is able to maintain updates for CiviCRM and your CMS (i.e. WordPress, Drupal, Backdrop)?

## Types of hosting to consider

* **Shared hosting** - *poor to medium speed, server maintenance included*

* [CiviCRM Spark](https://civicrm.org/spark) - *good speed, server maintenance included* - but capped at 5,000 contacts, can't install extensions.

* **Virtual Private Server (VPS)** - *excellent speed, server maintenance NOT included*

* **Managed VPS** - *excellent speed, server maintenance IS included*

* **Specialty hosting** exists, but I don't have enough experience to speak to it.

### Shared hosting

Used for small sites.  Hosting companies maintain large servers and cram in as many customers as possible. Quality of hosting varies widely; you generally get what you pay for (except GoDaddy, which is high-priced for poor service).

Because of overbooking, speed is generally poor. Also, if one customer gets a huge influx of traffic, everyone else's performance suffers.  Server restrictions can lead to unexpected headaches.  I recommend *not* using shared hosting unless it's with a company that certifies that they can handle CiviCRM, like [CiviHosting](https://www.civihosting.com) or [LiquidWeb](https://www.liquidweb.com/).  I haven't used either and can not vouch for them, but would consider them for clients under 10,000-15,000 contacts.  **Cost is $3-10/month** for bad hosting, **$15+/month** for CiviHosting.  The main advantage is that *server maintenance is included*.

### CiviCRM Spark

[Spark](https://www.civicrm.org/spark) is a specialized "starter" CiviCRM service - but if your needs are simple, it may be a good permanent option. **Cost is $9.50-14.50/month**. *Server maintenance is included*.

### Virtual Private Servers (VPS)

VPSes guarantee your resources, so you can run CiviCRM at maximum speed.  However, *server maintenance is not included*.  **Cost is $10-20/month** from companies like [Linode](https://www.linode.com) or [Digital Ocean](https://www.digitalocean.com), and is well-suited to CiviCRM.

The major cloud providers (Amazon Web Services, Microsoft Azure, Google Compute Engine) generally charge **$25-60/month** for the same service; they offer "enterprise" features that your typical CiviCRM doesn't need, and are far more complicated to set up.  However, Microsoft Azure has a non-profit program that gives **free credits ($3500/year)** to almost any 501c3.  Amazon has reduced-cost credits through [Techsoup](https://www.techsoup.com) - **$175/year for $2,000 in credits**.

I have a page that explains [How to get Microsoft Azure credits and technical setup](https://hq.megaphonetech.com/projects/commons/wiki/Azure_VPS_setup_notes).

### Managed VPSes 

Managed VPSes are like regular VPSes, but include server maintenance.  Maintenance can be from the hosting company or external.  24x7 management is **$60-100/month**.  I offer weekday management for **$25-35/month** as part of a larger [maintenance plan](https://www.megaphonetech.com/services/maintenance-plans).

### Enhanced security/privacy needs

Shared hosting is generally less secure than others regarding hackers; the rest are all comparable, though the enterprise cloud providers (Amazon, Microsoft, Google) have some features to simplify your security.  However, many people choose CiviCRM because they have special concerns with regard to their data being seized or illegally accessed by law enforcement.  If you're an organization with these concerns, server hosting is no longer a commodity service.  It's a relationship, and should be treated as such.

[May First](https://www.mayfirst.org) is a cooperative based in the US and Mexico, and includes shared hosting with membership ($100/year for individuals, $200/year for organizations) and managed VPSes ($50-150/month).  VPS performance is relatively poor, but is also a potential cheap managed VPS option.  

[Koumbit](https://www.koumbit.org/en) is based in Canada, and offers VPSes comparable to Linode for roughly twice as much.  

I will vouch for both of them to take the maximum (legal) effort to protect your data from law enforcement.  Be sure to speak to them about your specific needs.

### Other specialty hosting

Some organizations use a managed host like Pantheon ($35+/month).  This gives decent performance and managed servers, but you need to do things the "Pantheon way". While Pantheon is a workable solution, there are several workarounds you must implement to get the service to work.  E.g. you need an external service if you want mail to go out more than once an hour, their "copy database to the test/development" site functionality doesn't work without additional steps, etc.  I personally don't recommend Pantheon unless you've contracted with an organization that is experienced with CiviCRM on Pantheon.

Ultimately, Pantheon is more expensive than other hosting primarily for benefits that accrue to developers, not users.

### Megaphone Tech maintenance plans

Almost all of my clients are hosted on unmanaged VPSes on Linode, Microsoft Azure, May First or Koumbit.  The majority opt for a [maintenance plan](https://www.megaphonetech.com/services/maintenance-plans) with me.  Others maintain the server themselves, or have a separate website vendor that does it.