Cart: hosting €4.99/month. Total: €12.47 — SiteLock enabled, daily premium backup, "pro" SSL certificate. Uncheck? Red arrows "your site without protection." This is not optimal security: it is often a conversion funnel where fear sells redundant or free-elsewhere options.
Shared hosts monetize security via add-ons: basic WAF, malware scan, paid SSL, extended backup. Some protections are useful for non-technical teams; others duplicate Cloudflare, Let's Encrypt, or backup policy already in place. This inquiry helps you tell the difference before validating the cart.
Security add-on map
| Add-on | Real utility | Alternative |
|---|---|---|
| Host WAF | SMB without CDN | Cloudflare, Fail2ban on VPS |
| Malware scan | Unpatched shared hosting | Updates + integrity monitoring |
| Premium SSL | EV or legacy panel cases | Let's Encrypt |
| Premium backup | Long retention | Restic + object storage |
| "IP protection" | Vague marketing | Documented cloud firewall |
Before checkout, list existing security layers. A useful add-on fills a proven gap — not a fear checkbox enabled by default.
Aggressive upsell signals
Several signs reveal a fear-driven model rather than measured protection.
Options pre-checked on automatic renewal. Paid SSL when Let's Encrypt is freely available on the same panel. Billed WAF without exploitable logs to diagnose false positives. Undetailed "security" bundle — impossible to know what you actually pay for.
Paying twice for the same layer (host + external service) is the silent SMB mistake.
The summit: fear is a line item
Decide and move forward without blind spots
Run checkout dry and note total with no options checked — that is your reference. Compare with an equivalent stack you would build: Let's Encrypt, free Cloudflare, Restic backups to object storage. If the gap does not justify measurable gain, uncheck. Cross-check with the anti-DDoS and included backups inquiries, then compare hosts via our directory.
Frequently asked questions
Are security options at checkout mandatory?
Rarely contractually, but often pre-checked. Uncheck and compare Let's Encrypt, free Cloudflare, and self-managed backups before paying duplicate layers.
Does a host WAF replace Cloudflare?
Frequent partial overlap. With external WAF already running, check rules, logs, and annual cost — host option may be purely redundant.
Should you pay for "premium" SSL?
No for standard public sites. Premium useful for EV, legacy panels, or guaranteed renewal support — not standard Let's Encrypt.
How do you choose premium vs included backup?
Compare retention, self-service restore, and frequency. Premium justifies if included covers only seven days without granular restore.
Cart total > 2× displayed price? Audit checked boxes — not the "from" landing page.