Do I need hosting with WordPress?

Yes, if you mean the WordPress software from WordPress.org. It's a PHP application that needs a web server, PHP and a MySQL or MariaDB database running somewhere, and whoever runs those for you is your hosting. No, if you use WordPress.com or another hosted service, because the server is bundled into the plan. There's a middle ground that surprises people: you can develop on your laptop or even in a browser tab with no host at all, and you can publish the public site as static files, but the WordPress admin still needs a live server somewhere.

Last verified: 2026-10-29.

A note on method and disclosure. I work on VeloCMS, and this post lives on its developer blog, so VeloCMS appears below as one option among several, with its weaknesses listed. Every number I quote was read from the linked vendor or documentation page on 2026-10-29. Where a page wouldn't give me a number, I left it out. Prices are in US dollars as the pages showed them to me, and they vary by region and promotion, so treat them as a map rather than a quote.

What does the WordPress software actually need to run?

Strip off the branding and WordPress is a PHP program that keeps its content in a relational database. The requirements page recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS support. It names Apache or Nginx as the recommended servers while allowing that "any server that supports PHP and MySQL will do", and the sample message it suggests sending to a host mentions the mod_rewrite module for Apache. The current download is WordPress 7.1.4 (wordpress.org/download). The same requirements page says older stacks, PHP 7.4+ and MySQL 5.5.5+, still work but are end of life and may expose your site to security vulnerabilities.

The Hosting Handbook is more specific, and a little stricter. It lists json, hash and mysqli as the required PHP extensions, then a longer "highly recommended" set that includes curl, dom, exif, fileinfo, imagick, intl, mbstring, openssl, xml and zip. It suggests one object-cache extension (APCu, Memcached or Redis) plus opcache, a memory_limit of at least 128M with 256M as the recommended default, and PHP 8.4 or later for production. So two official pages disagree by one minor version: 8.3 on the download page, 8.4 in the handbook.

Which one should you follow? PHP's own supported versions page is a useful tiebreaker. PHP 8.3 stopped getting active support on 31 December 2025 and gets security fixes until 31 December 2027. PHP 8.4 has active support until 31 December 2026 and security fixes until 31 December 2028. PHP 8.2's security support ends on 31 December 2026, two months from now. My opinion: on a new server, start at 8.4 or 8.5 and test your plugins against it before launch. Nobody enjoys a forced PHP upgrade in the week their host retires a version.

The dependency list for the install itself is short. The install guide says to create a database and a MySQL or MariaDB user with full privileges on it, upload the WordPress files to your web server, optionally copy wp-config-sample.php to wp-config.php and add your database details (or let the installer write it), and open the install URL in a browser. It calls this a five-minute job "under most circumstances". That is the whole graph: web server, PHP, database, a place to put files. "Hosting" just means somebody keeps those four things running and reachable from the internet.

Does WordPress have to use MySQL?

Officially, WordPress uses systems compatible with MySQL, and every host and plugin author assumes that. One exception is in the making. The SQLite Database Integration plugin swaps the database layer for SQLite while WordPress keeps its normal wpdb API. It calls itself a community feature plugin meant to test SQLite, with the goal of eventually landing in core. Its FAQ allows production use but says to "keep reliable backups and make sure SQLite is a good fit for your site's traffic", since SQLite allows only one writer at a time, and enabling it starts a fresh installation rather than migrating an existing site. Treat it as an experiment, not a reason to stop budgeting for MySQL.

What does "hosting" mean in practice?

Four shapes cover nearly everything, and they differ in who does the server work.

Shared hosting gives you a slice of someone else's server with PHP and a database already configured, usually with a control panel and a one-click installer. WordPress.org's hosting page says the vast majority of hosts meet the minimum requirements and lists Pressable (owned by Automattic), Bluehost and Hostinger as recommended, adding that some listed hosts pass part of your fee to WordPress.org when you sign up through its links. That's disclosed rather than hidden, but it means "recommended" has a commercial side. I haven't priced shared plans today. When you do, compare the renewal price, not the introductory one.

Managed WordPress hosting is the same idea with the sysadmin work pushed further onto the vendor: caching, staging, backups and updates are part of the product. The entry plans I could read were Kinsta at $30 a month billed annually ($350) or $35 billed monthly for one WordPress install, with 10 to 15 GB of storage depending on the plan, and WP Engine Essential at $28 a month billed annually ($336 due up front), which its footnote calls first-year pricing for new customers, with renewal pricing subject to change. Both vary what a tier includes by traffic and storage, so read the exact tier you'd buy.

A VPS or cloud instance is a blank Linux box. You install Nginx or Apache, PHP-FPM, MariaDB, TLS certificates and a firewall, then WordPress on top. DigitalOcean's Basic Droplets start at $4 a month for 512 MiB of RAM, 1 vCPU and 10 GiB of SSD, then $6 for 1 GiB and 25 GiB, and $12 for 2 GiB and 50 GiB. I won't tell you which size runs your site; that depends on traffic and plugins, and I found no official RAM figure for WordPress. The box is cheap. Your time isn't.

Containers are a flavour of the last one. The official WordPress image on Docker Hub doesn't bundle a database. It expects a MySQL-compatible server that already contains the database named in WORDPRESS_DB_NAME, plus connection settings in WORDPRESS_DB_HOST, WORDPRESS_DB_USER and WORDPRESS_DB_PASSWORD. Its examples map host port 8080 to container port 80 and mount a volume at /var/www/html, where WordPress is copied on first start. Tags exist for PHP 8.2 through 8.5, and latest points at the PHP 8.3 Apache build. The -fpm variants need a reverse proxy in front, and the page warns against publishing the FastCGI port because FastCGI is "inherently trusting".

services:
  db:
    image: mysql:8.4
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wp
      MYSQL_PASSWORD: change-me
      MYSQL_RANDOM_ROOT_PASSWORD: "1"
    volumes: [db:/var/lib/mysql]
  wordpress:
    image: wordpress:php8.4-apache
    ports: ["8080:80"]
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: wp
      WORDPRESS_DB_PASSWORD: change-me
      WORDPRESS_DB_NAME: wordpress
    volumes: [wp:/var/www/html]
    depends_on: [db]
volumes: { db: {}, wp: {} }

That sketch follows the variable names on the image page, but the page's own example pins mysql:8.0, which the Hosting Handbook's version table lists as reaching end of life in April 2026, so I used 8.4 (both tags, mysql:8.4 and wordpress:php8.4-apache, exist on Docker Hub as of today). It's a starting point for a laptop or a VPS, not a production hardening guide. You still own TLS, backups and updates, which is the part containers don't remove.

Can you run WordPress without hosting at all?

For development and experiments, yes, three ways.

wp-env is the official local tool. The handbook page describes it as a way to "easily set up a local WordPress environment for building and testing plugins and themes". It's a Node script, powered by Docker by default, and also wants git. wp-env start brings the site up on port 8888, wp-env stop frees the ports, and wp-env destroy removes the containers, volumes and local files, which the page warns permanently deletes your posts, pages and media. The default login is admin with the password password, which is fine on localhost and a reason never to expose that environment.

WordPress Playground needs no install. The developer docs say it "runs entirely client-side in WebAssembly" with "no authentication, no backend required", and describes it as isolated to the browser with no persistent side effects outside the sandbox. The product page describes testing GitHub pull requests in the browser, switching WordPress and PHP versions, and sharing sites from Blueprints. I couldn't confirm from those pages how long your changes persist, so don't keep anything there you can't recreate.

Local (localwp.com) is a desktop app with a "Download for Free" button, published by WP Engine, which also promotes its own hosting on the page. The page text I could read said little else, so I won't describe its internals.

None of these is a way to run a public site. They're a way to learn, build and test with zero monthly cost, then move the result to a server (or a static host, below) when it's time to publish.

Can you skip the PHP server in production?

Partly. You can skip it for your visitors. You can't skip it for yourself.

The first route is a static export. Simply Static is a plugin that "turns your WordPress site into secure, lightning-fast static HTML files": the exported copy serves no PHP and uses no database. The free version exports a ZIP or deploys to a local directory. The Pro plan, $99 a year per site, adds deploys to GitHub, Netlify, Cloudflare Pages, AWS S3, BunnyCDN or SFTP, plus forms and search. A Studio plan at $12 a month per site bundles managed WordPress hosting with static hosting on a CDN. The plugin's own page is blunt about the limits: forms, search and comments don't work in the free version, and it's "Not Suitable For" e-commerce, membership sites, user logins or real-time data. The plugin needs WordPress 6.2+ and PHP 7.4+ on the machine that does the exporting, which is the point. WordPress still runs; it just runs somewhere private, like your laptop, a small private server, or the Studio plan.

The second route is headless WordPress. The REST API handbook says the API lets you "bring your WordPress content into completely separate applications" and build a new front end. WPGraphQL is a free, GPL-3 plugin that offers a GraphQL schema for any WordPress site and says it "separates your CMS from your presentation layer", listing Next.js, Gatsby, Vue and Svelte as supported frameworks. Your editors keep the admin they know, and your public front end can be a Next.js or Astro site on a static or edge host.

The catch is operational. You've swapped one deployment for two: a WordPress instance that has to stay online for builds and previews, and a front end with its own pipeline. Plugins that render on the front end (forms, shortcodes, page builders) won't carry over automatically, and you still maintain the WordPress server's updates and backups for a site your readers never touch. Headless suits a team with a reason to leave PHP templates behind. As a way to dodge hosting, it fails, since it only hides the server from visitors.

Does WordPress.com mean you don't need hosting?

Right. WordPress.com's comparison page says "Managed hosting is built-in. You don't need any other hosting provider", with updates, backups and SSL for a free domain handled automatically, while on WordPress.org you "must find and pay for a hosting provider yourself".

The pricing page lists these tiers. Free is $0 with 1 GB of storage, a WordPress.com subdomain, no custom domain and no plugin installs. Personal is $4 a month billed annually ($9 monthly) with 6 GB. Premium is $8 ($18 monthly) with 13 GB. Business is $25 ($40 monthly) with 50 GB, and Commerce is $45 ($70 monthly). A free domain for the first year comes with annual and multi-year terms. The FAQ says plugin installation is available on "every paid WordPress.com plan", and cites tens of thousands of plugins (the page itself says both 60,000+ and 50,000+). The plan features page puts "install plugins, upload theme files" at Personal, and real-time backups, SFTP/SSH access, database management and staging sites at Business.

So what do you give up? Mostly root. You work inside a vendor's rules: which plugins are compatible, what the plan allows, when SFTP access appears. The comparison page notes that WordPress.com blocks potentially risky plugins proactively, which is a safety feature if you're a blogger and a constraint if you're a developer. What do you gain? No apt upgrade, no PHP version decisions, no 3 a.m. disk-full alert. If your goal is a WordPress site rather than a WordPress server, it's a legitimate answer to the question in the title.

What do you have to do yourself on self-hosted WordPress?

The software is free. The upkeep isn't, and it falls into four buckets.

Updates. The upgrade docs say automatic updates are enabled on most sites. Core minor releases update by default, and new installs created since WordPress 5.6 also get automatic major updates (existing installs keep the older minor-only behaviour). Plugins and themes update automatically only "in special cases" by default. That sentence is the one that bites. A typical site carries plugins and a theme that nobody updates unless someone logs in and clicks. The docs also call disabling the default minor-release and translation updates "strongly discouraged", and note that AUTOMATIC_UPDATER_DISABLED switches off every automatic update.

Backups. The backup guide says there are two parts, the database and the files, and you need both to restore. It suggests weekly backups for small sites and daily for busy ones, keeping at least three to five recent copies in different locations, and checking an automated backup with a manual one once in a while. A backup you've never restored is a hope, not a backup.

Runtime upgrades. PHP versions expire on a published schedule (dates above), and a host may force the move before your plugins are ready. On your own VPS, the operating system, web server and database are on your calendar too.

Security. Most of the attack surface is plugins. Patchstack's State of WordPress Security in 2026 report says plugins accounted for 91% of the 11,334 new vulnerabilities it counted in 2025, with 6 in core. I haven't audited its method. The practical reading doesn't need the exact figure: every plugin is code you must keep current.

Managed hosts and WordPress.com take much of this off your plate, which is a lot of what you pay for. Plugin updates are often still yours.

What does each path cost per month?

Rough ranges from the pages above, before domains, paid plugins and taxes:

• Local, wp-env or Playground: $0, and not for publishing.
• Static export plus a free static host: $0 for hosting, but the WordPress that produces the export still has to live somewhere. Simply Static Pro is $99 a year per site if you want automated deploys.
• Small VPS you run yourself: $4 to $12 a month on DigitalOcean's cheapest Basic Droplets, plus your own time.
• Managed WordPress host: about $28 to $35 a month at the entry plans I read (WP Engine Essential and Kinsta).
• WordPress.com: $0 on Free; $4 to $25 a month billed annually on the plans from Personal to Business.
• Shared hosting: I haven't priced it today, so no number here.

The cheapest line isn't always the least expensive one, because your hours are the real cost.

When don't you want WordPress at all?

The honest case for leaving WordPress isn't that it's bad. It's that some people want to publish and not run a PHP server, a database and a plugin chain. These are the main ways to do that. Each entry is deliberately about the same length so you can compare them fairly.

Ghost(Pro)

Ghost is a publishing platform built around a newsletter and memberships. You can self-host it or pay for Ghost(Pro). The pricing page lists Starter at $18 a month, Publisher at $29 and Business at $199, each labelled "Billed yearly", with a monthly/yearly toggle and an audience-size slider. I couldn't read a monthly-billing figure, so I'm not quoting one. At the default slider all three cards show 1,000 members, while the comparison table gives Business 10,000, so check which limit applies to the audience you actually have. Each paid tier has a "Try for free" button with no trial length stated. The install docs recommend "an Ubuntu server with at least 1GB of memory" if you self-host, which puts the server back in your hands. Strength: a focused product with no plugin chain to patch. Weakness: it's a publishing tool rather than a general website builder, and pricing follows your audience size.

Hashnode

Hashnode is a developer blogging platform (and the host of this post). The Free plan is $0 with no expiry and includes a hosted blog on a hashnode.dev address, unlimited posts and a Markdown editor. Pro is $5 per seat per month and adds a custom domain with SSL, the headless GraphQL API, GitHub backup, scheduled posts and removal of Hashnode branding. Growth is $34 a month and adds AI-citation tracking. Strength: free to start, developer-friendly, content in Markdown. Weakness: it's a blog on someone else's platform, the headless API and custom domain sit behind Pro, and it's not designed for stores or complex sites.

A static site generator on free static hosting

Tools like Astro, Hugo, Eleventy or Jekyll turn Markdown into plain files, and the files need no PHP server. Three common hosts, with their limits as published. Cloudflare Pages on the Free plan allows 500 builds a month, 20,000 files per site and 25 MiB per asset; its overview page also says Workers "supports most Pages use cases" and to "Start new projects with Workers", so read the current guidance before you pick. GitHub Pages allows sites up to 1 GB with a soft 100 GB monthly bandwidth limit, and says it isn't intended as a free host "to run your online business". Netlify has a $0 Free plan with 300 credits, plus Personal at $9 and Pro at $20 a month with more credits; the page doesn't say what happens at the cap. Strength: almost nothing to patch, no database, version control as your backup. Weakness: you need a technical editor and a workflow, and non-developers can't easily edit.

VeloCMS

VeloCMS is a hosted blog, newsletter, membership and store platform. Pro is $9 a month ($86.40 a year), Business $29 ($278.40) and Agency $69 ($662.40). There's no free plan. Every plan starts with a 14-day trial that needs a card unless you hold a cardless trial code, and the first charge lands on day 15. There's a 0% VeloCMS platform fee on Stripe sales, though Stripe's processing fees still apply. Its comparison page says plainly that it's a proprietary managed SaaS, not open source, and self-hosting isn't offered; only the plugin SDK, CLI and MCP server are MIT licensed. Strength: nothing to host, patch or back up yourself. Weakness: a young product with a much smaller ecosystem than WordPress, and no plugin marketplace anywhere near its scale (the marketplace page shows first-party integrations and I found no third-party submission path on it).

Which path fits which developer?

• Self-hosted WordPress on shared or managed hosting: best if you need a specific plugin or theme ecosystem and want the host to carry most of the server chores.
• Self-hosted WordPress on a VPS or containers: best if you want root, version-pinned infrastructure and reproducible deploys, and you'll own updates, backups and TLS.
• WordPress.com: best if you want WordPress's editor and plugins with zero server work, and a vendor's rules are acceptable.
• WordPress as a static export or headless backend: best if you already have a front-end pipeline and a reason to take PHP out of the visitor's path, and you accept running WordPress privately.
• Ghost(Pro): best if the newsletter and memberships are the business and the plugin world isn't needed.
• Hashnode: best for a developer blog that should cost nothing to start and stay in Markdown.
• Static generator on a static host: best if you're comfortable in Git and want the smallest attack surface and the lowest bill.
• VeloCMS: best if you want blog, newsletter, membership and store behind one login and don't need WordPress's plugin depth.

When is VeloCMS the wrong pick?

Often. If you want a free plan, it isn't one, because the lowest entry is a card-backed trial and then $9 a month. If a particular WordPress plugin is the reason you're here, or you want a codebase you can fork or self-host, WordPress, Ghost or a static generator will serve you better. If your site is a large publication with years of WordPress content and custom workflows, the comparison page itself says to "plan a migration project rather than a casual switch" if you run an established WordPress business, and it lists WordPress as still leading on plugin breadth ("genuinely unmatched"), deep multilingual support and highly customized editorial-review workflows for very large teams. And if you're deciding specifically because you want to learn server operations, a VPS and a Docker Compose file will teach you more than any subscription.

FAQ

Can I run WordPress on my own computer for free?

Yes. wp-env (needs Docker and Node), Local and WordPress Playground all run WordPress without a hosting account, per their official pages above. They're for development and testing, not for serving the public.

Can I host WordPress for free?

The nearest official answer is the WordPress.com Free plan: $0 with 1 GB of storage, a WordPress.com subdomain, no custom domain and no plugin installs (wordpress.com/pricing). I haven't verified any free PHP hosts, so I won't name one.

If I buy a domain, do I still need hosting?

Yes. A domain is just the address. Something still has to answer requests at that address, whether that's a WordPress host, a WordPress.com plan, or a static host.

Can I put WordPress on GitHub Pages or Cloudflare Pages?

Only as a static export, because neither runs PHP or a database. Simply Static's Pro plan lists deploys to GitHub, Netlify and Cloudflare Pages, but forms, search and comments need extra work, per the plugin page. GitHub Pages' terms also say it isn't meant to host an online business (GitHub docs).

Which PHP version should I run?

The WordPress download page recommends 8.3 or greater, and the Hosting Handbook recommends 8.4 or later for production. PHP.net lists 8.4 with security support until 31 December 2028, so it's the safer starting point for a new server (php.net).

Does VeloCMS have a free plan?

No. It has a 14-day trial, a card is required unless you have a cardless trial code, and the first charge is on day 15 (velocms.org/pricing).