How to vet a UAE hosting company before you pay: a due-diligence guide

Before paying for hosting marketed in the UAE, check five things: the contracting entity and its applicable registration, the written plan and renewal terms, the specificity of pre-sales answers, what a provider-approved endpoint can and cannot show, and your ability to recover the site and domain if you leave. A UAE office or trade name is not evidence that the ordered server or backups are in the UAE.

Illustrative scenario, not a reported customer case: a Sharjah business buys a multi-year “Dubai hosting” plan. Later, the site goes down and the business discovers that the domain is in the seller’s registrar account. Pre-purchase checks could have clarified domain control and contractual terms; they could not have predicted a future outage or support response.

By the end of this guide you will have a due-diligence checklist you can run on any UAE hosting company: licence checks, the clauses to read, a support test, technical checks with a few safe commands, backup questions, and an exit plan.

What due diligence means for hosting

Think of it like buying a used car. You check the papers are real, you read the warranty, you take it for a test drive, you look under the bonnet, and you make sure the ownership papers go in your name. Hosting due diligence is the same five habits, applied to a service your business will depend on every day.

These checks are not an accusation against any provider. They help you identify the entity, exact service and recovery responsibilities before committing to a term.

Before you start

• The provider's legal name. It is usually in the website footer, the terms of service or a sample invoice. It may differ from the brand name.
• The exact plan you are considering, with its name and price written down.
• A test site or demo address on the exact plan, if the provider offers one. If no suitable test exists, request a trial or a written scope; do not treat an unrelated customer website as proof of your ordered environment.
• A terminal (Terminal on macOS, a Linux shell, or Command Prompt on Windows) for the optional technical checks.
• About two hours, spread over a few days so you can see how support responds at different times.

Risk level: low for reading public pages and asking questions. Only test a site you own or have permission to inspect; avoid bulk requests or probes of unrelated customer sites.

Step 1: Confirm the company exists and is licensed

An official licence record is a useful identity check, not proof of service quality or a guarantee that a particular salesperson is authorised to contract for that entity. Match the legal name and licence details to the proposed invoice and ask about any mismatch.

Find the legal name

Look in the website footer, the terms of service and the contact page. Write down the exact legal name and any licence number shown. If you cannot find a legal name anywhere, ask sales for it in writing. A provider that will not tell you who you are contracting with has answered your question.

Search the official registries

Start with the current UAE government National Economic Register page. It describes enquiries about listed economic licences and links the recognised licensing authorities, including emirate departments. Follow the appropriate current authority link rather than relying on a copied app name or an old search URL.

Search using the exact contracting legal name and any licence number supplied by the seller. If a result is missing or ambiguous, check the issuing mainland or free-zone authority directly and ask the seller to explain the discrepancy. The register result does not verify the quality or physical location of a hosting service.

If the company says it is licensed in a free zone, ask which free zone and check with that free zone authority. If the provider is based outside the UAE, check the company registry in its home country.

Compare what you find

• The name on the licence matches the name on the terms and invoices.
• The licence status is active, not expired.
• The licensed activity fits IT, web hosting or related services.

Quick tip: search with and without words like "LLC" or "FZ-LLC", and try the Arabic trade name if the English one returns nothing.

Step 2: Read the terms that actually matter

You do not need to read every word. You do need to read these parts, and the best way is to open the terms of service, refund policy and any SLA page, then search each one for the keywords below.

Uptime and the SLA

Search for "uptime", "SLA" and "credit".

• Promise or aim: "guarantee" and "strive to maintain" are different commitments.
• What the percentage allows: a 30-day month has 43,200 minutes. 99.9% uptime still allows about 43 minutes of downtime, 99.95% about 22 minutes, and 99.99% about 4 minutes.
• Exclusions: scheduled maintenance, events outside the provider's control, problems caused by your own code or settings, and often email delivery.
• Remedy: a service credit, a refund, or nothing stated. Note how to claim and the deadline.

Refunds

Search for "refund" and "money back". Write down the window (for example 30 days), which products qualify, and what is excluded. Domains, setup fees, migrations and software licences are common exclusions.

Price changes and renewals

Search for "renew" and "price". Check whether the renewal price is shown, whether the provider can change prices, how much notice it gives, and when a change takes effect. Our guide to reading hosting renewal prices shows how to compare total cost over several years.

Governing law and which company bills you

Search for "governing law" and "jurisdiction". Groups with companies in several countries may say the contract follows the law of whichever entity issues your invoice. If you want a UAE contract and UAE invoices, ask which entity will bill you before you pay.

Cancellation and your data afterwards

Search for "cancel", "terminate" and "data". Note how to cancel (often a ticket before the renewal date) and what happens to your files, databases and email after cancellation or suspension. If the terms do not say how long data is kept, ask and get the answer in writing.

Step 3: Test support before you pay

A pre-sales exchange can show whether a provider answers your plan-specific questions, but it cannot predict future support. Send one or two genuine questions through the advertised channel and hours, record the clarity of the answer, and ask for material commitments in writing. Do not flood several channels with duplicate tickets.

Good test questions are specific, so vague answers stand out:

• "For the plan I am considering, which data centre does it run in, and where are backups stored?"
• "How often are backups taken, how long are they kept, and can I restore a single database myself?"
• "Which PHP versions can I choose on this plan?"

For each reply, note three things: how long until a person answered, whether the answer was specific to your plan, and whether they offered to put it in writing. Copy-pasted marketing text in reply to a specific question is a warning sign.

Step 4: Check the technical evidence yourself

These optional, low-rate checks need no account access, but only use a site you own or a provider-approved demo endpoint. They inspect the responding endpoint, which may be a CDN or proxy rather than the ordered origin. Replace example.com with the approved address and do not infer a particular plan’s hardware or location from an unrelated website.

Look at the response headers

This shows the HTTP version and headers the server sends back, without downloading the page:

curl -sI https://example.com/

Look at the first line: HTTP/2 200 shows that this endpoint returned a successful HTTP/2 response; a CDN may be answering rather than the origin server. A server: line often names the web server software, such as LiteSpeed, Apache or nginx. If you see strict-transport-security, it tells supporting browsers to use HTTPS for later visits for the stated period. It does not by itself prove that every page and subdomain is correctly secured. Headers from a demo site may not represent your ordered plan.

Check the certificate

This prints who issued the site's TLS certificate and when it expires:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -enddate

The command above displays the presented certificate’s issuer and expiry; it does not itself establish hostname matching or a trusted certificate chain. Check those separately with a browser or a validating TLS client. It also cannot prove automatic renewal; ask whether renewals are enabled and monitored. Our SSL renewal guide explains why automatic renewal matters more each year.

See who owns the network

First find the site's IP address:

dig +short example.com

Then look up who the address block is registered to. Replace the documentation address below with the one dig returned:

whois 192.0.2.10

The organisation field may identify an address holder, cloud provider or CDN rather than your contracted host. Registration country and IP-geolocation are not reliable proof of the physical origin or backup location. Ask for the specific service region in writing and test the actual ordered environment when available.

Measure speed from where your customers are

Ping, route and time-to-first-byte tests from Dubai, including how to run them if you are abroad, are covered step by step in our UAE hosting pillar guide.

Look for a status page

Search the provider's site for "status". A status page with a history of past incidents and explanations is a good sign of a team that communicates during outages.

Step 5: Ask hard questions about backups and restore

Backups are where hosting promises are most often vague. Ask for written answers to all of these:

• Frequency: how often are backups taken (daily, weekly)?
• Retention: how many days or weeks back can you go?
• Location: are backups stored on a different server, or in a different data centre, from your live site?
• Scope: do they include files, databases and email?
• Restore: can you restore yourself from the control panel, or must you open a ticket? Is there a fee? How long does a restore usually take?

Then plan to keep your own copy as well, because the host's backups protect the host's platform, and your copy protects your business.

How to download your own full backup in cPanel

If the plan uses cPanel, you can generate a full account backup yourself. According to cPanel's documentation, the steps are:

1. Go to cPanel > Files > Backup.
2. Click Download a Full Account Backup.
3. Choose a Backup Destination: Home Directory, Remote FTP Server, Remote FTP Server (passive mode transfer) or Secure Copy (SCP).
4. Choose whether to get an email when it finishes, or select the option not to send one.
5. Click Generate Backup.

The file is named in the backup-MM-DD-YYYY format. Download it and store it somewhere outside the hosting account. The same Backup page also offers partial downloads: your home directory, individual databases, email forwarders and email filters.

Heads up: cPanel's documentation says you cannot automatically restore a full backup file from cPanel itself; that is done in WHM, so you contact your hosting provider. Partial backups, such as a database, can be restored from the same page.

Step 6: Plan your exit before you sign

The best time to plan leaving a provider is before you join it. Make sure each of these is true:

• The domain is registered in your company's name, in a registrar account you control, with your email as the contact. Check your registrar account; public whois results are often redacted.
• You can get the transfer code (often called an EPP or auth code) for the domain from the registrar when you need it.
• You know where your DNS is hosted and keep a copy of every record, especially MX, SPF, DKIM and DMARC. Our nameserver guide explains how to copy a zone safely.
• You know where email lives and how to export mailboxes if it is on the hosting account.
• You hold the admin logins for the hosting account, WordPress and any paid plugins, under a company email address, never a freelancer's personal one.
• You download a full backup monthly and keep it off the server.

If those are in place, moving later is an ordinary job. Our WordPress migration guide shows what that job involves.

Red flags worth walking away from

• No legal company name anywhere on the website or terms.
• A licence search returns nothing, or a different company.
• Huge discounts that only apply if you pay for several years up front, with no renewal price shown.
• The domain registered in the provider's name "to make things easier".
• No written terms, or terms that contradict the sales page.
• Support that only answers sales questions quickly.
• Refusal to say where the server or backups are located.

Your due-diligence scorecard

Score each line yes or no for every provider on your shortlist:

• Legal name found and licence verified as active.
• Licensed activity fits hosting or IT services.
• Uptime commitment, exclusions and remedy understood.
• Refund window and exclusions written down.
• Renewal price and price-change notice written down.
• Governing law and invoicing entity confirmed.
• Support answered the specific plan questions clearly through an advertised channel, and material commitments were confirmed in writing.
• Data centre and backup locations confirmed in writing.
• Self-service backup download available.
• Domain will be registered in your company's name.

Use the scorecard to find unanswered or unacceptable conditions, then compare the plans that satisfy your requirements on total price and service scope. A simple count of “yes” answers is not a guarantee of quality or value.

If something goes wrong

The licence search finds nothing

Try the exact legal name with and without suffixes such as LLC, try the Arabic trade name, and try the portal for the emirate where the company says it is based. If it is a free zone company, check with that free zone. If you still find nothing, ask the provider for its licence number and search again.

The invoice shows a different company from the website

Groups often trade under one brand through several companies. Ask which company you are contracting with, where it is registered, and which law governs the contract.

Support is fast before purchase and slow after

Write it down with dates and times. If the terms promise response times, quote them in a ticket. If they do not, that is a lesson for your next scorecard.

The provider will not say where the server is

Ask once more, in writing, for the data centre location of the specific plan. If the answer stays vague, treat that as the answer and move on.

Generating a full backup fails

cPanel's documentation warns that the backup process for an account near or over its disk quota may fail, because the system cannot write the files it needs. Free up space, choose a remote FTP or SCP destination, or ask support to generate the backup for you.

Whois shows the provider as the domain's registrant

Ask the provider to change the registrant to your company now, while the relationship is good, and confirm the change in your own registrar account.

Where Hostlelo fits

Full disclosure: Hostlelo runs this blog, so apply every step above to us too. At the time of writing (3 October 2026), Hostlelo's about page lists three registered companies, including Hostlelo Information Technology LLC in the UAE. Its Terms of Service say the contract is governed by the laws of the jurisdiction of the Hostlelo entity that issued your invoice, describe the uptime commitment as "We strive to maintain 99.9% uptime for all hosting services" with listed exclusions, and say prices may change with 30 days notice, taking effect from your next renewal. Its refund policy covers new shared hosting accounts within 30 days, once per customer, while VPS, VDS and dedicated server purchases are final.

The one message worth forwarding

Send this to every hosting company on your shortlist:

"Before we buy, please confirm in writing: your company's legal name and licence number, which entity will invoice us, the data centre location for this plan, backup frequency, retention and location, how we restore a backup ourselves, the renewal price, and that our domain will be registered in our company's name."

The takeaway: verify the contracting entity, exact plan, written terms, recovery path and domain control before paying. These checks reduce uncertainty; they do not guarantee uptime, support quality or legal compliance.