How to vet a UAE hosting company before you pay:a due-diligence guide

To vet a UAE hosting company before you pay, check five things: that the company legally exists and holds a licence (through official UAE registries), what its written terms actually promise, how its support behaves when you test it, what its servers show when you inspect them yourself, and how you would get your data and domain out if you ever leave. It takes an afternoon, and it is far cheaper than a bad three-year contract.

A made-up story that is uncomfortably common. Omar runs a small trading company in Sharjah. He sees an advert for "Dubai hosting, 70% off", pays for three years, and the site goes live. Eighteen months later the WhatsApp number stops answering, the site is down, and when he tries to move, he discovers the domain was registered in the seller's name, not his company's. Every one of those problems was visible before he paid.

By the end of this guide you will have a due-diligence checklist you can run on any UAE hosting company: licence checks, the clauses to read, a support test, technical checks with a few safe commands, backup questions, and an exit plan.

What due diligence means for hosting

Think of it like buying a used car. You check the papers are real, you read the warranty, you take it for a test drive, you look under the bonnet, and you make sure the ownership papers go in your name. Hosting due diligence is the same five habits, applied to a service your business will depend on every day.

None of this assumes the provider is dishonest. Good hosts welcome these questions, because customers who ask them tend to stay.

Before you start

• The provider's legal name. It is usually in the website footer, the terms of service or a sample invoice. It may differ from the brand name.
• The exact plan you are considering, with its name and price written down.
• A test site or demo address on that plan, if the provider offers one, or the address of an existing site they host.
• A terminal (Terminal on macOS, a Linux shell, or Command Prompt on Windows) for the optional technical checks.
• About two hours, spread over a few days so you can see how support responds at different times.

Risk level: none. You are only reading public information and asking questions.

Step 1: Confirm the company exists and is licensed

A real business licence does not prove a host is good. It does prove there is an accountable company behind the brand.

Find the legal name

Look in the website footer, the terms of service and the contact page. Write down the exact legal name and any licence number shown. If you cannot find a legal name anywhere, ask sales for it in writing. A provider that will not tell you who you are contracting with has answered your question.

Search the official registries

The UAE government portal lists several official channels for checking a business licence. At the time of writing (3 October 2026) they include:

• National Economic Register (NER): a platform linking federal and local licensing authorities. The portal says you can search it by business name, licence number, economic register number (CBLS) or business activity.
• Ministry of Economy: its Unified Commercial Registration System supports enquiries by business name or business activity.
• Abu Dhabi: the Department of Economic Development offers trade name search and trade licence details search.
• Dubai: Dubai Economy and Tourism offers trade name and business activity search.
• Sharjah: the Economic Development Department offers trade name search.
• Ajman: the Department of Economic Development offers a trade name inquiry.
• Fujairah: the Rukhsati app from Fujairah Municipality, on the App Store and Google Play.

If the company says it is licensed in a free zone, ask which free zone and check with that free zone authority. If the provider is based outside the UAE, check the company registry in its home country.

Compare what you find

• The name on the licence matches the name on the terms and invoices.
• The licence status is active, not expired.
• The licensed activity fits IT, web hosting or related services.

Quick tip: search with and without words like "LLC" or "FZ-LLC", and try the Arabic trade name if the English one returns nothing.

Step 2: Read the terms that actually matter

You do not need to read every word. You do need to read these parts, and the best way is to open the terms of service, refund policy and any SLA page, then search each one for the keywords below.

Uptime and the SLA

Search for "uptime", "SLA" and "credit".

• Promise or aim: "guarantee" and "strive to maintain" are different commitments.
• What the percentage allows: a 30-day month has 43,200 minutes. 99.9% uptime still allows about 43 minutes of downtime, 99.95% about 22 minutes, and 99.99% about 4 minutes.
• Exclusions: scheduled maintenance, events outside the provider's control, problems caused by your own code or settings, and often email delivery.
• Remedy: a service credit, a refund, or nothing stated. Note how to claim and the deadline.

Refunds

Search for "refund" and "money back". Write down the window (for example 30 days), which products qualify, and what is excluded. Domains, setup fees, migrations and software licences are common exclusions.

Price changes and renewals

Search for "renew" and "price". Check whether the renewal price is shown, whether the provider can change prices, how much notice it gives, and when a change takes effect. Our guide to reading hosting renewal prices shows how to compare total cost over several years.

Governing law and which company bills you

Search for "governing law" and "jurisdiction". Groups with companies in several countries may say the contract follows the law of whichever entity issues your invoice. If you want a UAE contract and UAE invoices, ask which entity will bill you before you pay.

Cancellation and your data afterwards

Search for "cancel", "terminate" and "data". Note how to cancel (often a ticket before the renewal date) and what happens to your files, databases and email after cancellation or suspension. If the terms do not say how long data is kept, ask and get the answer in writing.

Step 3: Test support before you pay

Support quality is the hardest thing to judge from a sales page, and the easiest to test. Send the same three questions through each channel the provider offers (live chat, ticket, email, WhatsApp), on two different days, including once in the evening or at the weekend.

Good test questions are specific, so vague answers stand out:

• "For the plan I am considering, which data centre does it run in, and where are backups stored?"
• "How often are backups taken, how long are they kept, and can I restore a single database myself?"
• "Which PHP versions can I choose on this plan?"

For each reply, note three things: how long until a person answered, whether the answer was specific to your plan, and whether they offered to put it in writing. Copy-pasted marketing text in reply to a specific question is a warning sign.

Step 4: Check the technical evidence yourself

These checks take ten minutes and need no special access. Use the provider's demo site or a site they host on the same plan. The examples use example.com; replace it with the real address.

Look at the response headers

This shows the HTTP version and headers the server sends back, without downloading the page:

curl -sI https://example.com/

Look at the first line: HTTP/2 200 means the server speaks HTTP/2, which is normal for a modern host. A server: line often names the web server software, such as LiteSpeed, Apache or nginx. If you see strict-transport-security, the site enforces HTTPS. Missing headers prove nothing on their own, but they are good conversation starters with sales.

Check the certificate

This prints who issued the site's TLS certificate and when it expires:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -enddate

A certificate from a known authority, renewed automatically well before expiry, is what you want. Our SSL renewal guide explains why automatic renewal matters more each year.

See who owns the network

First find the site's IP address:

dig +short example.com

Then look up who the address block is registered to. Replace the documentation address below with the one dig returned:

whois 192.0.2.10

Look for the organisation and country fields. They show which network operator holds the address, which may be the hosting company, a data centre operator or a cloud provider. That is normal. What matters is that it matches what the provider told you about the location.

Measure speed from where your customers are

Ping, route and time-to-first-byte tests from Dubai, including how to run them if you are abroad, are covered step by step in our UAE hosting pillar guide.

Look for a status page

Search the provider's site for "status". A status page with a history of past incidents and explanations is a good sign of a team that communicates during outages.

Step 5: Ask hard questions about backups and restore

Backups are where hosting promises are most often vague. Ask for written answers to all of these:

• Frequency: how often are backups taken (daily, weekly)?
• Retention: how many days or weeks back can you go?
• Location: are backups stored on a different server, or in a different data centre, from your live site?
• Scope: do they include files, databases and email?
• Restore: can you restore yourself from the control panel, or must you open a ticket? Is there a fee? How long does a restore usually take?

Then plan to keep your own copy as well, because the host's backups protect the host's platform, and your copy protects your business.

How to download your own full backup in cPanel

If the plan uses cPanel, you can generate a full account backup yourself. According to cPanel's documentation, the steps are:

1. Go to cPanel > Files > Backup.
2. Click Download a Full Account Backup.
3. Choose a Backup Destination: Home Directory, Remote FTP Server, Remote FTP Server (passive mode transfer) or Secure Copy (SCP).
4. Choose whether to get an email when it finishes, or select the option not to send one.
5. Click Generate Backup.

The file is named in the backup-MM-DD-YYYY format. Download it and store it somewhere outside the hosting account. The same Backup page also offers partial downloads: your home directory, individual databases, email forwarders and email filters.

Heads up: cPanel's documentation says you cannot automatically restore a full backup file from cPanel itself; that is done in WHM, so you contact your hosting provider. Partial backups, such as a database, can be restored from the same page.

Step 6: Plan your exit before you sign

The best time to plan leaving a provider is before you join it. Make sure each of these is true:

• The domain is registered in your company's name, in a registrar account you control, with your email as the contact. Check your registrar account; public whois results are often redacted.
• You can get the transfer code (often called an EPP or auth code) for the domain from the registrar when you need it.
• You know where your DNS is hosted and keep a copy of every record, especially MX, SPF, DKIM and DMARC. Our nameserver guide explains how to copy a zone safely.
• You know where email lives and how to export mailboxes if it is on the hosting account.
• You hold the admin logins for the hosting account, WordPress and any paid plugins, under a company email address, never a freelancer's personal one.
• You download a full backup monthly and keep it off the server.

If those are in place, moving later is an ordinary job. Our WordPress migration guide shows what that job involves.

Red flags worth walking away from

• No legal company name anywhere on the website or terms.
• A licence search returns nothing, or a different company.
• Huge discounts that only apply if you pay for several years up front, with no renewal price shown.
• The domain registered in the provider's name "to make things easier".
• No written terms, or terms that contradict the sales page.
• Support that only answers sales questions quickly.
• Refusal to say where the server or backups are located.

Your due-diligence scorecard

Score each line yes or no for every provider on your shortlist:

• Legal name found and licence verified as active.
• Licensed activity fits hosting or IT services.
• Uptime commitment, exclusions and remedy understood.
• Refund window and exclusions written down.
• Renewal price and price-change notice written down.
• Governing law and invoicing entity confirmed.
• Support answered specific questions on at least two channels.
• Data centre and backup locations confirmed in writing.
• Self-service backup download available.
• Domain will be registered in your company's name.

Pick the provider with the most yeses, then compare price. Doing it in that order saves money.

If something goes wrong

The licence search finds nothing

Try the exact legal name with and without suffixes such as LLC, try the Arabic trade name, and try the portal for the emirate where the company says it is based. If it is a free zone company, check with that free zone. If you still find nothing, ask the provider for its licence number and search again.

The invoice shows a different company from the website

Groups often trade under one brand through several companies. Ask which company you are contracting with, where it is registered, and which law governs the contract.

Support is fast before purchase and slow after

Write it down with dates and times. If the terms promise response times, quote them in a ticket. If they do not, that is a lesson for your next scorecard.

The provider will not say where the server is

Ask once more, in writing, for the data centre location of the specific plan. If the answer stays vague, treat that as the answer and move on.

Generating a full backup fails

cPanel's documentation warns that the backup process for an account near or over its disk quota may fail, because the system cannot write the files it needs. Free up space, choose a remote FTP or SCP destination, or ask support to generate the backup for you.

Whois shows the provider as the domain's registrant

Ask the provider to change the registrant to your company now, while the relationship is good, and confirm the change in your own registrar account.

Where Hostlelo fits

Full disclosure: Hostlelo runs this blog, so apply every step above to us too. At the time of writing (3 October 2026), Hostlelo's about page lists three registered companies, including Hostlelo Information Technology LLC in the UAE. Its Terms of Service say the contract is governed by the laws of the jurisdiction of the Hostlelo entity that issued your invoice, describe the uptime commitment as "We strive to maintain 99.9% uptime for all hosting services" with listed exclusions, and say prices may change with 30 days notice, taking effect from your next renewal. Its refund policy covers new shared hosting accounts within 30 days, once per customer, while VPS, VDS and dedicated server purchases are final.

The one message worth forwarding

Send this to every hosting company on your shortlist:

"Before we buy, please confirm in writing: your company's legal name and licence number, which entity will invoice us, the data centre location for this plan, backup frequency, retention and location, how we restore a backup ourselves, the renewal price, and that our domain will be registered in our company's name."

The takeaway: a hosting company that passes the licence check, the terms check, the support test, the technical check and the exit check is one you can build on; one that fails any of them is cheap only until the day you need it.