Disclosure: WebFin is reader-supported. If you buy hosting through links on this page, we may earn a commission at no extra cost to you. Commissions vary between providers and our ratings do not — here’s our full disclosure.
The phrase “hidden fees” is slightly wrong, and the wrongness matters. Nothing here is hidden. Every figure below sits on a public help page, indexed and free to read.
They are simply not printed where you decide. The checkout shows one number; the add-on renewal rates, the refund exclusions and the cancellation charge live three clicks away in a knowledge base nobody opens before buying. And on one host, two of those knowledge base pages give different prices for the same product. How to decline them at the cart is covered in avoiding checkout upsells.
What Are the Hidden Costs of Cheap Hosting?
Four categories: the renewal price after the introductory term, add-on services that renew separately, the domain after its free first year, and the exclusions written into the refund policy.
The Published Numbers
We use Bluehost for most figures below for one reason: it publishes them. Most hosts do not put add-on renewal rates on any public page, which makes them impossible to check and impossible to quote.
All figures read on 31 August 2026 from the Bluehost help article last updated 27 June 2026.
| Host | Charge | Cost per year |
|---|---|---|
| Bluehost | Premium SSL, single domain | $89.88 (optional; Let's Encrypt is free) |
| Bluehost | Domain privacy | $15.00 (free year one on Business and up) |
| Bluehost | SiteLock Essentials | $95.88 |
| Bluehost | SiteLock Prevent | $239.88 |
| Bluehost | Yoast SEO Premium | $99.99 |
| Bluehost | Early cancellation, free domain | $15.99 one-off, deducted from refund |
| GoDaddy | SSL on Economy after year one | $119.99; other tiers include it for the plan's life |
| GoDaddy | Pre-checked extras at checkout | $345.39 counted by one review, unverified |
| HostGator | CodeGuard daily backups | $35.88 (weekly copies are a courtesy, not guaranteed) |
| HostGator | SiteLock, pre-selected at checkout | $23.88 |
| HostGator | Dedicated IP | $59.40 |
| HostGator | Professional migration | $149.99 one-off |
| Hostwinds | Standard SSL | $75.00 (free AutoSSL on shared via cPanel) |
| Hostwinds | Wildcard SSL | $150.00 |
| Scala Hosting | Processor core, added or removed anytime | $36.00 per core |
| Scala Hosting | Memory, added or removed anytime | $12.00 per gigabyte |
| Hostinger | WHOIS privacy | Included |
| Hostinger | Domain renewal, .com | $15–$20, no first-party figure published |
| DreamHost | WHOIS privacy | Included for the life of the domain |
| Namecheap | Domain privacy | Included for the life of the domain |
| InterServer | Everything on the one plan | Included; no tiers to upgrade to |
Where the Money Actually Goes
The renewal, first. Starter advertises low and renews at $9.99 a month on a 36-month term, $11.99 on 12 months, and $15.99 month to month. The same plan therefore has three different renewal prices depending on how long you commit, and the cheapest of the three requires paying three years at once. Where these charges are written down is covered in reading a hosting agreement.
SSL is genuinely free at both hosts above, and it is worth saying so plainly — though not everywhere. Every shared plan includes a Let’s Encrypt certificate at no cost. What costs money is the premium tier: a single-domain certificate renews at $89.88 a year, wildcard and extended validation at $239.88. Nothing forces you onto those, and for a normal site nothing recommends them either.
Domain privacy is where the plan tier bites. It renews at $15 per domain per year and comes free for the first year on Business and above. On Starter, the cheapest plan, it does not come free at all.
Security add-ons are the large numbers. SiteLock Essentials renews at $95.88 a year, Prevent at $239.88, Prevent Plus at $359.88. Per domain.
And the SEO plugin costs more than the hosting. Yoast SEO Premium renews at $99.99 per domain per year through the Bluehost control panel. Yoast belongs to Newfold Digital, which also owns Bluehost — we traced that ownership separately — so one company sells you the hosting and the plugin upsell.
Two Pages, Two Price Lists
This is the part that makes cross-checking hard even when you try.
The current help article lists Premium SSL as Single Domain at $89.88 and SiteLock’s entry tier as Essentials at $95.88. An older Bluehost knowledge base, still live on a separate domain and marked no-index, lists the same product families under different names and different prices: Positive SSL at $49.99, and SiteLock’s entry tier as Find at $47.88.
The older page also carries CodeGuard backup pricing, from $32.95 a year, which the current page omits entirely. A third-party pricing tracker gives CodeGuard as $47.88 for the same tier. What those security add-ons are for is explained in recovering a hacked website.
Three sources, three sets of numbers, one company. We are not going to pick the tidy one. The current, indexed page is the one we quote, and the disagreement is itself the finding.
The Free Domain Is Not Free If You Leave
Read this clause before you buy anything, at either host.
Bluehost’s terms state that cancelling before the end of your term, or downgrading to a term shorter than a year, forfeits the domain registration coupon — and $15.99 is deducted from your refund to cover registering the domain on your behalf. You keep the domain. You just paid for it after all. If you decide to leave over a fee, canceling hosting and getting a refund sets out the safe order.
Hostinger runs the same structure with softer edges: a free domain on annual terms, WHOIS privacy included rather than sold, and domain registration fees treated as non-refundable in the usual way.
⚠️ What the .com renews at afterwards, we could not pin down. Published figures range from about $14.99 to $19.99 a year depending on which write-up you read, and we found no first-party page stating it plainly. So we give the range and say it is a range.
⚠️ WebFin runs on Hostinger. We pay for the plan ourselves and bought it before this site existed.
The Refund Covers Less Than You Think
Both hosts advertise 30 days. Both mean 30 days on hosting.
Bluehost states it directly on the pricing page: the money-back guarantee covers hosting services only, and is not available for add-ons, domains, or professional services. So if the checkout talked you into SiteLock and a premium SSL, those are yours regardless of what you decide in week two.
That flips the usual advice. The refund window is a good tool for testing a host, and a poor shield for testing its add-ons. Buy the hosting, skip everything else, and add services later only if you find you need them.
How to Read a Cheap Plan Before You Buy
Five checks, and none of them require an account.
Find the renewal price for your exact term. Not the plan’s renewal price — the one for 12, 36 or monthly, because they differ.
Search the help center for “renewal pricing”. If add-on rates come back, you can budget. If they do not, assume the add-ons renew high and plan not to buy them. Shedding the extras is covered in how to downgrade a hosting plan.
Check what the refund excludes. The sentence is usually in the same paragraph as the guarantee.
Check the cancellation charge for the free domain. It is a fixed sum, it is published, and most buyers meet it by surprise.
Then price the boring version. Hosting alone, no add-ons, at the renewal rate, times three years. That number is the honest one, and it is the one we use throughout this site.
How We Research
Every Bluehost figure above came from that company’s own help pages, read on 31 August 2026, and we name which page carries which number rather than merging them. Where two Bluehost pages disagree, both are shown. The Hostinger domain renewal figure is given as a range because no first-party page stating it was found, and inventing a number would be worse than admitting the gap.
We run no tests of our own. The method and the criteria behind every score are on our About page.
Frequently Asked Questions
Not hidden, but not shown at checkout either. Add-on renewal rates, refund exclusions and the domain cancellation charge all sit in help articles rather than on the pricing page. Bluehost publishes all three; many hosts publish none of them.
On both hosts covered here, yes. Every shared plan includes a Let’s Encrypt certificate at no cost, and a normal site needs nothing more. Paid certificates exist at $89.88 a year and up, but they are an optional upgrade rather than a required renewal.
It renews at the registrar’s standard rate. Published figures for a .com run from roughly $15 to $20 a year depending on the host and the source. Cancelling your hosting early can also cost you $15.99 at Bluehost, deducted from the refund.
Generally no. Bluehost states that its 30-day guarantee covers hosting services only and excludes add-ons, domains and professional services. Treat the refund window as a way to test the hosting, not the extras you were offered alongside it.
Take the renewal rate for your exact term, multiply by the months remaining after the introductory period, add the introductory term itself, then add the domain from year two onward. Add-ons only if you genuinely intend to buy them.
The Verdict
The fees are published; the placement is the trick. A checkout page shows one number and a help article shows a dozen, and only one of those pages is in front of you when your card is out.
Two of them are worth memorizing. Add-ons and domains fall outside the 30-day refund, and cancelling early costs $15.99 for the domain you were given.
Price the plan with nothing added, at the renewal rate, over three years. If that number works, the plan works. Everything offered on top of it is a separate purchase wearing the same receipt — and the word attached to the plan itself deserves the same scrutiny, which is why “unlimited” has its own page here.