Free WordPress Hosting: Limits, Pitfalls and the

Free WordPress hosting is one of the oldest and most misleading promises on the internet. A single Google search lands you on dozens of pages with headlines like "100% Free, No Ads, No Card Required," each promising unlimited bandwidth, one-click WordPress installs, and 99.9% uptime. The reality is far more layered: behind the handful of genuinely free providers sit inactivity policies, aggressive resource limits, hidden ad layers, sensitive ToS terms, and long-term risk that often includes your account being deleted without warning.

This guide explains where free hosting actually makes sense for low-traffic scenarios — personal blogs, small portfolios, student projects, or temporary demos — what pitfalls to watch out for, and how to build a relatively more sustainable setup. With a vendor-neutral technical lens, I'll walk through real PHP/MySQL limits, provider categories, ways to spin up "zero-cost WordPress" on your own VPS, and the numbers that show when paying for hosting becomes the smarter move.

What Does "Free Hosting" Actually Mean?

Free hosting isn't a single category — it's the umbrella term for four very different business models. Knowing which one you're using is the same as knowing the real terms of service and when your account might get suspended. Below you'll find an objective definition of each of the four models.

Subdomain model (PaaS): WordPress.com's free plan is the best-known example. Both the software and the hosting belong to the same company, the control panel is intentionally limited (no plugin uploads, narrow theme selection, no code access), and in return setup is fully hands-off for you. The traffic is paid for through displayed ads and premium upsells.
Classic shared hosting freemium: providers like AwardSpace, InfinityFree, and GoogieHost. Standard cPanel-style panel + 1–5GB disk + WordPress installer. They function as a customer "funnel" toward their paid plans, which is why performance and support on the free plan are deliberately constrained.
Trial / dev sandbox: CloudAccess (30 days), Wordify DevSites, the developer sandboxes of some managed WP services. Free "for development purposes"; you're expected to migrate to a paid plan to go to production, and custom domains usually don't work on the free tier.
Cloud free tier (FaaS / serverless): Wasmer, Oracle Cloud Always Free, Google Cloud Free Tier, AWS Free Tier (12 months). They don't really hand you a server — they hand you a monthly compute/disk/bandwidth quota per account. You install WordPress on top of it yourself, and exceeding the quota means immediate billing.

These four models sit in different places when it comes to ROI, level of control, and long-term risk. The rest of this guide works through each of them with real limits, real configurations, and real scenarios.

Minimum System Requirements to Run WordPress

To know whether a host can run WordPress at all, you first need to know what the software itself requires. The minimums recommended by WordPress.org as of 2026 may look modest, but the gap between "it runs" and "it runs fast" isn't measured in those numbers.

PHP 7.4+ (8.1 / 8.2 / 8.3 recommended): security patches have been cut off for older PHP versions. PHP 8.x is 20–40% faster.
MySQL 5.7+ or MariaDB 10.4+: PostgreSQL is not supported (only in a limited way through community plugins).
HTTPS support: WordPress 5.7+ assumes HTTPS in the admin panel; modern plugins also won't work without HTTPS.
RAM 256–512 MB: WordPress + MySQL + PHP-FPM together. With WooCommerce added, anything below 1 GB is insufficient.
Disk 1 GB: starting size for WordPress core + themes + a few plugins + the media library. A production site can easily climb to 5–10 GB within 6 months.
HTTP modules: mod_rewrite for Apache, try_files directive support for Nginx — required for pretty permalinks.
Cron support: WP-Cron isn't enough; without real system cron access, scheduled posts and backup jobs won't run reliably.

These numbers are the floor. A typical enterprise WordPress site (10–30 plugins, WooCommerce, multilingual) can easily climb to 2 GB RAM and 4–8 PHP-FPM workers. Free plans almost never offer those upper bounds — which is why drawing the line between "WordPress installs" and "WordPress is sustainable in production" is something you have to do up front.

Provider Comparison: Real Limits for 2026

The following table summarizes the resource limits of the most common free WordPress hosting options based on 2026 data. The data was pulled from the providers' own sites (March–May 2026); policies change, so always verify the current version before any purchasing decision.

WordPress.com Free: 1 GB storage, unlimited bandwidth, subdomain (sitename.wordpress.com), no plugins, no custom themes, WordPress ads are shown, custom domain requires upgrading to a paid plan.
InfinityFree: 5 GB disk, "unlimited" bandwidth (fair-use quota applies), 400 MySQL DBs, PHP 8.3, Softaculous installer, free SSL, supports custom domains, no ads. Inode limit around 30K–50K — becomes a problem on medium-to-large WordPress sites.
AwardSpace Free: 1 GB disk, 5 GB monthly bandwidth, 1 main domain + 3 subdomains, 1 MySQL DB, PHP supported, email account included. Inactivity policy applies.
GoogieHost: 1 GB SSD, 100 GB monthly bandwidth, single site, LiteSpeed cache, free SSL, Cloudflare integration. Annual "renewal" required; inactive accounts get deleted.
CloudAccess: 30-day trial, 500 MB disk, 1 GB RAM, cloudaccess.host subdomain. Custom domain requires moving to a paid plan; missing a monthly login closes the account.
Wasmer Hobby: 100K monthly visitors, 1 GB storage, 150 GB bandwidth, 100 MB MySQL database, 1 application. Serverless WASM infrastructure, automatic scaling; database size is a serious limit.
Wordify DevSites: not production, developer sandbox. Paid (starts at $2/month) but still cheap; no real free tier.
000webhost (now Hostinger free): 300 MB storage, 3 GB bandwidth, MySQL, 1 site. No backups, daily login may be required.

This list isn't absolute — providers change plans throughout the year, new players appear, old ones shut down. When deciding, weigh three criteria together: resource limits (CPU, RAM, disk, MySQL size), long-term assurance (inactivity, ToS, account-deletion policies) and exit strategy (can you export a full backup, can you take a custom domain with you?).

The Subdomain Model: A Detailed Look at the WordPress.com Free Plan

WordPress.com's free plan is the lowest-friction option for users who want to start a blog from scratch and have no interest in technical tinkering. An email address + password and you're live within three minutes. In exchange, you give up something major: control.

No plugin uploads: Yoast SEO, RankMath, WP Rocket, WooCommerce — none of them can be installed. Only the lower-tier features of Jetpack are available on the free plan.
No custom theme: you can only choose from the platform's small approved theme pool. Even editing CSS requires a premium plan.
No custom domain: you run on siteadi.wordpress.com. Custom domain requires a plan starting at $4/month.
WordPress ads: ads from the WordAds platform appear on the free plan; users do not get a share of the revenue.
No FTP / SFTP, no file access: you can't edit theme files or create child themes.
Limited data export: the export tool gives you content (posts, pages, comments) but not a full WordPress backup (plugins, themes, uploads). Migrating means a pile of manual work.
No effective traffic limit in practice: "Unlimited bandwidth" is the line; in reality spikes can be throttled, and a ToS breach closes the account.

The right scenario: the most stress-free option for hobby bloggers focused on writing who never plan to do any technical work. No worries about backups, server monitoring, or plugin updates. The wrong scenario: anyone focused on AdSense / Google AdSense revenue, anyone who wants to use Yoast/RankMath for SEO, anyone trying to build a personal brand on a custom domain.

.com vs.org Distinction

This is the most commonly confused topic for newcomers. WordPress.org is the open-source software — you download it and install it on whatever host you like. WordPress.com is a managed SaaS run by Automattic. In this guide, when we talk about free hosting we usually mean "installing the WordPress.org software on a free host"; the WordPress.com free plan is only a subset of that category.

Classic Free Shared Hosting: A Detailed Look at InfinityFree

InfinityFree is one of the longest-running players in the free shared hosting category. It launched in 2014, is still active, and genuinely hands out accounts without ads or a credit card. That raises the obvious "how is it still around?" question — the answer is that the paid sister company iFastNet sells the marginal capacity of its infrastructure for free and operates with a deliberately low yearly conversion rate.

5 GB disk: more than enough for most personal blogs.
"Unlimited" bandwidth: in practice there's a daily CPU-second limit and an I/O limit. Bursty requests like page-speed tests (GTmetrix, Lighthouse) can get the account temporarily suspended.
Inode limit ~30,000–50,000: Inodes = file/directory count. WordPress core is ~3K, popular plugins add 5–10K more; as the media library grows, that's where the limit really starts to bite.
PHP 8.3 + MariaDB 11.4: modern. There's an option to roll back to older PHP.
400 MySQL databases: 1–2 is enough in practice; the high number is marketing.
No ads, but a "powered by" footer: may be mandatory when using a subdomain.
Custom domain support: after free Freenom domains were shut down in 2024, you can connect a domain bought from cheap .xyz / .top registrars. SSL is automatic (Comodo/InfinityFree SSL, similar to Let's Encrypt).
NO backups: this is the most critical point. If the server crashes or your account gets suspended, your data is gone unless you have your own backups.
Monthly "daily hits" cap: 50,000 daily hits. As traffic rises, you start seeing unanswered 503s.

Installing WordPress on InfinityFree takes 60 seconds with the Softaculous installer. But there are three additional things you need to do up front: external cron, external backups, and external email service. I'll cover each of these below.

Manual WordPress Install on Free Hosting (CLI)

If you'd rather skip Softaculous and install manually — which gives you a cleaner starting point because none of the throwaway plugins get bundled in — use these steps:

Most free shared hosts don't allow SSH access, so installing through wp-cli is usually not possible. The most common path is FTP upload + the browser-based 5-minute installer sequence.

Disabling WP-Cron with External Cron

By default WordPress tries to run wp-cron.php on every page request. On low-traffic sites this leads to delayed scheduled posts, missed scheduled backups, and 50–200ms of added latency per request. If your free host doesn't give you system cron access, use an external cron service.

PaaS / Serverless: Wasmer and Cloud Free Tiers

Wasmer's Hobby plan caught the WordPress world's attention when it launched in 2024. A WebAssembly-based runtime that keeps cold starts in the millisecond range; the 100K monthly visitor cap is more than enough for a small blog. The one serious problem: the 100 MB MySQL database limit. A blank WordPress core install is ~5 MB; after 1000 posts + 50 plugins it climbs to 80–90 MB easily.

Cloud free tiers (Oracle Always Free, Google Cloud, AWS) are a different category. They give you a small VM (Oracle: 4 ARM cores + 24 GB RAM Always Free, genuinely generous); you install WordPress on it yourself. Typical install: Ubuntu 22.04 + Nginx + PHP 8.3-FPM + MariaDB. The one condition: account verification requires a credit card, and exceeding the quota means immediate billing.

Installing WordPress on Oracle Always Free

This setup gives you a real VPS experience; follow up with SSL setup with Let's Encrypt and the Nginx configuration guide and you have a fully production-ready WordPress site standing up at zero licensing cost.

Nginx Configuration (WordPress with PHP-FPM)

Trial / Sandbox: Wordify DevSites and CloudAccess

The trial model runs on a "try it before you decide" philosophy. CloudAccess is free for 30 days; when the trial ends the site shuts down or you're expected to migrate to a paid plan. Wordify's DevSites isn't fully free, but it offers similar functionality at a "developer-friendly" cheap price.

Pick this model if: you work at an agency and develop a site before showing it to a client, you want to spin up WordPress and evaluate it visually, you need real control to set up multiple staging environments. Don't pick it if: you're trying to build a permanent site — once the trial ends the site is deleted or charges start.

The Hidden Costs of Free Hosting

"Free" is misleading because the price isn't paid out of your wallet; the real cost shows up in time, risk, and opportunity cost. Each item below is something a free-hosting user runs into sooner or later.

Performance penalty: free accounts run on shared servers at the lowest priority. CPU throttling, I/O queue latency, shared cache misses — your page load time can be 2–4× that of a typical $5/month VPS.
SEO penalty risk: slow pages = poor Core Web Vitals = lost rankings. As we explain in the Page Speed and Core Web Vitals 2026 guide, sites with LCP > 4s can lose half their organic traffic.
Risk of content loss: backups generally don't exist. If the provider shuts down, your account gets suspended for a ToS violation, or the server crashes — your data is gone.
SSL / certificate validity issues: some free providers' own SSL still triggers the browser "Not Secure" warning; the lack of Let's Encrypt integration is a serious red flag.
Email delivery problems: SMTP on free hosting usually goes out over a shared IP. Those IPs are most likely on Gmail/Outlook spam lists. The password-reset email sent via wp_mail() never reaches your customers.
Migration lock-in: getting out of managed services like WordPress.com is hard; full database export, plugin/theme data, and user meta have to be moved manually.
Hidden data mining: some providers (especially the obscure ones) inject <script> tags into free accounts; that script collects user analytics or fires affiliate links. Always check this with browser DevTools.
Total cost of ownership: the migration effort you'll spend going from free to paid mid-year is more expensive — by several hours — than just starting on a cheap VPS from the beginning.

Local Providers in Turkey and Free Trial Options

Local hosting providers in Turkey (Natro, Turhost, İsimTescil, GoDaddy Turkey, Hostinger TR, etc.) generally don't offer truly free tiers; instead they use 30-day "money-back guarantee" windows and low entry pricing (entry plans around ₺19–39 / month, roughly $1–2 USD). That isn't really "free," but it's a useful mechanism for trials.

Short-term campaigns: some local providers bundle 1 year of free hosting with a free .com domain at year-end / Black Friday.
Educational discounts: if you have a corporate email on a .edu or .k12 domain, you can get a year of free hosting through packages like the GitHub Student Pack or Namecheap promotions.
Money-back guarantee: 30 days of zero risk. If you don't like it you refund and try a different provider; works well as a trial.
Local support advantage: Turkish-speaking support team, Turkish documentation, VAT invoice — the actual value proposition of a local provider.

If you want to launch a serious project on a tight budget, the shared/VPS/managed comparison tables in the what is hosting and types guide will help you pick the right plan for your scenario. In most cases, an entry shared plan at ₺50–100/month (around $3–5 USD) is much cheaper than the headaches a free alternative will eventually pile on.

Exit Strategy for the WordPress.com Free Plan (Migration)

Starting on a subdomain and moving to self-hosted WordPress later is a common path. Knowing the right order matters, because losing the SEO ecosystem along the way is the real risk. The process is typically four stages:

1. Full content export: WordPress.com admin → Tools → Export. You get an XML file in WXR format. Content only (posts, pages, comments, meta).
2. New host + WordPress.org install: VPS, shared, or managed hosting — doesn't matter; install WordPress 6.x.
3. WXR import: new site → Tools → Import → WordPress → upload the WXR file. Images are pulled from the WordPress.com CDN automatically (if you exceed the size limit you'll need to transfer the uploads folder manually).
4. Domain redirect: WordPress.com's "Site Redirect" feature is paid ($13/year) — sets up a permanent 301 redirect. If a custom domain is connected, point DNS to the new host and 301 from the old subdomain.

Speeding Up Free WordPress: Cache, CDN, and Optimization

The biggest weakness of free hosting is performance. But the right cache + CDN combo closes most of that gap. Use a three-layered approach: application cache (WordPress plugin), edge cache (Cloudflare), browser cache (HTTP headers).

WP Super Cache or W3 Total Cache: free, generates static HTML cache. Because it writes to disk, pages are served without PHP execution.
LiteSpeed Cache: if your provider runs LiteSpeed (e.g. GoogieHost, A2, Hostinger) this is the best choice — server-level cache. Details in the LSCache guide.
Cloudflare Free: static assets (images, CSS, JS) are served from the edge; origin load drops 60–80%. With a "Cache Everything" Page Rule, HTML can also be edge-cached (on non-ecommerce/non-login pages).
Image optimization: plugins like ShortPixel and Smush convert JPEG/PNG to WebP, cutting size by 50%.
Lazy loading: native since WordPress 5.5+ — the loading="lazy" attribute is added to images automatically. For above-the-fold hero images, fetchpriority="high" needs to be added manually.

Full HTML Edge Cache via Cloudflare Page Rules

This combo can drop the TTFB of WordPress on free hosting from 1.2s to 100–150ms. For most small blogs, that's enough.

Security Side: Hardening on Free Hosting

Security matters even more on free hosting because the provider usually doesn't supply a WAF, DDoS protection, or advanced monitoring. You have to apply WordPress's most basic hardening procedures by hand.

16+ character wp-admin password: use a password manager like 1Password or Bitwarden. Brute-force bots make millions of guesses every day.
Activate 2FA: Wordfence, miniOrange, Two Factor plugin — with TOTP (Google Authenticator).
Change the wp-login.php path: move it to a custom URL like /login or /giris using the WPS Hide Login plugin. Bot traffic drops 95%.
Disable XML-RPC: xmlrpc.php is used as a brute-force amplifier. Disable XML-RPC plugin or an.htaccess rule.
Disable file editor: add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. Even if an attacker takes over the panel, they can't reach theme/plugin code.
Auto plugin/theme updates: forgetting manual updates is the most common vulnerability.
Limit Login Attempts Reloaded: ban the IP after 5 failed attempts.
SSL/HTTPS enforced: HSTS header. Free Let's Encrypt is automatic on most providers.
Change the database table prefix: replace the default wp_ with a random prefix like wp_ax8z3_. Reduces SQL injection vectors.

OWASP's WordPress hardening guide is a useful additional read. For general security, our OWASP Top 10 2026 guide is a baseline reference for any web application.

Backups: The #1 Gap in Free Hosting

The quietest danger of free hosting is the absence of backups. If the provider's infrastructure crashes, if your account gets suspended for a ToS violation, or if the company stops operating, your data is gone unless you have your own backup. A disciplined backup strategy is essential.

UpdraftPlus (Free): the most popular WordPress backup plugin. The free version can ship backups to remote storage like Google Drive, Dropbox, or Amazon S3 (with manual API keys). Weekly full backup + daily DB backup is a typical configuration.
BackWPup (Free): an UpdraftPlus alternative. Cron-job based, with a powerful scheduler.
Manual mysqldump + tar: the most reliable method if you have SSH access. Automate with a cron job.
3-2-1 rule: 3 copies, 2 different media, 1 offsite. Free hosting + Google Drive + local disk = standard.

This script works if you have your own VPS. On typical shared free hosting where SSH/cron access is missing, go with UpdraftPlus.

Connecting a Custom Domain

Most free providers (InfinityFree, AwardSpace, GoogieHost) let you connect your own domain in the form siteadi.tld — they just want you to use their parking nameservers. Since free domains (Freenom shut down in 2024) are no longer an option, the most common path is to buy a domain from a cheap registrar (around $1–3/year for .xyz, .top, .online) and connect it.

The Cloudflare free tier alone closes most of the performance and security gaps in free hosting. Use it.

Email Delivery: The SMTP Trap

WordPress's wp_mail() function uses PHP's mail() by default, which sends email from the hosting server's shared IP. Free hosting IPs are most likely flagged on Spamhaus, Barracuda, and SpamCop lists. The result: password-reset emails, customer order confirmations, subscription notifications — none of them arrive.

The fix: integrate a transactional email service. All the major services offer free tiers:

Brevo (formerly Sendinblue): 9,000 emails per month free. Provides SMTP credentials.
Mailgun: 5,000 emails/month for the first 3 months, then 1,000/month free.
Amazon SES: $0.10 / 1,000 emails — practically free.
SendGrid: 100 emails/day free.
Postmark: 100 emails/month free; one of the market leaders on deliverability.

This config solves the deliverability problem. The WP Mail SMTP plugin (free version) does the same job through a GUI.

Real Performance Measurement: Free vs Paid

Let's look at the actual numbers behind the performance penalty of free hosting. The measurements below come from tests run in early 2026 — the values aren't exact, they show order of magnitude:

InfinityFree (empty WP): TTFB 800–1500ms, Lighthouse Performance 45–65, LCP 4–6s.
InfinityFree + Cloudflare + WP Super Cache: TTFB 80–200ms (cache hit), Lighthouse 75–85, LCP 1.5–2.5s.
WordPress.com Free: TTFB 200–400ms (their own CDN), Lighthouse 70–85, LCP 2–3s.
Oracle Always Free VM (Nginx + PHP-FPM + opcache): TTFB 60–100ms, Lighthouse 90–95, LCP 1–1.8s.
$5/month shared hosting (Hostinger entry): TTFB 100–250ms, Lighthouse 80–90, LCP 1.5–2.5s.
$10/month managed WordPress (Pressable, Kinsta): TTFB 50–150ms, Lighthouse 92–98, LCP 0.8–1.5s.

Net findings: Oracle Free Tier hits professional hosting performance when set up correctly — but it requires sysadmin work. The InfinityFree + Cloudflare combo is enough for a small blog; with zero setup, WordPress.com Free is also workable. If you want to run a serious project, $5–10/month shared or managed hosting represents a major leap in both performance and stability.

When Should You Switch to Paid? (Decision Matrix)

A checklist: if 2–3 of the items below turn into a "yes" for you, it's time to leave free hosting behind.

You get 10K+ visitors per month.
Your site has revenue (AdSense, affiliate, product sales).
You're building a long-term brand on a custom domain.
You'll be installing heavy plugins like WooCommerce.
You need an SLA (service-level agreement) for backups and recovery.
You're holding customer data (KVKK / GDPR responsibility).
Page speed and SEO ranking are part of your business model.
You need a development + staging environment.
Email deliverability is critical (membership, notification, receipt).
You have multiple users / a team to manage (editors, writers).

If 30%+ of this list comes back "yes," the cost of moving from free to paid (₺50–200, roughly $2–8 USD per month) is negligible compared to the assurance the work demands. If none of them apply, you can stay free; in the "just trying it out" scenario, free is also the right call.

A Zero-Cost, Anti-Lock-in Setup Recommendation

If you genuinely want to build a sustainable, portable, secure free WordPress, our recommendation is the following stack:

Domain: a .com or .net domain from a cheap registrar (around $5–10/year).
Hosting: an Oracle Cloud Always Free ARM VM (free) or the InfinityFree + Cloudflare combo (zero cost).
SSL: Let's Encrypt (Certbot auto-renewal).
CDN: Cloudflare Free.
Cache: WP Super Cache (Apache) or Nginx fastcgi_cache.
SMTP relay: Brevo Free (9K emails/month).
Backup: UpdraftPlus + Google Drive + weekly offsite Backblaze B2.
Monitoring: UptimeRobot Free (50 monitors, 5-minute interval).
DNS analytics: Cloudflare Analytics + Plausible self-hosted (on the same VM).
Security: Wordfence Free + 2FA + WPS Hide Login + Limit Login Attempts.

This stack is more than enough for a personal blog or portfolio doing 5–20K monthly visitors, looks professional, and most importantly: because it has no vendor lock-in, it can be moved to a different provider with a single click. About as solid as a zero-cost setup gets.

Common Mistakes

Not taking backups: assuming "the provider handles it." No, they don't.
Not configuring SMTP: panic when the password-reset email never arrives.
Being careless with plugin selection: a single "bad" plugin can add 500ms of latency. Only install plugins you actually need.
Picking themes by price: free themes often hide bloated code, encrypted footers, and silent redirects. Pick a theme from the WordPress.org directory.
Not keeping WordPress up to date: most hack attacks target WordPress installs that are three versions behind. Turn on auto-updates.
Setting your admin username to "admin": the first thing brute-force bots try. Always change it.
Skipping HTTPS: modern Chrome flags HTTP sites as "Not Secure." It kills conversion.
Using the same password for cPanel and WordPress admin: if one leaks, the other is gone too.
Copying files directly from localhost to production: localhost settings in wp-config.php collide with production. Updating the config with wp-cli is essential.
Leaving WP_DEBUG = true on during testing: everything ends up in the error logs, including the SQL password.

Frequently Asked Questions

Is free WordPress hosting really 100% free?

"Free" comes in two flavors: monetarily free (InfinityFree, WordPress.com Free) and quota-based free (Oracle Always Free, Wasmer Hobby). With the second, exceeding the quota means immediate billing; since you've already given a credit card, there's a "surprise bill" risk. With the first, no money is taken but resource limits are strictly enforced.

Does WooCommerce work on free hosting?

Technically yes, but it's not recommended. WooCommerce requires at least 1–2 GB RAM, fast disk I/O, and reliable cron jobs. On free shared hosting where the checkout page opens with 5–10 seconds of latency, abandoned-cart rates skyrocket. For WooCommerce, budget at least ₺100–200/month (around $4–8 USD) for hosting.

Is migrating from WordPress.com to WordPress.org hard?

Medium difficulty. Exporting content (WXR) is easy, but having images automatically pull into the uploads folder doesn't always work perfectly. Plugin and theme data don't migrate — the new site is built from scratch. For domain redirects you need to buy the WordPress.com "Site Redirect" upgrade ($13/year).

Can I open multiple sites under a single free account?

With most providers, no. AwardSpace allows 1 main domain + 3 subdomains; InfinityFree supports multiple addon domains, but each account has its own CPU/inode limit. Multisite (WP Network) usually works on free hosting but may be turned off in the admin panel.

Does showing ads violate the ToS?

It depends on the provider. AdSense is forbidden on the WordPress.com Free plan (their own WordAds run instead). On shared free hosting like InfinityFree, AdSense is fine as long as the site content is legal/copyright-compliant; "warez," proxy, and file-sharing content violate the ToS and lead to account suspension.

Does HTTPS come automatically on free hosting?

Yes on most modern providers (Let's Encrypt integration). InfinityFree, GoogieHost, and AwardSpace automate it. Very old or small providers may require a manual certificate upload or not offer SSL at all — in that case Cloudflare's "Flexible SSL" mode lets you show HTTPS to the user even if the origin is HTTP.

Is unlimited bandwidth real?

No. "Unlimited bandwidth" is marketing language; under the hood, every provider has a fair-use policy. Typical limits: daily CPU-second cap, requests-per-minute cap, concurrent-connection cap. As traffic rises you start getting 503s.

Resources and Further Reading

What Is Hosting? Web Hosting Types and Pricing — core hosting concepts
What Is a VPS? VPS vs VDS — building your own VPS
LSCache (LiteSpeed Cache) Guide — performance
Free SSL with Let's Encrypt — HTTPS
Website Management with cPanel — using the panel
WordPress SEO Plugin Recommendations — Yoast/RankMath
Page Speed and Core Web Vitals 2026 — performance metrics
How to Optimize a Website — end-to-end
OWASP Top 10 2026 — security
Nginx Configuration Guide — web server
DNS Lookup Tool
SSL Certificate Check Tool

Get professional support for sustainable WordPress hosting

If you're outgrowing the free plan, talk to the for lock-in-free migration and performance-focused setup get in touch

Readers of this article also read these

hosting 27 min