Who Hosts and Maintains a Treatment Center Website? What 60 Rehab Sites Show

Most treatment center owners cannot answer three questions about their own website: which company runs the server, which company holds the domain, and who installs the updates. That is usually fine until the day one of those three stops happening. Then the site is down on a Saturday, the ads are disapproved, or a form full of insurance details has been sitting in a database nobody signed a contract about.

This article answers the hosting question the way an operator needs it answered: who hosts a treatment center website in practice, who should maintain it, what each piece costs at published prices, and where patient privacy law changes the answer. On 29 September 2026 we looked up the hosting, domain, certificate and software details of 60 drug rehab providers that rank in 12 large US metros. We also read the policies of the hosts they use. We are an agency that builds these sites, so weigh our section at the end accordingly. The census numbers read the same whoever you hire.

The short answer on hosting and upkeep

A treatment center website is usually hosted by a managed WordPress company and maintained by whoever built it, and those two jobs should stay separate from ownership. Put the hosting account, the domain and the DNS in the center's own name, pay the host directly, and have your agency or developer work inside those accounts as a named user. Hosting a public marketing site is cheap: entry managed WordPress plans published in September 2026 run from $17.99 to $30 a month billed yearly. The expensive mistake is different. Mainstream hosts such as WP Engine and Kinsta will not sign a HIPAA business associate agreement, so any form that keeps admissions details on the website itself has to live somewhere else.

What we checked, and how

We searched "drug rehab" plus the city name for Los Angeles, Houston, Phoenix, Chicago, Denver, Atlanta, Miami, Nashville, Dallas, Seattle, Boston and Philadelphia, then kept only the results that belonged to a provider's own site. Directories, government pages, hospital systems, the Salvation Army and Wikipedia came out. That left 60 domains.

For each one we recorded the name servers and IP addresses, matched the addresses to the network that owns them, read the response headers that hosts stamp on their pages, pulled the security certificate, and looked up the domain's registrar and expiry date in the public registration database (RDAP). Where the homepage loaded, we also read which software it announces about itself. Twelve homepages refused our plain request or failed to connect, so homepage counts are out of 48. DNS and certificate data do not need the homepage, so those counts cover more.

Ten sites sit behind a security proxy that hides the real server. We did not try to get around that, so those ten count as "hidden" rather than a guess.

Who actually hosts rehab websites

One company hosts roughly a third of the market we sampled: WP Engine ran 19 of the 60 sites, identified by its own headers, its hostname in the DNS, or the network range it uses. No other host had more than three. Liquid Web, DigitalOcean and Amazon Web Services had three each. Thirteen more companies split the remaining 19 between them, from Kinsta, SiteGround, GoDaddy and Hostinger down to single sites on Squarespace, Pantheon and Microsoft Azure.

Two things in that chart matter more than the brand names. First, the 19 WP Engine sites run on a host that says, in writing, that it will not hold patient data. We come back to that below. Second, three sites resolved to an IP range registered to a marketing agency rather than a hosting company. That is the arrangement where the agency is your landlord. It works while the relationship lasts, and it turns leaving into a migration project, because the files, the server and often the content system sit in somebody else's account.

Notice also what is missing. None of the 50 sites whose host we could name ran on a host that markets itself to treatment centers. The agency pages that rank for "addiction treatment website hosting" sell hosting as part of a package, and the one we could read in full promised a dedicated IP address "ideal for SEO purposes" and published no price. Underneath, the market runs on the same general hosts everyone else uses. So the question worth asking a vendor is which host they resell, on whose account, and at what markup.

Three companies usually hold the keys

A working website depends on three separate accounts: the registrar that holds the domain, the DNS provider that points the domain at a server, and the host that runs the server. In our sample they were rarely the same company. Of the 50 sites where we could name the host, 15 used three different companies for those three jobs, 32 used two, and only three used one company for everything.

Splitting is not a flaw. Plenty of good setups keep the domain at one registrar, the DNS at Cloudflare and the site on a managed host. The risk is that each account has its own login, its own billing card and its own renewal email, and in a small center those three often belong to three different people, one of whom has left. GoDaddy was the registrar for 43 of the 59 domains whose records we could read, and the DNS provider for 30 of all 60. That concentration makes the first lookup easy: for most centers, one GoDaddy account decides whether the domain renews.

The registration data had one reassuring result. Every one of the 59 domains we could read carried a transfer lock, the flag that stops a domain being moved to another registrar without the owner's say. Registrars apply it by default, and it is doing its job across this market.

The domain is the one renewal that cannot be missed

If the host fails, you restore from a backup. If the domain lapses, the website, the email on that domain, and the phone number in every ad pointing at it all go dark together. ICANN's Expired Registration Recovery Policy requires registrars to send at least two reminders before expiry, one about a month out and one about a week out, and another within five days after. Between expiry and deletion, the policy has the registrar interrupt the domain's normal DNS, which is the moment the site disappears. Once a domain is deleted, the registry holds it in a 30-day redemption grace period during which the owner can still restore it.

In our census, 10 of the 59 readable domains were due to expire before the end of 2026, and only 13 were paid more than two years ahead. Yearly renewal is normal and not a problem on its own. It becomes a problem when the reminders go to an address nobody reads. That is what the ICANN notices are for, and it is the first thing to check: which inbox receives them, and whether the card on file is current.

When the domain expires, the whole cost falls on admissions. Google Ads disapproves ads whose destination returns an error to its crawler, under its "Destination not working" policy, so paid traffic stops at the same moment organic traffic does.

Where patient privacy decides the host

For a HIPAA covered entity, the rule on hosting is simple: any company that stores patient data for you is a business associate, and it has to sign a business associate agreement (BAA). The Department of Health and Human Services says this directly in its cloud computing guidance, last reviewed 23 December 2022. A cloud provider that creates, receives, maintains or transmits electronic protected health information on your behalf is a business associate. Encryption does not change that: HHS states that lacking an encryption key does not exempt a provider. And a host generally cannot claim the "conduit" exception that covers the postal service.

The two largest managed WordPress hosts in our sample have both said in writing that they will not sign one.

That does not make either host a bad choice for a treatment center. WP Engine's own post recommends exactly the split we would: keep the public marketing site on a fast managed host, and send anything carrying patient information to a separate system covered by a BAA. The catch is in the forms.

WordPress form plugins usually keep a copy of every submission inside the site's own database. Gravity Forms, the most common one in our census, says so in its own documentation.

Gravity Forms' retention setting offers three choices, and the first on the list, "Retain entries indefinitely", means entries are never deleted. Now put that next to the census. Of the 16 WP Engine homepages we could read, 9 carried Gravity Forms markup. The visible field labels included "Who Is The Treatment For?", "Relationship to Patient", and on one homepage, insurance provider, member ID and group number.

We cannot see from outside whether those sites store entries, delete them at once, or pass them straight to a BAA-covered system, and some will have it set up properly. The question for your own site is simply whether you know. If your inquiry form saves a family's insurance member ID into a WordPress database on a host whose policy forbids patient data, fix that before anything else in this article. For the wider picture on what counts as patient data on a website, we cover it in our guide to HIPAA and treatment center websites.

What hosting costs at published prices

Hosting a treatment center's public website costs somewhere between $18 and $30 a month on a mainstream managed plan paid yearly, and around $99 a month or more on a WordPress host that signs a BAA. These are the prices the hosts published on 29 September 2026, for the smallest plan that fits one business site.

A few details sit behind those bars. SiteGround's StartUp plan is $3.99 a month for the first prepaid year and renews at $17.99, so the renewal is the honest number. WP Engine's Essential plan starts at $28 a month billed yearly, which it shows as $336 paid up front. Kinsta's single-site plan is $35 month to month, with the first month free, or $30 a month paid yearly. HIPAA Vault prices its Essential WordPress plan at $120 a month, or $99 a month yearly, with the BAA included, and its Starter plan, sized for 10,000 to 100,000 monthly visitors, at $349 or $299.

So hosting itself is rarely the budget question. The one decision that moves the price is whether patient data will touch the site. If your forms hand everything to an admissions CRM or intake tool that has signed a BAA, and the website keeps nothing, a mainstream host is fine. If the website itself will store inquiries, you are shopping in the right-hand column.

Uptime promises matter less than they look. Kinsta's service level agreement guarantees 99.9 percent, and it spells out that downtime has to pass 43 minutes in a month before any credit is issued. A credit on a $30 bill does not replace an evening of lost calls, which is why monitoring, covered below, is worth more than the percentage.

Who should maintain it, and what maintenance means

Maintenance is four jobs, and a treatment center should know who does each one: software updates, backups, certificate and domain renewals, and monitoring. The host can do some of it automatically. The rest needs a named person.

Software updates are the job that fails quietly

WordPress ran 40 of the 48 homepages we could read, which puts updates at the center of maintenance for most centers. WordPress says on its releases page that only the latest version in the current series is safe to use and actively maintained. On the day we looked that was 7.1.2, released 22 September 2026. Of the 13 homepages that printed their WordPress version, 8 were already on 7.1.2, a week after release. That is what automatic minor updates look like when they work. One site was still on 6.2, a line first released on 29 March 2023, even though it carried that branch's latest patch.

Plugins are where sites fall behind. Elementor, a page builder, printed its version on 19 homepages. Only 9 were on the 4.3 line that wordpress.org listed as current on the day we checked, and 2 were still on version 3. Patchstack's 2026 security report counted 11,334 new WordPress vulnerabilities in 2025, 42 percent more than in 2024, and found 91 percent of them in plugins. It also found 46 percent had no fix available on the day they were made public, and that the median time from disclosure to mass exploitation, for the heavily attacked ones, was 5 hours. A monthly update habit cannot keep pace with a five-hour window. Automatic updates for trusted plugins, a firewall at the host, and a person who reads the alerts can.

The server software ages too. PHP, the language WordPress runs on, ended support for version 8.1 on 31 December 2025, and version 8.2 gets security fixes only until 31 December 2026. One site in our census announced PHP 8.2 in its headers, which gives it three months. On a managed host this is usually a button in the dashboard, but someone has to press it and then check the site still works.

Certificates now renew themselves, mostly

Certificate renewal used to be a yearly chore. It is now automatic for most sites, and the rules are moving to force that. The CA/Browser Forum's Ballot SC081v3 cuts the maximum life of a public TLS certificate from 398 days to 47 days in steps between March 2026 and March 2029. It passed with 25 certificate issuers voting yes and none voting no, and all four browser makers (Apple, Google, Microsoft and Mozilla) in favor. DigiCert's schedule for it: 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029.

Rehab sites are already there. Of the 57 certificates we could read, 55 were issued for 89 or 90 days by Let's Encrypt or Google Trust Services, which means a host or proxy renews them automatically. Only two were longer, at 198 and 394 days, and the 394-day one was issued in February 2026, before the first cap applied. If your certificate is one of the long, manually bought kind, ask your host to move it to automatic renewal before the 100-day limit makes a manual process painful.

Backups and monitoring

Backups are easy to buy and easy to never test. Managed hosts take nightly backups, and WP Engine lists them as automatic. What matters is whether anyone has restored one, and where the copies go. If your website stores patient information, the backups hold it too, which brings every backup destination back to the business associate question above. Monitoring means something outside your host checks the homepage and the admissions page every few minutes and texts a person, not a shared inbox, when either fails. Eleven of the 60 homepages refused our automated request outright and one failed to connect. That is often a firewall doing its job, but a firewall that blocks the wrong crawler can also stop Google's ad checks, so confirm your security settings allow Google's AdsBot.

The division of labor, in one table

Here is the split we recommend, whoever you hire. The center owns every account. The host runs the machinery. The agency or developer does the skilled work inside accounts it does not own.

Two rows deserve a second look. The hosting row says the center pays the host directly. Many agencies bundle hosting into a monthly fee, and that is fine if the account is in your name and the markup is disclosed. It is a problem when the account is theirs, because leaving then depends on their cooperation. The forms row is the one with legal weight. It is also the cheapest to fix, because form tools built for health data, Jotform among them, will sign a BAA once their HIPAA features are switched on.

If you want the contract side of this in detail, our piece on who owns your website covers the clauses. For what the build itself should include, see what gets built in an addiction treatment website.

What happens when you change agencies

Changing agencies is painless when the center owns the accounts, and slow when it does not. If the domain, DNS and hosting are in your name, a new agency needs to be added as a user, and the old one removed. Nothing moves. If the hosting sits in the old agency's account, the site has to be copied to a new server, the DNS repointed, forms and tracking reconnected and tested, and every integration checked. That is days of work at best, and it depends on the old agency handing over a full export.

The three sites in our census that resolve to an agency's own network show the shape of the risk, not a verdict on that agency. A treatment center in that position should ask for three things in writing now, while relations are good: a copy of the site and its database, a list of every account the site depends on, and a date by which a handover would be completed.

Where KhanWork sits in this, and when you do not need us

We do not sell hosting, and none of our three tiers includes it. The host bills you directly, at the prices above, in an account you own. Wherever we can, we set up hosting, the domain connection and analytics in the center's own accounts, then work inside them as a user you can remove. The website, the source files and the brand assets are yours. We build in Next.js and in WordPress and will work with the host you already have if it is sound.

Our pricing is monthly and published on the pricing page: Foundation at $1,000 a month, Growth at $2,500 and Scale at $5,000, with no minimum term; you can pause or cancel whenever you like. Foundation's landing page is live within 14 business days of your assets arriving; miss that and the next month costs nothing. Cornerstone Healing Center, one of our addiction treatment clients, saw 20 percent more conversions on its website once we had redesigned it. How we work with treatment centers is laid out on our addiction recovery industry page.

You probably do not need an agency for hosting at all. If your site is on a reputable managed host, the domain is in your name, updates are automatic and your forms send to a system that has signed a BAA, you are in better shape than most of the market we measured. Pay the host directly and keep the $30 a month. Where we help is when the site is not producing calls. For that, start with the free review of the page your traffic lands on, most often the homepage, or the page your ads send people to.

The locked-out drill: run it this week

Here is a test that takes an hour and tells you whether your website is really yours. Pretend your agency, developer or IT contractor stopped answering email tonight. Then, without contacting them, try to do four things.

1. Renew the domain. Look up your registrar in a public RDAP search, log in to that account yourself, and confirm auto-renew is on and the card is current. If you cannot log in, that is finding number one.
2. Change one sentence on the homepage. Log in to WordPress, or whatever runs the site, with your own admin account, not a shared one, and edit a line. Change it back.
3. Find last night's backup. Log in to the hosting account and find the most recent backup and its date. If the hosting account is not in your name, write down whose it is.
4. Trace one inquiry. Submit your own contact form, then find where the entry went: the website database, an email inbox, a CRM. Write down whether each place has signed a BAA with you.

Time each step. Anything you could not finish in 15 minutes goes to the top of your list for the next meeting with whoever runs your site. If all four worked, your hosting and maintenance are in order, and you can spend the budget on what brings in admissions instead.