There’s a scene in every disaster movie where the scientist stares at a graph, takes off their glasses, and says dramatically: “It’s happening faster than we thought.” Substitute the graph for the 2026 CloudLinux/WebPros Web Hosting Trends Report, and the scientist for anyone who’s walked the CloudFest exhibition floor lately, and you’ve got the mood of the hosting industry right now. Nobody’s panicking, exactly, but everybody’s recalculating.
The report surveyed 446 hosting providers worldwide, and the headline number induces serious forehead sweat: 41% of providers say they’re losing customers to SaaS site builders. Not to a competitor with a shinier control panel: to Shopify, Squarespace, and their friends, who’ve quietly convinced a huge chunk of the market that “hosting” is a problem best solved by not thinking about hosting at all. Add in that 56% of churn is straight-up price sensitivity, and you get a picture of an industry getting squeezed from both ends: undercut on price by the bargain bin, and out-innovated on convenience by the all-in-one platforms. It’s less “death by a thousand cuts” and more “death by two very specific, very sharp samurai swords.”
The security gap nobody wants to admit to
Here’s the part that should worry more than the accountants. Patchstack tested 18 hosting providers against real, documented WordPress exploits and found that, on average, only 26% of known attacks were actually blocked. Some providers blocked nothing. Zero. As in, if you handed them a list of known WordPress vulnerabilities, their servers would wave every single one through like a bouncer who’s given up caring who’s on the list. With 11,334 new WordPress ecosystem vulnerabilities logged in 2025 alone (a 42% jump over 2024), and a median time of five hours between disclosure and mass exploitation, “we’ll patch it eventually” stopped being a strategy sometime around the Obama administration. It’s exactly why efforts like FAIR’s partnership with Patchstack matter: someone has to be doing the unglamorous work of closing that gap while the rest of the industry argues about margins.
Jorijn Schrijvershof’s breakdown of the 2026 data puts a fine point on where the squeeze actually lands: it’s not just prices creeping up, it’s plans quietly shrinking underneath you. One major budget host cut Business-plan storage from 200GB to 50GB, dropped mailboxes from 100 to 5, and halved the site limit, all while keeping the sticker price exactly the same. It’s the hosting equivalent of a cereal box getting smaller while the price stays put, except instead of slightly fewer Froot Loops, you find yourself running out of inodes at 2:00am on launch day.
Meanwhile, the M&A carousel keeps spinning
If the margin story is the slow-motion part of this disaster movie, the consolidation wave is where buildings start falling in the background. One European hosting group completed 11 acquisitions in 2025 alone, basically one a month, which is either an aggressive growth strategy or a transparent tell that organic growth got hard. Meanwhile, the parent company behind several household-name budget hosting brands took a Moody’s downgrade to Caa1 and needed $100 million in emergency financing from its own private equity owners just to keep the lights on. That’s not “strategic pivot” language. That’s “the bank called” language.
And it’s not slowing down. MonsterMegs’ look at the wider consolidation trend points to Automattic’s quiet, unannounced acquisition of the WebHosting.com domain from AT&T in mid-2026—no press release, no roadmap, just a “coming soon” page with a familiar logo where a dormant placeholder used to be. When even the company behind WordPress.com is buying up brand equity by stealth, you know the industry has entered its “everyone’s a potential acquisition target” era. Somewhere, a hosting founder is having their Michael Corleone moment: “Just when I thought I was out, they pull me back in.”
So what does this mean if you’re actually running things?
This is where it stops being a spectator sport for anyone in the CloudFest orbit: hosts, registrars, agencies, the whole ecosystem that makes the open web actually work day to day. The providers cited as bucking the churn trend aren’t the cheapest ones; they’re the ones investing in exactly what the report flags as 2026 priorities: performance (44%), security and compliance (43%), and automation (41%); the same shift we’ve been tracking as compliance becomes non-negotiable across the whole IT stack. In other words, the way out of the margin trap isn’t a race to the bottom on price; it’s a race toward being genuinely, boringly reliable; which turns out to be a much harder thing to fake than a landing-page discount banner.
None of this is abstract for the people who are coming to Europa-Park in March. Consolidation and commoditization pressure are exactly the kind of “boring until it isn’t” business trends that reshape which vendors are still around at next year’s show, which acquisitions get announced on the show floor, and which independent hosts decide the smartest move is to get acquired on their own terms rather than wait for a Caa1 downgrade to make the decision for them. The open web doesn’t die from consolidation, but it does get quieter, with fewer independent voices setting the terms, which is exactly the question CloudFest 2026 put on stage: where does the internet actually go from here? Follow that up at CloudFest Americas 2026 in November, which is where the Independent Cloud gathers.
Want the state-of-the-industry data as it lands, not six months after the fact? Subscribe to the CloudFest newsletter and get the next State of the Cloud Report, plus the sessions and speakers tackling exactly this stuff, straight to your inbox.
