Bluehost Review (2025)

Ah, Bluehost—the one with the most affiliates.

Shall I contribute yet another glowing review about why you ABSOLUTELY need to use Bluehost?

First, let’s recap some family history.

1. (Ex) EIG Family Curse?

Founded in 2003, Bluehost was later acquired by the Endurance International Group (EIG), along with other hosting providers like HostGator.

Since then, there have been a lot of online complaints.

A lot involving website downtime and compromised websites, with Bluehost’s support often described as unhelpful (Dive deep here on Reddit).

It got so bad that some users compiled a list of EIG-owned hosting companies and shared a PSA urging others to avoid them.

Not me though.

And nope, it’s not for that sweet, sweet affiliate cash.

As an independent blogger, I review every WordPress hosting provider objectively, even if it has some shady associations.

I won’t become an affiliate if I think the host sucks. And who knows, maybe the Bluehost apple falls very far from the EIG tree?

Moreover, EIG merged with Web.com to form Newfold Digital in 2021, a new company that Bluehost has been with since.

Let’s see if Bluehost can break the family curse and redeem the Newfold Digital name.

2. My Plan

I got the WordPress Choice Plus, which comes with:

This plan costs $15.99/mo for a 1-year commitment (Renewal, not promotion price).

As with HostGator, I wasn’t satisfied with this level of detail, so I contacted the Bluehost Support team for more info. This started well.

3. Speed Features

WordPress Plugin

Bluehost’s free plugin comes with:

• Static content caching: Speeds up load times by caching assets like images, so they display faster when someone visits your website.
• Image optimization: Compresses your images and converts them to the WebP format, so they load even faster for your visitors.

CDN

Bluehost uses Cloudflare to cache your website across 335 cities worldwide and deliver content to them along optimized routes with Argo Smart Routing.

4. Security Features

CDN

As the point of entry to your site, Cloudflare is also your primary defense at the edge with:

Like HostGator though, Cloudflare is also your only line of defense unless you get SiteLock.

Malware Protection

Starting at $7.99/mo.

Support says SiteLock helps to protect your website from malware infection, but I am a bit skeptical.

If other online reviews are to be believed, it seems SiteLock has a pretty scummy reputation. Some users reported that they would charge you extra to repair your compromised website, effectively holding you ransom.

Some even said that SiteLock would send false alarms about your website being hacked to scare you into paying for their services.

Not sure if this is real because I haven’t experienced it myself, but there are way too many similar stories out there to ignore.

Malware Scanning

That said, if SiteLock is really good and your website got infected because you didn’t get it, you can request a free malware scan from Support and they’ll run it in the backend.

Website backups

Unlike HostGator, Bluehost includes free automatic backups with CodeGuard to recover your website if it gets infected.

IP Blocker

Finally, you can get your hands dirty by blocking suspicious IP addresses in the dashboard or cPanel. However, you’d need to go through your logs to find out who’s attacking you.

5. Speed Test

GTMetrix said my Largest Contentful Paint (LCP) was a decent 354ms in Dallas.

However, it got worse at 559ms in London.

6. Security Test

I launched 19,365 cyberattacks against my Bluehost website:

• 2 out of 30 high risk vulnerabilities detected:
  • SQL Injection: 24 out of 668 attacks successful. The worst of all the hosting providers that I have reviewed so far.
  • SQL Injection – SQLite: 1 out of 336 attacks successful. Okay as Bluehost doesn’t use SQLite.
• 0 out of 12 medium risk vulnerabilities.
• 1 out of 2 informational risks. 1,206 alerts but these aren’t vulnerabilities.
• Success Rate: 18,134 or 93.6% of my attacks were completely neutralized.

7. Uptime Time

In the 20 days I was testing it, UptimeRobot reported that my Bluehost website enjoyed 100% uptime after checking on it every minute.

HetrixTools reported the same results after monitoring my website at 1-minute intervals for 7 days.

However, like BlueHost, HostGator doesn’t publish its current system status or even outage history, while other hosts do so with details like start times, fix updates, and resolutions.

Heck, even its X (formerly Twitter) page is practically dead.

So like Bluehost, you won’t get wind of major outages (like the one in 2013). In fact, it had this to say:

And the best part? Bluehost doesn’t guarantee a minimum uptime, unlike most decent hosts.

So Bluehost just doesn’t pass the vibe check here.

8. AI Site Creator

Like many hosts, Bluehost has jumped on the AI bandwagon with its AI-powered Site Creator.

Just enter a prompt to get things started.

Personally, I find its generated website designs better than Hostinger’s, especially its Testimonials section. But I am not a UI designer, so take my opinion with a grain of salt.

Still, I think it’s a nice feature to have, though it’s not a deciding factor in whether I consider Bluehost a good hosting provider.

9. Cons

Note: You might wanna skip this if you have already read my HostGator review —Bluehost has almost the exact same cons.

MySQL

Slower than MariaDB. I don’t know many hosts still using it, besides HostGator and SiteGround.

Not NVMe SSD Storage

Only available in Bluehost’s VPS hosting plans. This means its servers are slower compared to hosts like Chemicloud and InterServer, which use NVMe SSD storage.

Image Optimization Failures

None of my images (existing or newly uploaded) were successfully optimized using Bluehost’s plugin.

No Opcode Cache

Usually OPcache that many other hosts include for free. When your PHP code runs to load a web page, it’s compiled into opcode, or machine-readable instructions that generate the HTML your visitors see in their browser. Without OPcache, this compilation happens on every request, slowing down your page load times.

PHP Workers Unknown

Specifically, PHP workers handle the process of compiling your code into opcode when there’s a request. Each worker can only handle one request at a time. So, the fewer workers you have, the fewer requests your website can handle concurrently, slowing down your page loading times again.

No Object Cache

Usually Memcached or Redis that many other hosts include for free. If your opcode includes instructions to query your database, your PHP worker must retrieve the data with every request, even if it has been requested before. Since databases are slower than object caches, data retrieval is slower and your database might become overloaded with repeated queries.

No JavaScript (JS) Deferring

Unless you get the paid Jetpack Boost. This feature ensures that your HTML loads and renders correctly before JS files are executed in the proper order. Without JS deferring, some JS files can block this rendering process, causing your website to load more slowly or appear broken.

No Server WAF

You only have Cloudflare (and SiteLock) to protect your server. So if an attack gets past them, good luck.

No Uptime Guarantees

Only available in its Cloud hosting plans. Seriously, HostGator’s the same. What’s wrong with EIG hosts?

Scanty Hosting Plans

Wanna know how I know Bluehost doesn’t offer any of the above? I had to contact Support for more details about my plan, because none of it was listed on its website.

10. Evaluation

Let’s see how Bluehost did against my self-hosting:

	Self-hosting	Bluehost
Speed (LCP) – Dallas	306ms	354ms
Speed (LCP) – London	253ms	559ms
Security	0	2 high risk vulnerabilities (1 doesn’t affect WordPress). Worst SQL vulnerability ever.
Uptime	95%	100%, but no uptime guarantee, outage reports, or current system status.
Winner	👑

11. Final Thoughts

Remember this scene from Casino Royale (0:34), where a terrorist asks how he can trust Mads Mikkelsen’s Le Chiffre, a man he’s never met, with his money?

Bluehost feels like that – you can’t seem to trust them with your website.

And I have met Bluehost.

Bluehost’s best feature was its speed, which was only good in the US but meh in other parts of the world.

I was even less impressed by its other features, or lack thereof.

Features that are standard at other hosts seem to be premium at Bluehost. Almost like it is pushing customers to get its more premium cloud and VPS hosting plans.

And it shows.

Bluehost has a serious SQL vulnerability and doesn’t even seem to care about its uptime and downtime, transparency concerns and other online rants be damned.

If only it have the same zero chill about its upselling attempts.

For these reasons, there’s absolutely no way I can recommend a host like Bluehost.

Even if it has ‘AI’ in its plans.

To be honest, writing this review was both frustratingly slow and refreshingly fast.

Slow, because Bluehost doesn’t give much information about its hosting plans on its website.

Frustrating, because it took a while and a lot of patience to get the details out of Support.

Fast, because my tests made Bluehost such a hard pass that it wasn’t hard writing this review.

Refreshing, because I am happy my self-hosting solution totally cooked such a famous hosting provider.