IONOS Review (2025)

Like the guy who doesn’t say anything in group chats, I lurked around Reddit and found a web hosting company everyone loves to hate: IONOS.

Honestly, Google (Or DuckDuckGo) “IONOS Reddit” and you get the feeling IONOS doesn’t really pass the vibe check.

From deleting servers suspected of fraudulent activities without verifying with its users to unsatisfactory billing services, IONOS seems to have an uncanny talent for pissing off its customers.

Especially with its billing practices—It seems IONOS doesn’t allow customers to cancel their plans and get a refund easily.

So, I am basically gambling my own money on this review.

1. Plan

We are going continental!

A German web hosting company that had started out as 1&1 in 1988, IONOS rebranded itself many times before settling on a name inspired by the Earth’s ionosphere far above our heads.

Let’s see how high I can get with its WordPress Hosting Grow plan, which comes with:

This plan costs $10/mo for a 1-year commitment (Renewal, not promo price).

2. Speed Features

Opcode Cache

When someone visits your web page, your WordPress PHP code is compiled into opcode, the machine-readable instructions that generate the page’s HTML. This HTML is what visitors see in their browser. By caching the opcode with OPcache, your server can reuse it to generate the HTML instantly, without recompiling your code on every request.

IONOS Plugin

Comes with its own speed features:

1. Page cache: To store the HTML output generated with the opcode. This allows your web pages to load faster because they do not need to be regenerated from scratch on every request.
2. Browser cache: To store your static content (e.g, images) on your visitors’ devices so they don’t have to be downloaded again when they revisit your website.
3. Mod Deflate: To compress your static content with gzip so their file size is smaller, allowing them to be sent faster over the Internet.

3. Security Features

IONOS Plugin

The plugin is also my main defense with:

1. Vulnerability scanning: Powered by the WPScan database, which assigns security scores ranging from 1 to 10 for all plugins and themes. Higher scores mean higher security risks. Upon installation, IONOS checks whether a plugin or theme has a score higher than 7.0. If it does, IONOS proactively prevents the installation.
2. SSL Login protection
3. XML-RPC protection: WordPress can be remotely managed without using the admin console via XML-RPC. Disabling this helps prevent DDoS, brute-force, and other intrusion attacks.

Malware Scanning (Add-on)

According to the IONOS website, my plan includes this, but imagine my surprise (not) when it turned out to be a $6/mo add-on at checkout.

The real surprise? IONOS uses SiteLock for malware scanning and repair.

Yes, the same shady SiteLock that Bluehost and HostGator use. No wonder the upselling felt so familiar.

4. Speed Test

GTMetrix said my Largest Contentful Paint (LCP) was already a meh 534ms in Dallas, even though my server was in the US.

So without a CDN, I expected my LCP to be worse in London.

And it was at 1.1s.

5. Security Test

I launched 36,056 cyberattacks against my IONOS website:

• 2 out of 30 high risk vulnerabilities detected:
  • Path Traversal: 4 out of 1,127 attacks successful.
  • SQL Injection: 2 out of 1,708 attacks successful. Some attacks even exposed vulnerabilities in my wp-login page.
• 0 out of 12 medium risk vulnerabilities.
• 2 out of 2 informational risks. 1,220 alerts but these aren’t vulnerabilities.
• Success Rate: 34,830 or 96.6% of my attacks were completely neutralized.

Amazingly, my scan took 4 hours to complete because IONOS rate-limited my attacks with the X-WS-RateLimit-Limit header, which caused each of my requests to take nearly 1s to reach my website.

Kudos to IONOS!

6. Uptime Test

Their redemption continues.

IONOS actually has a detailed status page that shows which services (eg. hosting, domain, eCommerce) are operational.

It even publishes incident reports from the past 3 months, with each containing details like start times, updates during the incident, and resolutions.

However, after monitoring my IONOS website every minute for 20 days, UptimeRobot reported 99.96% uptime with 3 downtimes lasting 6 minutes and 7 seconds.

HetrixTools reported almost the same results after monitoring my site at 1-minute intervals for 20 days – 99.98% with 2 downtimes lasting 5 minutes.

So, this meant that IONOS failed to meet their 99.99% uptime commitment.

The second issue I found with IONOS’ uptime was related to its UK data centers – from the major server outage in April 2019 to more recent incidents reported on its X (formerly Twitter) feed.

7. AI-Powered Web Creation

I am seeing a trend here with older hosting providers like Hostinger: They seem to think that jumping on the AI bandwagon and bundling in a website builder makes them more relevant.

But my AI-generated website seemed meh at best and try-hard at worst.

To be fair, I think this is subjective because one man’s AI-generated website might be another man’s treasure.

And treasure or not, here’s a peek of what IONOS generated for me:

8. Cons

No NVMe SSD Storage

Only available in its dedicated plans. Makes IONOS servers slower than servers with these SSDs.

No Object Cache

Only available in its dedicated plans, while many hosts offer at least Memcached or Redis for free. If your opcode includes instructions to query your database, PHP has to retrieve the data on every request, even if it has been requested before. Because databases are slower than object caches, data retrieval is slower and your database might be overloaded with repeated queries.

No WAF

Like come on, how hard is it to install an open source WAF like ModSecurity?

No CDN

Although IONOS has an article explaining how to activate a free Cloudflare CDN for its WordPress plans, Support confirmed that this feature is no longer available. And the lack of a CDN definitely showed – my website was noticeably slower outside the US. I even tried setting one up with a Namecheap domain but…

External Domains Don’t Work

I followed IONOS’ instructions to connect an external domain by adding a TXT record to my DNS, but the verification remained stuck in ‘pending’. I even tried getting another plan to use my Namecheap domain from the start, but IONOS told me I’d need to transfer the domain to them. Wow, no thanks.

Shady Hosting Plans

Like HostGator’s, IONOS’ website gives the impression that malware scanning (SiteLock) is included for free with its hosting plans. I got my plan expecting this, only to find out it’s actually a paid add-on.

9. Biggest Con?

Well, regarding the complaints about IONOS’ questionable billing practices…

In my case, I did get my money back because I canceled my plan within the 30-day refund period.

So my gamble paid off.

10. Evaluation

Let’s see how IONOS did against my self-hosting:

	Self-hosting	IONOS
Speed (LCP) – Dallas	306ms	534ms
Speed (LCP) – London	253ms	1.1s
Security	0	2 high risk vulnerabilities, but they rate-limited my attacks.
Uptime	95%	99.97% with status page and incident reports. UK customers should be concerned with its history of outages there.
Winner	👑

11. Final Thoughts

IONOS says its name comes from the ionosphere high above our heads, but me personally, I think it belong down in the sewers.

Well, almost.

To its credit, IONOS does rate-limit attacks, maintains a detailed system status page, and publishes past incident reports.

But that’s about where the good stuff ends:

1. IONOS’ WordPress plans are the only ones I’ve seen that don’t support a CDN
2. It mislead users by advertising free malware scanning that’s actually a paid SiteLock add-on
3. It lacks basic features that are standard at other hosts, like an object cache and WAF

To paraphrase the Flash: if there were an Olympics for the least developed WordPress host, IONOS would be Michael Phelps.

So, instead of aiming for the sky, IONOS might want to look down at the ground, starting with the chorus of frustrated Reddit threads.

After all, the last thing IONOS wants is yet another rebrand just to start everything anew.