Nexcess Review for Regulated Industries Needing SOC 2 Compliance

The research in brief

Nexcess is a mixed fit for SOC 2 compliance hosting. Three of seven platforms named it during ranking discovery (DeepSeek, Gemini, Perplexity), with an average listed rank of 7.0 and a best rank of 6. The strongest reason to consider it is that Nexcess publicly claims SOC 2 Type II-aligned infrastructure, SOC 3 Type 2-audited data centers, and audit-support services including QSA assistance and automated evidence collection ^[18]. The main limitation is that reviewed public materials do not verify a current SOC 2 Type 2 report explicitly covering the Managed WordPress service, and historical audits from 2017 covered colocation, not managed WordPress ^[43].

Research Snapshot

Why Nexcess Qualified for This Study

Questions explored

• Why did Nexcess qualify for this SOC 2 compliance hosting study when only three platforms named it?
• Is Nexcess a legitimate contender for regulated-industry WordPress hosting, or did it qualify on brand recognition alone?

Nexcess qualified because it cleared the study's minimum-mention threshold and because multiple platforms independently associated it with compliance-oriented hosting. Three of seven platforms named Nexcess during ranking discovery - DeepSeek at rank 6, Gemini at rank 7, and Perplexity at rank 8 - giving it an average listed rank of 7.0 and a 42.9% share of included platform responses.

The qualification is not purely brand-driven. Platforms cited company-owned documentation describing SOC 3 Type 2-audited data centers and GDPR, SSAE-18, and PCI DSS compliance ^[21], annual SOC 1 Type II and SOC 2 Type II assessments under SSAE-22 ^[18], and a compliance-focused hosting product line with audit-ready documentation and GRC advisory support ^[12]. Independent coverage also exists: a 2017 SOC 2 Type 1 examination for colocation services was reported by PRWeb and HostingJournalist ^[43], and a 2016 SOC 1 Type 2 examination was reported separately ^[44].

That said, qualification is not endorsement. Nexcess ranked in the lower half of the field on every platform that named it, and the compliance evidence is weighted heavily toward company-owned pages. Company-owned citations materially outnumber independent citations in this study, so company claims should not be read as independently verified.

The hosting offering in focus

Questions explored

• Which Nexcess plan should a regulated buyer choose if they need SOC 2-aligned WordPress hosting?
• Does Nexcess Spark at $21 per month include the same compliance coverage as Nexcess Enterprise plans?

The relevant offering is Nexcess managed wordpress hosting, with the strongest compliance positioning attached to Enterprise plans and to Managed Cloud or Dedicated WordPress arrangements rather than entry tiers ^[16].

Platforms described the relevant product differently, and that inconsistency matters for a buyer. OpenAI pointed to Managed WordPress hosting, particularly the Enterprise Support Group or custom managed cloud/dedicated WordPress arrangements. Anthropic named Managed WordPress Hosting, Enterprise plans, and Managed Cloud / Dedicated WordPress. Deepseek named the Nexcess Spark Managed WordPress plan or higher tiers. Google pointed to Nexcess HIPAA & PCI-DSS Compliant Cloud Hosting and Managed Dedicated Servers. Kimi named Managed WordPress (Spark and higher) plus Managed Cloud / Dedicated under the Liquid Web parent. Perplexity named Managed WordPress, especially Enterprise plans, plus Managed Cloud / Dedicated WordPress.

The practical implication: entry-level plans and enterprise plans are not described as carrying the same compliance posture. Google's research explicitly found that standard lower-tier managed WordPress plans starting around $19 per month are hosted on shared systems and do not inherit the isolated compliance features, which are restricted to specialized Compliant Cloud and Dedicated plans ^[31]. A regulated buyer should treat the specific plan, not the brand, as the unit of compliance.

What the AI Platforms Agreed About

Questions explored

• What do AI platforms agree that Nexcess provides for SOC 2 compliance hosting?
• Does Nexcess offer audit documentation and vendor review support for regulated buyers?

Platforms broadly agreed that Nexcess markets compliance-oriented infrastructure and audit-support services, though the agreement rests mostly on company-owned sources.

On infrastructure compliance claims, platforms converged. Nexcess publicly states that its global data centers are SOC 3 Type 2 audited and references GDPR, SSAE-18, and PCI DSS compliance ^[21]. Nexcess states it undergoes annual SOC 1 Type II and SOC 2 Type II assessments under SSAE-22 ^[18]. Nexcess also states its infrastructure is PCI, GDPR, and SOC 2 Type II compliant ^[23], and that enterprise WordPress hosting is backed by SOC 3-audited data centers with 24/7 support ^[27].

On audit and vendor-review support, platforms also converged. Nexcess documents compliance dashboards, automated evidence collection, audit trail logging, and HIPAA and PCI-DSS framework mappings ^[12]. It documents QSA assistance and vendor review support, including having a Nexcess engineer available in the audit room ^[12]. It documents GRC advisory support with dedicated account management for compliance-tied workloads ^[12]. Audit evidence is logged continuously so documentation can be prepared before the review cycle begins ^[12].

On shared responsibility, platforms agreed that Nexcess does not absorb the buyer's compliance burden. Nexcess's own PCI guidance states that PCI-compliant hosting does not automatically make the customer's store compliant ^[24]. Google's research described a shared responsibility model in which Nexcess manages physical servers, network infrastructure, and virtualization while the client remains responsible for application security, database access controls, and data processing ^[38]. Deepseek estimated the SOC 2 report covers only the infrastructure layer - roughly 10-15% of a typical control matrix - leaving the buyer responsible for application access, logging, change management, and incident response ^[30].

On managed WordPress security features, platforms agreed on the operational baseline: daily backups, SSL, staging, Cloudflare Enterprise, DDoS protection, a web application firewall, automatic updates, SSH keys, and team permissions ^[26]. Enterprise WordPress hosting adds firewalls, threat detection, malware scans, onsite security, automatic updates, and daily backups ^[27].

Where the AI Platforms Disagreed or Were Uncertain

Questions explored

• Is Nexcess's SOC 2 Type II attestation current, and does it explicitly cover Managed WordPress?
• Which legal entity holds the Nexcess SOC 2 report, and does the audit scope include the WordPress service?

The central disagreement is whether a current SOC 2 Type 2 attestation exists and whether it covers Managed WordPress specifically. This is unresolved across platforms.

OpenAI found that Nexcess public materials use both SOC 3 Type 2 and SOC 2 data-center wording in different contexts, and that the reviewed sources do not resolve whether a current SOC 2 Type 2 attestation exists, what entity holds it, or whether it covers Managed WordPress ^[21]. Anthropic found that historical SOC 2 Type 1 reports dated 2017 specifically covered colocation services, and that current SSAE-22/SOC 2 Type II scope is stated broadly across hosting but explicit coverage for managed WordPress is not independently verified ^[43]. Grok concluded that independent sources show only older or related certifications, and that no current public SOC 2 Type II report was identified for managed WordPress services ^[6]. Kimi found no Nexcess-specific SOC 2 page or explicit product-level Type II claim, and noted that compliance flows through parent company Liquid Web ^[30]. Perplexity found that sources conflict in terminology and scope - some pages say SOC 2 Type II compliant infrastructure, others say SOC 2 Type II enterprise hosting, and one uses broader SOC2-ready wording without providing the underlying report ^[23].

Report currency is also unresolved. Anthropic found no current SOC 2 report date, audit firm name, or report period publicly displayed, and that verification of 2025-2026 report status is not available in public materials. Deepseek found the auditor name for Nexcess/Liquid Web's SOC 2 is not disclosed in available sources. Kimi found the SOC 3 report is publicly downloadable while the SOC 2 report requires an email request and potentially an NDA.

Corporate structure adds further uncertainty. Anthropic noted that Nexcess was acquired by Liquid Web, that nexcess.net increasingly redirects to liquidweb.com, and that it is unclear whether all Nexcess products receive unified SOC 2 attestation or whether older Liquid Web and newer Nexcess products have separate audit scopes. Kimi found it unverified whether Nexcess infrastructure is fully within Liquid Web's SOC 2 scope or operates under separate controls, and that the buyer must verify whether Nexcess operations are explicitly in scope of Liquid Web's SOC 2. Google noted it is sometimes unclear to external auditors which specific physical data centers host Nexcess workloads under the Liquid Web corporate umbrella.

Access control and logging detail is also uncertain. OpenAI found that reviewed materials do not specify complete administrative audit-log coverage, retention duration, SIEM integration, or whether logs are included and exportable for every Managed WordPress plan. Deepseek found specific access control, audit logging, and SIEM integration capabilities for the Managed WordPress product are not directly documented. Kimi found no Nexcess-specific documentation on RBAC granularity, SCIM, SAML SSO, or audit log streaming for SOC 2 CC6/CC7 control families.

Features for this workload

Questions explored

• What security and audit features does Nexcess Managed WordPress include for a vendor security review?
• Does Nexcess support MFA, team permissions, and downloadable access logs for compliance evidence?

Nexcess documents a managed WordPress feature set that supports operational security, plus a separate compliance-support layer that is most clearly described on enterprise and platform pages.

Managed WordPress capabilities include core updates, backups, plugin management, visual testing, and portal-based management ^[3]. Public plan pages list backups, SSL, staging, Cloudflare Enterprise, DDoS protection, and a web application firewall ^[26]. Enterprise WordPress hosting adds firewalls, threat detection, malware scans, onsite security, automatic updates, and daily backups ^[27].

Access control and logging features include two-factor authentication, team permissions, SSH keys, and the ability to download access and error logs through the client portal ^[22]. Data centers are described as using biometric authentication, video monitoring, intrusion detection, controlled access systems, reinforced construction, and onsite technicians ^[5]. Nexcess also describes managed firewalls, intrusion detection, DDoS mitigation, end-to-end encryption, and vulnerability scanning monitored 24/7/365 ^[42].

Compliance-support features are the most directly relevant to a vendor security review. Nexcess describes compliance dashboards, automated evidence collection, audit trail logging, and HIPAA and PCI-DSS framework mappings ^[12]. It describes QSA assistance and vendor review support ^[12]. It describes clear documentation of responsibility boundaries between Nexcess and the customer team, available for auditor review without a separate request ^[12]. It describes GRC advisory support with dedicated account management for compliance-tied workloads ^[12].

Two caveats apply. First, these compliance-support descriptions appear primarily on platform, enterprise, and infrastructure pages rather than on a plan-specific trust package for managed WordPress, so the exact evidence available to a procurement team remains partially unclear ^[12]. Second, the buyer retains responsibility for WordPress application security, plugins, administrator accounts, configurations, and endpoints ^[24].

Pricing, renewal terms, and ongoing costs

Questions explored

• How much does Nexcess cost per month for compliance-oriented WordPress hosting, and are there setup or cancellation fees?
• What are Nexcess's contract and cancellation terms for a regulated buyer?

Public pricing is promotional, plan-dependent, and inconsistent across platforms, and compliance-specific pricing is not publicly transparent.

Standard Managed WordPress pricing was reported differently by platform. OpenAI found introductory pricing shown publicly from $5 per month for selected plans with one-year upfront billing ^[26]. Anthropic reported entry WordPress (Spark) at $6-$21 per month depending on term and promotions, mid-tier at $79-$149 per month, and enterprise plans at $299-$999+ per month, with annual billing discounts of roughly 20-33% ^[39]. Deepseek and Kimi both reported Nexcess Spark starting at $21 per month and Liquid Web Managed Cloud VPS 2GB at $59 per month ^[30]. Google reported standard paid WordPress plans starting at $19.00 per month, which it noted are not isolated compliance plans, and compliance-ready HIPAA and PCI-DSS cloud hosting starting at $199 per month ^[31]. Perplexity reported Managed WordPress Enterprise at $490.80 per month billed for three months, or a $5,940 annual price on the checked plan table ^[26]. Grok reported compliance-focused hosting starting at $199 per month, with enterprise WordPress plans requiring a quote.

These figures conflict and should not be treated as a single reliable price list. Promotional pricing may not represent renewal or enterprise pricing, and enterprise, dedicated, custom-cloud, compliance-documentation, and enhanced support pricing is unclear and should be quoted ^[26].

On contract terms, Nexcess documents that services may be monthly or term-based, that a contracted service cannot be canceled until the contract expires, and that each service requires a separate cancellation request ^[1]. Anthropic reported monthly, 1-year, 2-year, and 3-year billing terms with progressive discounts, and no explicit mention of early termination fees in public materials. Deepseek found published rates suggest annual billing with month-to-month terms unclear. Perplexity found contract length, renewal behavior, and cancellation terms for the relevant enterprise WordPress offering were not clearly verified.

On additional fees, no verified public fee schedule was found for SOC reports, security questionnaires, audit assistance, compliance addenda, dedicated account management, or custom logging (ChatGPT). Deepseek noted HIPAA BAA fees, if applicable, are likely an add-on cost. Kimi noted SOC 2 report access may require an NDA and sales engagement, and compliance-specific customization or HIPAA BAA likely carries uplifted enterprise pricing. Google noted custom enterprise architecture migration fees are quote-by-quote and that a 30-day money-back guarantee applies to hosting plan services.

Best Suited For

Questions explored

• Who is Nexcess best suited for in a SOC 2 compliance hosting decision?
• Is Nexcess a good choice for a regulated buyer that can verify compliance scope directly with the vendor?

Nexcess is best suited to buyers who can obtain and validate compliance evidence directly, and who accept that the attestation covers infrastructure rather than their application.

Platforms converged on a similar buyer profile. OpenAI described the best fit as organizations needing managed WordPress with documented infrastructure security, PCI-oriented controls, backups, staging, and support, plus buyers willing to obtain a current SOC 2 or SOC 3 report, bridge letter, scope statement, and responsibility matrix directly from Nexcess before purchase. Anthropic described companies in healthcare, financial services, or regulated industries operating WordPress sites that require vendor SOC 2 attestation, organizations undergoing security reviews that require proof of third-party compliance, and enterprises needing documented responsibility boundaries for audit defense. Deepseek described small-to-mid-scale WordPress sites in regulated industries where the buyer's application scope is limited and the primary need is a pre-attested infrastructure layer, plus buyers wanting a single vendor offering SOC 1, SOC 2, and HIPAA-capable hosting. Google described companies in regulated industries needing audit-ready WordPress hosting and organizations looking for documented responsibility boundaries to ease vendor security reviews. Kimi described organizations already comfortable with Liquid Web compliance infrastructure and small-to-mid-size regulated businesses where parent-company scoping is acceptable to auditors.

The common thread: Nexcess fits buyers who treat the vendor review as a negotiation with a specific evidence request, not as a checkbox satisfied by a public trust page.

Probably Not Best Suited For

Questions explored

• Who should not choose Nexcess for SOC 2 compliance hosting?
• Is Nexcess a poor fit for a buyer whose vendor review requires a current SOC 2 Type 2 report naming the exact WordPress service?

Nexcess is probably not the best fit for buyers whose vendor review strictly requires a current SOC 2 Type 2 report explicitly covering the contracted Managed WordPress service.

OpenAI listed as poor fits buyers whose vendor review strictly requires a current SOC 2 Type 2 report explicitly covering the contracted Managed WordPress service, organizations requiring publicly documented compliance-specific account management or contractual security commitments without negotiating them, and highly regulated workloads needing clearly defined data residency, customer-managed keys, granular administrative logging, or formal compliance addenda. Anthropic listed startups or small businesses without compliance requirements seeking low-cost hosting, organizations requiring FedRAMP, HITRUST, or industry-specific compliance beyond SOC 2, companies needing only basic shared WordPress hosting, and buyers prioritizing absolute lowest cost over compliance infrastructure. Deepseek listed large enterprises or custom application stacks where the attestation must cover a broader set of controls, and buyers expecting the hosting provider's SOC 2 to fully transfer compliance to their product. Grok listed buyers requiring current, independently verifiable SOC 2 Type II reports specifically for WordPress hosting. Kimi listed buyers requiring product-level SOC 2 attestation with Nexcess-branded reports, enterprises with strict subservice organization carve-out requirements, and organizations needing immediate auditor-ready documentation without NDA delays. Google listed budget-conscious buyers looking for cheap compliance hosting, since standard entry WordPress plans do not include full isolation or SOC 2 scope, and organizations seeking a provider that takes 100% of the compliance burden.

When Another Option May Be Better

Questions explored

• What is a better alternative to Nexcess for a buyer who needs a downloadable SOC 2 Type II report with named plan-level scope?
• When should a regulated buyer choose a hyperscaler instead of Nexcess for WordPress hosting?

Another option may be better when the buyer needs immediate, plan-level, third-party compliance evidence rather than a negotiated evidence request.

Deepseek and Kimi both pointed to Kinsta and WP Engine as alternatives with more polished compliance documentation processes. Deepseek described Kinsta at $35 per month with a 38-control Type II audit by BARR Advisory, and WP Engine at $20-25 per month with a SOC 2 Type II from Holtzman Partners, and noted Cloudways at $14 per month using DigitalOcean infrastructure with Type II as a cheaper option with a less polished trust center process. Kimi described Kinsta as offering product-level SOC 2 Type II with a named trust center and ISO 27001/27017/27018, and WP Engine as offering Type II Security and Availability from Holtzman Partners, and noted that AWS Artifact provides immediate auditor-ready documentation without sales or NDA delay.

For complex or large-scale applications with stringent custom control requirements, Deepseek recommended a hyperscaler such as AWS, Azure, or Google Cloud with enterprise support and dedicated compliance teams. Kimi recommended AWS, GCP, or Azure with enterprise contracts for a strict subservice organization carve-out with minimal CUEC burden, and AWS with enterprise support or a dedicated IaaS build for true enterprise-grade compliance account management and custom SLAs. OpenAI's alternative guidance was framed as criteria rather than named vendors: choose a provider with a current SOC 2 Type 2 report explicitly naming the relevant hosting service and legal entity, a public trust center with downloadable audit reports under NDA, a formal security questionnaire process, a defined subprocessor list, and contractual security or breach-notification commitments.

Grok noted that buyers requiring FedRAMP or other government-specific frameworks, ISO 27001 or HITRUST as the primary standard, or maximum global data center footprint may need alternatives, since Nexcess has 10 global data centers versus competitors with 37+ locations.

Questions to ask before choosing a provider

Questions explored

• What should a buyer confirm with Nexcess before signing a contract for SOC 2 compliance hosting?
• Which compliance artifacts should a regulated buyer request from Nexcess during vendor review?

Buyers should request specific artifacts and written commitments before signing. The following questions are drawn from platform-supplied verification lists and should be answered in writing.

Request the current SOC 2 Type 2 report, SOC 3 report, or equivalent attestation for the exact Managed WordPress, Managed Cloud, or dedicated WordPress service being purchased, and confirm the report date, audit firm name, report period, and exact services covered (ChatGPT, Claude, DeepSeek, Perplexity). Confirm which legal entity, facilities, systems, regions, subprocessors, and services are included in the report's scope, and whether Nexcess is explicitly named in scope within Liquid Web's SOC 2 Type II report or covered only as a subservice (ChatGPT, Claude, Kimi).

Ask whether the report can be provided under NDA, along with a bridge letter, management assertion, complementary user entity controls, and a shared-responsibility matrix (ChatGPT, Claude). Confirm whether customer-facing control activities such as WordPress administration, plugin updates, backups, support access, and staging are included in the attested boundary (ChatGPT, DeepSeek).

Ask what administrative, support, SSH, portal, and infrastructure logs are generated, how long they are retained, and whether the buyer can export them, including whether audit logs can be exported to SIEM (ChatGPT, DeepSeek, Kimi). Confirm whether MFA, least-privilege roles, approval workflows, IP restrictions, and segregation of duties are available for all users and support personnel, and whether RBAC, SSO, and SCIM are available for the Nexcess control panel versus the WordPress admin (ChatGPT, Kimi).

Ask where production data, backups, logs, and support artifacts will be stored, and whether U.S.-only or region-specific data residency can be contractually committed (ChatGPT, Claude). Confirm what encryption is used in transit and at rest, who controls the keys, and whether customer-managed keys are supported (ChatGPT).

Ask what security-questionnaire, audit, penetration-test, incident-notification, and compliance-account-management support is included in the proposed plan, and what the standard turnaround time is for completing vendor security questionnaires (ChatGPT, Claude, DeepSeek). Confirm whether a Business Associate Agreement is available for HIPAA workloads, at what plan tier, and at what additional cost (Claude, DeepSeek, Kimi, Gemini).

Ask for the exact monthly, annual, renewal, overage, dedicated-resource, support, migration, and compliance-assistance charges, plus the notice period, refund rules, auto-renewal terms, data-export process, and deletion timeline after cancellation (ChatGPT, Perplexity). Confirm whether the order includes a security addendum, data-processing agreement, breach-notification SLA, uptime SLA, and explicit responsibility allocation (ChatGPT, Claude).

The consensus assessment

Nexcess is a mixed fit for SOC 2 compliance hosting, not a clearly strong one. Three of seven platforms named it during ranking discovery, at an average listed rank of 7.0 and a best rank of 6, and platform fit ratings split four "good" (Claude, DeepSeek, Gemini, Perplexity) against three "mixed" (Grok, Kimi, ChatGPT).

The case for Nexcess rests on publicly claimed SOC 2 Type II-aligned infrastructure, SOC 3 Type 2-audited data centers, annual SOC 1 Type II and SOC 2 Type II assessments under SSAE-22, and a documented compliance-support layer including QSA assistance, vendor review support, automated evidence collection, compliance dashboards, and GRC advisory support ^[18]. Its managed WordPress platform also carries a reasonable operational security baseline ^[26].

The case against rests on unresolved scope and currency. Reviewed public materials do not verify a current SOC 2 Type 2 report explicitly covering the Managed WordPress service, historical audits from 2017 covered colocation, the auditor and report period are not publicly disclosed, and the corporate relationship between Nexcess and Liquid Web leaves the contracting entity and audit boundary unclear for a 2026 purchase ^[43]. Company-owned citations materially outnumber independent citations in this study, so the compliance claims should be treated as company-reported rather than independently verified.

Proceed only after Nexcess supplies service-specific compliance evidence and acceptable contractual terms. If the vendor review requires immediate, plan-level, third-party evidence with minimal back-and-forth, an alternative with a published trust center and named plan-level scope is likely a better fit.

How This Review Was Produced

This review was produced from a structured multi-platform research run dated 2026-10-03. Seven AI platforms evaluated fit for the same buyer scenario: a company in a regulated industry undergoing a vendor security review that requires proof of SOC 2 or equivalent compliance from its WordPress hosting provider. The platforms were Claude (claude-haiku-4-5-20251001), DeepSeek (deepseek-v4-flash), Gemini (gemini-3.5-flash), Grok (x-ai/grok-4.3), Kimi (moonshotai/kimi-k2.6), ChatGPT (gpt-5.6-luna), and Perplexity (perplexity/sonar).

Nexcess qualified for this study by clearing the minimum-mention threshold. Platform mentions count only platforms that named the entity during ranking discovery, not every platform that evaluated fit. All seven platforms evaluated fit, but only three named Nexcess during ranking discovery.

Citations in this review are platform-reported evidence, not independently verified facts. The supplied URLs were collected from platform responses and were not independently validated by the writer stage. Where a platform supplied no citation for a factual claim, that claim is labeled platform-reported or unverified rather than presented as independently established. Company-owned sources are distinguished from independent sources throughout.

Research limitations

Several limitations apply to this review.

Platform-reported dates are provenance metadata and do not independently prove freshness. The run research date of 2026-10-03 is the study date.

Conflicting product names, pricing, and capabilities were not resolved by guessing. Where platforms disagreed - on pricing, on which plan carries compliance coverage, and on whether a current SOC 2 Type 2 attestation exists - the conflict is described and buyers are directed to verify.

Company-owned citations materially outnumber independent citations in this study. Nexcess compliance claims should not be described as independently verified.

The deterministic identity audit contains qualification notes that are disclosed where relevant, including that official-site retrieval failed for one or more mentions and that company-name variants were collapsed onto one canonical brand before minimum-mentions qualification. The official-site excerpt for nexcess.com was retrieved but not verified.

One platform, DeepSeek, is recorded with search disabled in the research capabilities metadata, so its findings should be treated with additional caution.

No reviewed public evidence conclusively proves that the exact Managed WordPress service is covered by a current SOC 2 Type 2 report. SOC 3 evidence is less detailed than a SOC 2 report because it is intended for general distribution and may not provide the detailed control descriptions required by a vendor review. Public materials do not establish full audit-log scope, retention, exportability, SIEM integration, data residency guarantees, encryption-key ownership, or compliance-specific contractual commitments. Enterprise pricing and compliance-support terms are not publicly transparent.

See the broader Regulated Industries Needing SOC 2 Compliance consensus index for comparisons across qualified options.

Sources

Company-Owned Sources

1. How to cancel a specific Nexcess hosting service: https://docs.nexcess.com/sites-stores/hosting-services/sites-and-stores/cancel-services/
2. How to add a new web hosting plan to your Nexcess account: https://docs.nexcess.com/sites-stores/hosting-services/sites-and-stores/hosting-options/
3. Managed WordPress: https://docs.nexcess.com/sites-stores/managed-wordpress/
4. Does Vercel have a SOC 2 Type 2 attestation?: https://vercel.com/kb/guide/is-vercel-soc-2-compliant
5. Enterprise website hosting: https://www.liquidweb.com/enterprise-hosting/websites/
6. Nexcess: Cloud Without Compromise: https://www.nexcess.com/
7. How to choose enterprise web hosting for larger websites: https://www.nexcess.com/blog/enterprise-web-hosting/
8. Data centers: https://www.nexcess.com/data-centers/
9. Introducing Nexcess: https://www.nexcess.com/news/introducing-nexcess/
10. Enterprise Network & Security Infrastructure Stack: https://www.nexcess.com/platform/network-infrastructure/
11. Nexcess Platform: https://www.nexcess.com/platform/nexcess-platform/
12. Managed Secure Hosting for Regulated Industries: https://www.nexcess.com/platform/security-compliance-hosting/
13. Managed Shopware, WP, Woo, and Magento Hosting: https://www.nexcess.com/platform/sites-stores/
14. Enterprise WordPress Hosting | Nexcess: https://www.nexcess.com/solutions/enterprise-wordpress-hosting/
15. Managed Hosting for Agencies: https://www.nexcess.com/solutions/hosting-for-agencies/
16. Managed Cloud Hosting & Private Cloud Solutions: https://www.nexcess.com/solutions/managed-cloud/
17. Ecommerce Enterprise Solutions for WooCommerce | Nexcess: https://www.nexcess.com/woocommerce/enterprise-hosting/
18. Hosting compliance: https://www.nexcess.net/compliance/
19. PCI Compliant Hosting with Nexcess: https://www.nexcess.net/compliance/pci-hosting/
20. SSAE-18 compliance: https://www.nexcess.net/compliance/ssae-18/
21. Enterprise Server Cluster Support Documentation: https://www.nexcess.net/help/enterprise-server-cluster-support-documentation/
22. Nexcess Hosting and Nexcess Client Portal Guide: https://www.nexcess.net/help/nexcess-hosting-and-nexcess-client-portal-guide/
23. Single Secure Isolated Platform (SIP) server documentation and support: https://www.nexcess.net/help/single-secure-isolated-platform-sip-server-documentation-and-support/
24. What is PCI DSS compliance?: https://www.nexcess.net/help/what-is-pci-dss-compliance/
25. Magento Enterprise Hosting | Custom Magento Clusters: https://www.nexcess.net/magento/enterprise-hosting/
26. Fully Managed WordPress Hosting: https://www.nexcess.net/managed-wordpress-hosting/
27. Enterprise WordPress Hosting: https://www.nexcess.net/solutions/enterprise-wordpress-hosting/
28. Data Center Locations and Features: https://www.servers.com/data-center-locations/

Independent Sources

29. Nexcess Successfully Completes SOC 2 Type 1 Examination: https://hostingjournalist.com/news/nexcess-successfully-completes-soc-2-type-1-examination-colocation-services-southfield-data-center
30. Hosting With SOC 2 Compliance in 2026: What You Actually Inherit (and What You Still Have to Build: https://hostingpromax.com/hosting-with-soc-2-compliance-2026
31. Nexcess Pricing 2026: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEyoGJN4gBMOfZMdA3sjDTbZJjs1VK1IfzEH-ZvG8L5tsInPU45LBhWFTLEOBabRhIfqInUQ4Jot0ohdPAyockjP94NBhfvVE_F06pRwM6LMwHnp4fGRyeB0qHjnmgJ2ZM=
32. Enterprise Website Hosting - Liquid Web: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF8ws_2fms4XRGeRowCUJBDW9X4alL43jS6Gfu77dG2I9GrJEIuZy0-AIRdmb9iOIa0HUsarZ_ckvcOx6FTF3K67mEy_TsmOfTlU7aVtkE4AEHbnpodByWFQE8YxD69l-GO
33. Cloud Infrastructure Solutions for Financial Services - Nexcess: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFE8fnXxRM2Dijs567gJZaXnR53mKb3SaowxEhwZBtrMoO3i9rqyTnDdTFhvK6zLuupjVgdDb4CTGKDE4YXXjAAte7XNGXEmZzB5XN8kyssiqa6_5dzD7koqo9AMboipjQg0z9FB-ExFgiebX64MqclTvFg
34. Introducing Nexcess Managed Cloud built on Nutanix: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFEDcf07YH38OhU6GTzmh4chfKIQS4FCg2QGRF-fJ9m_fPGc1AHsEiSufFrOqm3ZsqZyCS3a35X0QX8l2YYaa2vXbmLDXKg-OfWJW0XFxc8l02vkKdKbSkp_P73wH6RxDJmJ4GAjBvfGNJ7loRSTRZm4Y8F6v0=
35. Fully Managed Dedicated Servers: 100% Uptime, Guaranteed | Nexcess: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG60jmNpUDQo_L9abQBPVtbFbZejqtLINdWAr8ldUQAb6bAYNsu8CucK8lsoOUvfEddhpiyVKQC6OTyGtLBvNmaBqTHJIXXEHEaLxBki9pZD69RPziY9C40X3r9uowNcBk=
36. Trusted Security and Certifications - Liquid Web: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGHLlX3wKeVYZsVZbD5qiChlaGb-AI0R0zvbyscsYHktw-GK_Vpz3pqUY5WZbvCh4-2KR_46CpufRWU2nKTQML0EBacZh2KrJ715-o8NBtG9aIv8AnmFBaJKY8-aAUCR0QbcdUMIvJ18q4nesU=
37. HIPAA & PCI-DSS Compliant Cloud Hosting - Nexcess: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGtKEgjg-V-ZDpuBuDd2Rv2S3iWgdDEvud2rG9pd25efA_y04Z7gmm60UBW7DyXUJkQE5OVs3ha-Wp_pFYiY3G9Vy5JQJ2YCvoHGtf9vm3tBq-4mf3Uz4bnZqTTm770Y3A0r0IS1GUK28GhdPJhzs2hkkAf
38. How Infrastructure Supports PCI DSS and SOC 2 Compliance in Financial Services: https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH3s__F-TkvkujXOwY5MqLFA4dGmA15On-ZytJeI8xX_UQP4axTC1bTW_7anLKX1cwGoHGDb4Cm2FD6wA5x-L1qmIwaCDRS1nuAB2KNaz6gyC_OfdSOeLFse1b9g3dI8sB9lp0GuI1FZxwe0Tsr4RSfDvfkxlfXJxZnqFw3NXuz
39. Best WordPress Hosting in 2026 (Tested & Compared: https://websitesetup.org/best-wordpress-hosting/
40. 9 Best Enterprise WordPress Hosting Providers Compared: https://www.bigscoots.com/blog/best-enterprise-wordpress-hosting/
41. Nexcess Review 2026: Managed WooCommerce & WordPress Hosting Deep Dive: https://www.hostproreviews.com/blog/nexcess-review-2026
42. Nexcess Introduces Dedicated Healthcare Hosting for Organizations Managing Sensitive Patient Data: https://www.morningstar.com/news/pr-newswire/20260422de40083/nexcess-introduces-dedicated-healthcare-hosting-for-organizations-managing-sensitive-patient-data
43. Nexcess Successfully Completes SOC 2 Type 1 Examination For Colocation Services: https://www.prweb.com/releases/2017/11/prweb14865324.htm
44. Nexcess Announces The Successful Completion Of Type 2 SSAE 16 SOC 1 Examination: https://www.prweb.com/releases/nexcess_announces_the_successful_completion_of_type_2_ssae_16_soc_1_examination/prweb13288758.htm
45. 11 Best Enterprise WordPress Hosting Solutions for Peak Performance: https://www.smartmoneymatch.com/en/11-Best-Enterprise-WordPress-Hosting-Solutions-for-Peak-Performance
46. Nexcess: Reliable Managed WordPress Hosting for Businesses: https://yassinebentaleb.com/en/nexcess-reliable-managed-wordpress-hosting-for-businesses/