I measured 20 hosting providers in Germany. I did not copy them and I did not take them off a brochure: I measured them with our own tool on July 31, 2026. One result surprised even me.
Of 20 providers sold as German hosting, 5 do not keep their own website in Germany. RAIDBOXES (Toronto, CA), Cloud86 (Istanbul, TR), Contabo (Toronto, CA), netcup (Amsterdam, NL), domainFACTORY (Menifee, US).
Read that again. If you are thinking about server location in terms of the GDPR, this is not a small detail.
The full table is below. Before that I will say exactly what I measured, because any hosting table that does not say so is worthless.
How I measured
I measured the provider’s own website, not a customer package. That is a difference, and I would rather say it myself before somebody else does.
It does not mean this: “Your site will open in 307 ms on Hetzner.” That is not how it works. Your package, your theme, your images and your database belong to you, not to the host.
It means this: a company that in 2026 still serves its own site over HTTP/1.1, with no HSTS and not a single security header, is telling you something about its craft. And where its server sits is telling you something about your data.
Measured with our own tool on July 31, 2026. There is a screenshot for every value below. Market share source: hosttest.de via hostadvice/builtwith, April 2026.
The table
| Provider | TTFB | HTTP | Headers | Location |
|---|---|---|---|---|
| lima-city | 266 ms | h2 | C | Bremen, DE |
| Hetzner | 307 ms | h3 | D | Nuremberg, DE |
| manitu | 333 ms | h2 | B | Sankt Wendel, DE |
| STRATO | 381 ms | 1.1 | D | Berlin, DE |
| goneo | 465 ms | h2 | D | Minden, DE |
| RAIDBOXES | 472 ms | h3 | D | Toronto, CA |
| Uberspace | 502 ms | h2 | C | Bad Oeynhausen, DE |
| Mittwald | 525 ms | h2 | B | Frankfurt am Main, DE |
| hosting.de | 554 ms | h2 | F | Aachen, DE |
| dogado | 559 ms | h2 | D | Dortmund, DE |
| IONOS | 560 ms | h2 | C | Karlsruhe, DE |
| InterNetX | 603 ms | 1.1 | D | Karlsruhe, DE |
| All-Inkl | 617 ms | h2 | B | Neusalza-Spremberg, DE |
| Host Europe | 926 ms | h2 | F | Cologne, DE |
| Cloud86 | 1071 ms | h2 | F | Istanbul, TR |
| Contabo | 1098 ms | h3 | F | Toronto, CA |
| netcup | 1214 ms | h3 | A | Amsterdam, NL |
| Alfahosting | 1274 ms | 1.1 | D | Halle, DE |
| webgo | 1325 ms | h2 | F | Hamburg, DE |
| domainFACTORY | 1512 ms | h3 | C | Menifee, US |
What caught my eye
The spread is enormous. lima-city answers in 266 ms, domainFACTORY takes 1512 ms. More than five times over. Both of them are selling you hosting.
Three providers are still serving over HTTP/1.1 in 2026: STRATO, InterNetX, Alfahosting. One of them is second in the market. That is not a typo.
Only 5 have HTTP/3 switched on: Hetzner, RAIDBOXES, Contabo, netcup, domainFACTORY. That is the standard that makes the difference on a weak mobile connection.
5 providers score a flat zero on security headers: hosting.de, Host Europe, Cloud86, Contabo, webgo. No CSP, no X-Frame-Options, nothing.
Then there is the location question. Look at the last column. Notice anything?
Two providers run on somebody else’s infrastructure: InterNetX on the IONOS network (AS8560), Alfahosting on the dogado network (AS45012). That is written on no pricing page. It is written in the data.
Twenty providers, one by one
Now in order, by response time. Under each provider is the screenshot of our own measurement. Not an advertisement, a measured value.
lima-city · 266 ms
The server sits in Bremen, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 64% compressed. HSTS is not set up. Security header grade C (57%).
Hetzner · 307 ms
The server sits in Nuremberg, which is to say in Germany. HTTP/3 is on. The page is 88% compressed. HSTS is set up. Security header grade D (38%). Market share 13%.
manitu · 333 ms
The server sits in Sankt Wendel, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 79% compressed. HSTS is set up. Security header grade B (76%).
STRATO · 381 ms
The server sits in Berlin, which is to say in Germany. It is still served over HTTP/1.1. The page is 80% compressed. HSTS is set up. Security header grade D (38%). Market share 16%.
goneo · 465 ms
The server sits in Minden, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 80% compressed. HSTS is not set up. Security header grade D (38%).
RAIDBOXES · 472 ms
Careful: the server is in Toronto, CA, not in Germany. HTTP/3 is on. The page is 82% compressed. There is Cloudflare in front of it. HSTS is set up. Security header grade D (29%).
Uberspace · 502 ms
The server sits in Bad Oeynhausen, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 66% compressed. HSTS is not set up. Security header grade C (57%).
Mittwald · 525 ms
The server sits in Frankfurt am Main, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 82% compressed. HSTS is set up. Security header grade B (67%).
hosting.de · 554 ms
The server sits in Aachen, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 78% compressed. HSTS is not set up. It scores zero on security headers.
dogado · 559 ms
The server sits in Dortmund, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 85% compressed. HSTS is set up. Security header grade D (38%).
IONOS · 560 ms
The server sits in Karlsruhe, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 90% compressed. HSTS is set up. Security header grade C (48%). Market share 28%.
InterNetX · 603 ms
The server sits in Karlsruhe, which is to say in Germany. It is still served over HTTP/1.1. The page is 80% compressed. HSTS is set up. Security header grade D (29%). Market share 5%.
All-Inkl · 617 ms
The server sits in Neusalza-Spremberg, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 80% compressed. HSTS is set up. Security header grade B (76%). Market share 3%.
Host Europe · 926 ms
The server sits in Cologne, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 81% compressed. There is Akamai in front of it. HSTS is not set up. It scores zero on security headers. Market share 7%.
Cloud86 · 1071 ms
Careful: the server is in Istanbul, TR, not in Germany. HTTP/2 is on, HTTP/3 is not. The page is 83% compressed. HSTS is not set up. It scores zero on security headers.
Contabo · 1098 ms
Careful: the server is in Toronto, CA, not in Germany. HTTP/3 is on. The page is 91% compressed. There is Cloudflare in front of it. HSTS is set up. It scores zero on security headers.
netcup · 1214 ms
Careful: the server is in Amsterdam, NL, not in Germany. HTTP/3 is on. The page is 92% compressed. HSTS is set up. Security header grade A (86%).
Alfahosting · 1274 ms
The server sits in Halle, which is to say in Germany. It is still served over HTTP/1.1. The page is 81% compressed. HSTS is set up. Security header grade D (38%).
webgo · 1325 ms
The server sits in Hamburg, which is to say in Germany. HTTP/2 is on, HTTP/3 is not. The page is 85% compressed. HSTS is not set up. It scores zero on security headers.
domainFACTORY · 1512 ms
Careful: the server is in Menifee, US, not in Germany. HTTP/3 is on. The page is 77% compressed. There is Sucuri in front of it. HSTS is set up. Security header grade C (57%).
What you do with this
Do not take this table as a ranking list. Take it as a list of the questions to ask when you call a provider.
Ask them: where exactly does my server sit? Do you serve HTTP/3? Is HSTS on in my package? Who actually runs your network? A good provider answers that in one sentence. A bad one changes the subject.
We will measure again. These figures are from July 31, 2026, and a provider could switch HTTP/3 on tomorrow. When we measure again, the date here gets updated.
