2026年11月14日
This article is a localized edition of the Japanese original. Read the Japanese original
IaaS, PaaS and SaaS are names that divide cloud services by how much the provider supplies and where the customer's management begins. They come from "The NIST Definition of Cloud Computing" (SP 800-145), published in 2011 by the U.S. National Institute of Standards and Technology (NIST), which splits cloud computing into three service models.
This article sorts out the differences between the three by management scope and explains how to apply them when choosing where to run WordPress.
Definitions of the three service models
Summarizing the NIST definitions:
| Model | What the customer is given | What the customer manages |
|---|---|---|
| IaaS (Infrastructure as a Service) | Computing resources such as CPU, storage and networks | Operating system, middleware, applications and data (plus some network settings) |
| PaaS (Platform as a Service) | An environment for running applications built with the languages, libraries and tools the provider supports | The customer's own applications, their settings, and data |
| SaaS (Software as a Service) | The provider's application itself | Limited per-user settings and data |
The lower layers are managed by the provider and the upper layers by the customer. Laid out layer by layer, the differences become clearer.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Data, accounts, permissions | Customer | Customer | Customer |
| Application | Customer | Customer | Provider |
| Runtime (languages, middleware) | Customer | Provider | Provider |
| OS | Customer | Provider | Provider |
| Virtualization, physical servers, network | Provider | Provider | Provider |
In every model, your data and who gets which permissions remain the customer's responsibility. Major clouds such as AWS describe this division of duties as the "shared responsibility model."
Examples of typical services
| Model | Examples |
|---|---|
| IaaS | Amazon EC2, Google Compute Engine, Azure Virtual Machines |
| PaaS | AWS Elastic Beanstalk, Google App Engine, Azure App Service, Heroku |
| SaaS | Google Workspace, Microsoft 365, Salesforce |
The same provider offers services in different models. There are also managed services such as Amazon RDS, where the provider runs only the database, so in practice the boundaries do not split neatly into three.
Pros and cons of each
IaaS
- Pros: You can freely choose the OS and software and configure them in detail. You can change the number and size of virtual machines as needed.
- Cons: You handle OS security updates, web server and database configuration, backups and monitoring yourself. Without someone to run it, a neglected server becomes an entry point for attacks.
PaaS
- Pros: The provider updates the OS and runtime, so you can concentrate on developing and running your application.
- Cons: You are limited to the languages, versions and extensions the provider supports. If you build around the service's own mechanisms, moving to another provider takes effort.
SaaS
- Pros: You can use it as soon as you sign up. No server management is needed.
- Cons: What you can do is limited to the service's features. You need to check in advance how to export your data and what happens if the service shuts down.
Applying this to where you run WordPress
Here is how the places commonly compared for hosting WordPress map onto these models by management scope. The point is to look at who manages what, not at the name of the service.
| Where WordPress runs | Closest model | What you mainly manage |
|---|---|---|
| VPS or a cloud virtual machine | IaaS | OS updates, web server/PHP/database configuration, WordPress core, themes and plugins, backups |
| Shared hosting | Close to PaaS | WordPress core, themes and plugins, and various settings (the provider handles the OS and web server) |
| Managed WordPress hosting | Close to PaaS | Themes, plugins and content (many providers handle core updates and backups) |
| Building a site as a service (WordPress.com and the like) | Close to SaaS | Content, plus settings within what your plan allows |
Shared hosting is not usually called PaaS, but because the customer does not manage the OS, the division of duties is close to PaaS. How much the provider takes care of differs by service, so check the provider's official documentation before signing up.
The difference between shared hosting and a VPS is covered in detail in shared hosting vs. VPS, and cloud options in comparing cloud servers.
What to check when choosing
- Do you need to configure the OS and middleware yourself?: If you want to install specific software or choose PHP extensions in detail, go with IaaS. Otherwise PaaS or shared hosting is enough.
- Who will run it?: If no one can keep up with security updates, incident response and checking backups, choosing a model with a narrower management scope is safer.
- Load fluctuations: For uses where traffic can spike suddenly, check whether there is a way to add servers automatically (IaaS auto scaling or PaaS automatic scaling).
- Taking your data out: With SaaS and PaaS, check how to export data and what happens when you cancel or the service ends.
- Support and contract scope: Uptime guarantees (SLA), whether backups are included and how long they are kept, and what support covers all differ by provider.
Common misconceptions
- "Putting it in the cloud makes it secure" is not true: In every model, password and permission management and data handling are the customer's responsibility. With IaaS, OS updates are also the customer's job.
- "SaaS needs no configuration" is not true: The customer configures user account permissions, sharing scope, two-factor authentication and so on.
- Do not compare on price alone: IaaS may look cheap at list price, but once you include the staff time needed to run it, it can end up costing more.
Related articles
Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)