China Website Hosting and ICP Filing: Technical Setup for Performance and Compliance

If you want to host a website on servers in mainland China, you first have to register it with the authorities. This registration is called ICP filing, and for any B2B company selling into the Chinese market, it is a basic requirement rather than an optional step. Hosting your website in mainland China gives Chinese users fast and reliable access to your site. However, by law, any public website hosted on mainland servers must complete ICP filing before it can go live.

What is ICP Filing and Who Needs It?

ICP (Internet Content Provider) filing, also known as beian (备案), is a registration process required by China’s Ministry of Industry and Information Technology (MIIT) for any website hosted on servers in mainland China. The filing requirement is determined by the location of the server, not by your company’s location or your target audience. If your website is hosted on servers in mainland China and is publicly accessible, you must complete ICP filing before it can go live. If your website is hosted outside mainland China, you do not need an ICP filing, nor can you apply for a Public Security Network Filing. However, once your website is hosted in mainland China and completes its ICP filing, you are required by law to complete the Public Security Network Filing within 30 days of going live. There is one exception. If your website uses a China-based CDN or a domain that resolves to a mainland Chinese IP address, you will still need an ICP filing.

The Two Types of ICP Registration

There are two distinct types of ICP registration. First, ICP Filing is required for non-commercial websites and is mandatory for all websites hosted in mainland China. It is a basic registration that identifies the website owner and the nature of the content. Second, the ICP License is for commercial websites that offer paid services, e-commerce, or online transactions.

Before you begin the filing process, you need to meet three basic requirements.

1. An Eligible Domain. Your domain must pass real-name authentication at least three calendar days before you submit your application. The registrant’s name and ID number must exactly match the information provided in the filing. Domains with sensitive prefixes such as “China”, “National”, or “Public Security” may be blacklisted and rejected. In addition, the domain must be registered through an MIIT-approved registrar. Common extensions such as .com, .cn, and .net are generally accepted.
2. A Server in Mainland China. You must purchase a server located in mainland China with a subscription of at least three months from an approved provider such as Alibaba Cloud, Tencent Cloud, or Huawei Cloud.
3. Your Filing Documents. For companies, the required documents usually include a colour copy of the business licence, the legal representative’s ID, the website manager’s ID, the domain certificate, and the filing verification form bearing your official company seal. All documents must be clear, complete, and unedited.

Once everything is ready, the process typically follows these steps.

1. Submit Through Your Provider. You submit your application through your cloud provider’s ICP filing system. Alibaba Cloud, Tencent Cloud, and Huawei Cloud all provide their own filing platforms.
2. Provider Review (1 to 2 Business Days). Your cloud provider reviews the application first. If any information is incorrect or missing, a specialist will contact you to explain what needs to be corrected. Once everything is in order, the provider approves the application and forwards it to MIIT.
3. SMS Verification. MIIT will send a six-digit verification code via SMS. You must enter the code on the MIIT website together with your phone number and the last six digits of your ID.
4. MIIT Final Review. MIIT carries out the final review of your application. Processing times vary considerably by province, as each province has its own review procedures and requirements.

From start to finish, the entire process usually takes 10 to 20 business days. However, you should always keep in mind that each province has its own specific requirements, which may affect the overall timeline.

What Happens After Filing Is Approved

Once your ICP filing is approved, you must display the filing number in the centre of your website footer with a hyperlink to the MIIT website. Similarly, after completing your Public Security Network Filing, you must also add the public security badge and filing number to your footer. Make sure the content on your website matches the information provided during the filing process. Any significant changes to the website’s content may require you to update your ICP filing. If you change your hosting provider, you must submit an “access addition” request through the new provider. If your website is discontinued, you must cancel your ICP filing, as failing to do so may result in legal risks.

Mainland China vs. Hong Kong vs. Overseas Hosting

Where you host your website has a significant impact on both performance and compliance. Here’s how the three main hosting options compare.

Mainland China Hosting (with ICP Filing): This is the best choice if most of your audience is in mainland China. Local servers provide fast performance, and bandwidth is both affordable and widely available. Baidu does not rank websites higher simply because they are hosted in mainland China. However, faster loading speeds and a better user experience for local visitors can indirectly improve your SEO performance. Websites with an ICP filing also benefit from small advantages, such as Baidu’s two-month new-site protection. The main drawback is the ICP filing process itself. It typically takes 10 to 20 business days, and ongoing compliance requirements must be maintained after approval.

Hong Kong Hosting (No ICP Filing Required): Hosting in Hong Kong does not require ICP filing, making it an attractive option if you want to launch your website quickly. With CN2 or CN2 GIA-optimised lines, many users cannot even tell the difference between hosting in Hong Kong and hosting in southern mainland China. The main disadvantages are cost and content restrictions. Bandwidth is significantly more expensive than in mainland China, and although Hong Kong hosting follows Hong Kong law rather than mainland ICP regulations, access to your website can still be restricted if its content violates mainland Chinese regulations.

Overseas Hosting (No ICP Filing, Poor Performance): Hosting your website outside China does not require ICP filing, but performance for users in mainland China is generally poor. A standard US-based server typically has a latency of around 180 to 250 milliseconds. If your primary audience is in mainland China, hosting your main website overseas is generally not recommended. Ultimately, your hosting location affects two key factors: how quickly users in China can access your website and how much regulatory compliance you will need to manage.

Choosing the Right Cloud Provider in China

Alibaba Cloud, Tencent Cloud, and Huawei Cloud are the three largest cloud providers in China. All three are MIIT-approved and provide integrated ICP filing services, 24/7 Chinese-language support, and BGP multi-line networking, which automatically routes traffic through the best available carrier (China Telecom, China Unicom, or China Mobile) to ensure fast and reliable access across the country. If your requirements are more complex, there are additional factors to consider, including data sovereignty requirements, integration with other Chinese software and platforms, and value-added services such as Web Application Firewalls (WAF), DDoS protection, and CDN services. Hosting is only one part of the equation. How your website is designed and developed is equally important for both performance and compliance, so these two aspects are best planned together. You can learn more about our approach through our website design and development services in China.

CDN and Global Acceleration

Even if your website is hosted in mainland China, a Content Delivery Network (CDN) remains important for delivering fast performance to users across the country. Major Chinese cloud providers all offer CDN services with nodes distributed throughout mainland China. If your CDN acceleration region includes mainland China, make sure your ICP filing also covers the CDN domain. Some international CDN providers offer mirroring solutions that bypass the need for ICP filing. However, these solutions generally cannot match the performance or compliance benefits of a properly filed CDN. For B2B companies serving both Chinese and international audiences, the most common approach is to host the main website in mainland China for domestic visitors while using a separate global domain or a CDN with worldwide nodes to serve users outside China.

Cybersecurity Law and 等保 2.0

Beyond ICP filing, B2B companies hosting websites in China must also comply with a broader legal framework built around the Cybersecurity Law and the Classified Protection of Cybersecurity, officially known as the Multi-Level Protection Scheme (MLPS) 2.0, or 等保 2.0 in Chinese.

Complying with these regulations is an essential part of keeping your website legally compliant in China. The Cybersecurity Law of the People’s Republic of China establishes the baseline cybersecurity obligations for all network operators.

Article 21 outlines the security measures that operators are required to implement:

• Establish internal security management systems and procedures.
• Appoint personnel responsible for cybersecurity.
• Implement technical measures to protect against viruses, cyberattacks, and network intrusions.
• Monitor and log network activity and security incidents.
• Retain security logs for at least six months.
• Classify, back up, and encrypt data.

Article 22 applies to network products and services. These must comply with mandatory national standards, contain no malicious programs, address vulnerabilities promptly, and include ongoing security maintenance and support.

Article 24 requires operators to verify users’ real identities before providing services such as internet access or content publishing.

MLPS 2.0 is China’s framework for classifying and protecting information systems based on their importance and the potential impact of a security breach. It defines five levels of protection:

• Level 1 (Autonomous Protection): General systems where a security breach would affect individuals or organisations but not national security.
• Level 2 (Audit Protection): Systems of general importance where a breach would cause limited harm to social order but not national security.
• Level 3 (Security Label Protection): Critical systems in sectors such as finance, energy, and transportation, where a breach could directly affect national security or social order.
• Level 4 (Structured Protection): Highly important systems related to national welfare and essential public services.
• Level 5 (Access Verification Protection): The highest level, covering core national infrastructure and its most critical subsystems.

For most B2B corporate websites operating outside regulated industries, Level 2 is generally sufficient. However, if your website processes the personal data of Chinese citizens or operates in sectors such as finance, healthcare, education, or logistics, a higher protection level may be required.

Data Privacy and Cross-Border Data Transfer

China’s Personal Information Protection Law (PIPL) establishes strict rules governing how personal data is collected, processed, and transferred. It is a key component of regulatory compliance for any website operating in China.

If you run a website in China, there are several key requirements you need to meet:

• Consent: Obtain clear and informed consent before collecting personal data, and request separate consent for each specific purpose.
• A clear privacy policy: Make your privacy policy easy to find, and clearly explain how personal data is collected, stored, used, and shared.
• The “minimum necessary” principle: Only collect personal data that is directly relevant and necessary for the service you provide.

Cross-border data transfers require additional attention. If your global headquarters accesses or stores the personal data of Chinese users outside mainland China, you must complete a Personal Information Protection Impact Assessment (PIPIA) before any personal data can be transferred abroad. It is worth noting that under the updated cross-border data transfer regulations, standard non-sensitive B2B contact information and marketing leads under specific thresholds may qualify for exemptions from complex CAC security assessments or standard contracts. The penalties for non-compliance are significant. Violations of PIPL may result in fines of up to 50 million yuan or 5% of annual revenue, as well as the possible suspension of business operations.

Summary and Key Takeaways

Hosting and ICP filing are fundamental to running a website in China. They affect how quickly your website loads for users, how easily it can be discovered, and whether it complies with local regulations. However, hosting alone is not enough. If your website is not properly localized or optimized for SEO, you will not get the full benefit. Our team can help you optimize both areas to maximize your website’s performance in China.

Need help with any of this? Contact Flow Asia. We can manage your ICP filing, set up hosting in mainland China, localize and optimize your website for SEO, and keep it compliant as your business grows.