Not every provider charges for all of these. Almost every provider charges for some. Knowing the list is enough to ask the right question before you sign up.
At Sign Up
Setup fees. Rarer than they were, still present on some plans and usually waived on longer terms, which is itself an incentive toward the long term.
Domain privacy. Hiding your personal details in the public WHOIS record. Frequently billed annually, occasionally as much as the domain.
While You Are There
SSL. Should be free and automatic. Still sold as an add-on in places.
Backups. Sometimes included but retained for only a couple of days, with anything longer chargeable. Sometimes free to take and chargeable to restore, which is the one worth watching for. The fee lands at the exact moment you have no leverage.
Email. Bundled mailboxes with tight limits, then a per mailbox charge beyond that.
Dedicated IP, staging, malware removal, migration assistance. All reasonable things to charge for. All worth knowing about beforehand rather than discovering mid-problem.
On The Way Out
Domain transfer fees. Charging you to move a domain you own to another registrar.
Refund handling. Deductions applied against a money back guarantee, often the value of a free domain that came with the plan, sometimes an administration fee.
The Question That Covers All Of It
Ask: what will I pay in year two, including everything I need to actually run the site?
Not the plan price. The total. If the answer requires a conversation, you have learned something useful about how the business is structured.
For what it is worth, we charge for the plan and for extra mailboxes or domains beyond your allowance. SSL, backups, restores, migrations and leaving are not billable events here. We would rather price the product than the exits.