A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national law (BDSG).
At the same time, while many aspects of GDPR are still considered unclear or disputed, there seems to be pretty much a consensus in Germany that any website owner1 whose site is hosted on the server of a 3rd party will have to sign a contract for processing on behalf with the webhoster.2 This appears the case even if the webhoster merely handles visitors' IP addresses such as for security logging purposes.
While I concede companies and people as a whole used to be sloppy about former privacy laws and very late at starting to prepare for GDPR, the requirement for those specific contracts with webhosters are generally implied to be something new. Webhosting companies have started to offer the respective contract templates only recently as a part of their GDPR preparation, and articles point out these contracts as something to take care of to make one's site GDPR-ready, especially including non-commercial fan sites, blogs, and similar.
Was there3 a requirement to have such a contract with one's webhoster for non-commercial/hobbyist websites before GDPR? (If so, was it simply widely ignored, especially on sites hosted abroad, where hosters wouldn't know about (and be unwilling to sign?) such contracts?
EDIT: The only thorough essay on the topic I have found so far is a blogpost on CR-online (in German). It specifically addresses the situation of non-commerical and/or small services (coming to the conclusion that from the point of view of these services, the claim that "not much has changed" is a "myth") and points out that the obligations for internal documentation have been considerably extended. However, it does not concretely discuss any particular setups such as "running a website".
1: Except for websites maintained as a part of a "purely personal or household activity", but it seems disputed whether any publicly accessible website can meet these criteria at all.
3: Either from BDSG itselt, or based upon some EU-wide regulation.