SECURE PHP HOSTING
Keeping PHP?
Let the architecture protect it.
You need WordPress features that static HTML can't provide, you run a PHP business system, or your site simply can't go static. Even then, rethinking the server architecture can limit the damage when a vulnerability is found.
Instead of putting everything on one server, we separate the front door, the public server, the database, and admin functions — and protect each one.
If your site can go static, see also WordPress to Static HTML.
PRINCIPLES
Move the front door forward
A CDN / WAF sits in front of the server and stops hostile or excessive traffic before it arrives. The server itself can't be reached directly by any other route.
Keep admin areas private
The WordPress dashboard and other admin functions are available only behind a VPN or access restrictions. From the internet, the admin area shouldn't even appear to exist.
Close the maintenance entrance
SSH and other maintenance access aren't exposed to the internet. Maintenance is done only by a limited set of people, over limited routes.
Separate data, minimize privileges
The database is separated from the public server, with who can connect and what they can do kept to a minimum. Where personal data is involved, storage and data paths are designed with particular care.
Encrypted backups and audit trails
Backups are stored encrypted, so even a compromised server can't expose their contents. Access logs are collected elsewhere and kept in a form that supports later investigation.
Rebuildable by design
The whole server configuration is managed as code, so the same environment can be reproduced at any time — for OS upgrades or after an incident, without relying on manual steps.
TWO ARCHITECTURES
Cloudflare + VPS
Our standard proposal
Cloudflare sits at the front, handling WAF, DDoS protection, and caching at the edge. The VPS accepts traffic only via Cloudflare, and admin and maintenance access are invisible from outside.
It protects both in front of and inside the server while keeping fixed costs down.
GOOD FIT FOR
- Small to mid-sized sites and systems
- Keeping monthly fixed costs low
- Sites with heavy overseas or hostile traffic
- Cloudflare
- VPS
- WAF
- VPN
AWS
When requirements call for it
Servers sit in a private network behind a load balancer, with a managed database service. Redundancy across multiple data centers and tamper-proof log storage are both available.
Servers can also be shut down during idle periods to save cost.
GOOD FIT FOR
- Systems with large seasonal swings in traffic
- Where redundancy or audit readiness is required
- Where internal policy specifies AWS
- AWS
- WAF
- Managed DB
- IaC
WHAT ARCHITECTURE CAN'T FIX
Architecture mainly limits damage from external attacks and software vulnerabilities. Flaws in the application itself — a missing permission check, for example — can't be fixed by infrastructure alone.
Where needed, we'll also propose a code review and fixes to the application.
PROCESS
- 01
Assessment
We review your current servers, applications, the data you handle, and how the system is operated.
- 02
Proposal
We propose a setup that fits your requirements and budget — including a combination with static publishing, where parts of the site allow it.
- 03
Rehearsal
We build the same setup in a test environment and verify procedures and settings. The configuration is kept as code.
- 04
Build and switchover
Following the rehearsed procedure, we build production and migrate your data and applications.
- 05
Maintenance
Ongoing OS and middleware updates, monitoring, and incident response.
PRICING
Costs vary widely with the architecture, scale, and scope of maintenance, so pricing is quoted case by case. We'll provide an estimate once we understand your situation.
CONTACT
“Can you check whether our current setup is OK?” is a fine place to start.