Category: Web and apps
Managed WordPress and WooCommerce: fast, up to date and with tested backups
Your website or your shop on a server you pay for, fast at peak times, with updates tested before touching production and a backup we know comes back because we restore it.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- Open source: WordPress, GPLv2 or later; WooCommerce, GPLv3
In short
WordPress is the most widely used open source content management system, and WooCommerce is its online shop extension. We set them up in your account with tuned PHP-FPM, persistent object caching with Redis or Valkey, page caching and a CDN if it helps. We keep a staging environment where we test every core, plugin and theme update before production, and take off-server backups that we restore in tests.
What do we take care of?
Installing WordPress takes five minutes; keeping it fast and secure for years is something else. Every plugin adds code that is updated at its own pace, the database grows with every order and a single badly tested update is enough to leave the shop without a checkout button. This is what we keep under control:
WordPress and WooCommerce
Core, plugins and theme up to date, with the server configuration described as code.
Performance
PHP-FPM, OPcache, object caching with Redis or Valkey and page caching tuned to your traffic.
Staging
A copy of production where updates and your agency’s changes are tested before publishing.
Database
MariaDB or MySQL with slow queries reviewed and options and session tables kept in check.
Security
Restricted admin access, two-factor authentication, correct file permissions and vulnerable plugins detected.
Monitoring
Response time, PHP errors, checkout, disk and certificates, with alerts.
How do we make it fast?
Most of WordPress’s slowness is not in the server but in the work PHP does on every visit. We tackle it in layers:
Page caching
Anonymous visitors get a page that has already been generated. In WooCommerce we exclude the basket, checkout and account, which are always live.
Object caching
Redis or Valkey keep the results of repeated queries between requests, which is most noticeable in the admin and in the shop when logged in.
PHP-FPM and OPcache
Number of processes based on available memory, OPcache with enough room and the newest PHP version your plugins support.
Optional CDN
Images, stylesheets and scripts served from close to the visitor when your audience is spread out.
If you also want Redis or Valkey for other applications, with replication and persistence, it is covered in managed Redis and Valkey. When the database gets heavy, it is handled as in managed MySQL and MariaDB.
What problems do we come across most often?
- Abandoned plugins: still active years after their last release, with known vulnerabilities.
- Blind updates: everything is updated from the admin panel in production and checkout stops working.
- WP-Cron depending on visits: tasks are delayed at night and pile up at peak times.
- Bloated options table: data loaded on every request that nobody cleans up.
- A hosting backup that was never tested: only the files, or only the database, or on the same server.
- Admin panel wide open: the login page gets access attempts around the clock.
How do we test an update before production?
Staging is a copy of production on the same type of server, with outgoing email disabled and payments in test mode, so that nothing goes out to real customers. Before each batch of updates we refresh staging from production, update core, plugins and theme there, and go through the important pages. For a shop, we also add a product to the basket and complete an order with the payment gateway in test mode. Only then do we update production, with a backup taken just before. Releases with urgent security patches are brought forward, but they go through the same path.
How do we handle backups and restores?
The backup includes the database and the content folder, where the uploads, plugins and theme live. It goes encrypted to object storage off the server, with several days of retention. We regularly restore a backup onto a test server and check that the website loads, that we can log in to the admin and, for a shop, that recent orders are there. With WooCommerce there is a catch: restoring last night’s backup means losing today’s orders, so when there is a problem we prefer to recover only what is missing and keep a full restore as a last resort.
How do we protect WordPress?
Admin access is restricted by IP or put behind a login with two-factor authentication, and file editing from the admin panel is disabled. The system user that runs PHP cannot modify the WordPress code, only the uploads folder, and PHP does not run in that folder. Every week we check the installed plugins against known vulnerability databases; that ongoing follow-up fits with vulnerability management. If you want someone to answer for the website and the server every month, that is covered by SRE as a service.
- CDNOptional, static files
- NginxHTTPS and page caching
- PHP-FPMWordPress and WooCommerce
- RedisObject caching
- MariaDBOff-site backups
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | Cloud or dedicated server with Nginx, PHP-FPM, MariaDB and Redis or Valkey, and backups in Hetzner Object Storage, which is S3-compatible. | A good balance between CPU and cost for shops with traffic peaks. |
| AWS | EC2 with PHP-FPM and Nginx, the database on RDS for MariaDB or MySQL if it fits, and backups and media in S3. | We keep an eye on outbound transfer; with lots of images, a CDN usually works out cheaper. |
| Google Cloud | Compute Engine with the full stack or with Cloud SQL for MySQL, and backups in Cloud Storage. | |
| DigitalOcean | Droplets with the full stack, or with DigitalOcean managed MySQL, and backups in Spaces. | |
| OVH | Public Cloud instances or dedicated servers, with backups in OVHcloud Object Storage. | |
| Own server | The stack on your server or on a virtual machine, published through a proxy or a tunnel. | Backups always leave the building. |
What is included
- Server with Nginx, PHP-FPM and MariaDB or MySQL sized for your traffic, in your account and in your name.
- Persistent object caching with Redis or Valkey, and page caching for anonymous traffic.
- Optional CDN in front for static files and images, with rules that do not cache the basket or the customer account.
- Staging environment with a recent copy of production for testing changes.
- Core, plugin and theme updates tested first on staging and applied in an announced window.
- WordPress scheduled tasks run by the system cron, not by visits.
- Daily backups of the database and files off the server, with regular test restores.
- Monitoring of response time, checkout, PHP errors, disk and certificates, with alerts.
Frequently asked questions
Do you switch on automatic plugin updates?
Not for everything. Minor core security releases are applied automatically. Plugins and the theme go through staging first: we update there, go through the key pages and, for a shop, place a test order. If everything works, we apply it to production in an announced window; if a plugin breaks something, it stays on the previous version until there is a fix or an alternative.
Can you help us if our WordPress is slow?
Yes. We start by measuring: which pages are slow, which database queries repeat and which plugins add the most work to each visit. The improvement often comes from object caching, tuning PHP-FPM and cleaning up bloated options tables, rather than from changing servers. If a plugin is the problem, we will show you the data.
Do you handle the website design or content?
No. We look after the server, performance, updates, security and backups. Design, copy and layout are still up to you or your agency; we work with them and give them access to staging so they can test their changes before publishing.
What about licences for paid plugins and themes?
They stay in your name. WordPress and WooCommerce are free software, but many premium plugins and themes sell the licence and updates separately. You keep the keys; we use them to keep those components up to date and let you know if a licence expires and leaves a plugin without patches.
Can we migrate our website from shared hosting?
Yes. We copy the website to your new server, test it on a temporary domain and we change the DNS when it responds the same. For a shop we choose a low-traffic moment and freeze orders during the switch, so that none is lost between the two servers.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
- WordPress Developer Resources: Advanced Administration Handbook
- WordPress Plugin Handbook: Hooking WP-Cron into the system task scheduler
Reviewed on