I’ve been managing several servers that host media websites. Talking about local and global news with a decent amount of traffic. And ever since I had my first screw-up with cPanel I’ve decided to do my server management. Currently, I’m using WordOps for configuring the servers with Nginx, PHP, etc.
However, no matter what combination I’ve tried, the ever-increasing number of visitors will stress any kind of server.
Now I would like to share my setup that gives me full confidence my sites are up and running, and serving tons of traffic without hiccups.
# Server infrastructure
1. Webservers running nginx and PHP for websites. I have three servers to host websites. I am keeping one server per client and they all host several websites. These are medium-spec machines. 8GB RAM and 4 to 8 cores. It’s a balance of php-fpm workers and nginx.
2. One beefy database server (talking 16 core and 16GB RAM for now) – this is a central database, accessible only within a local network, with each user having access to their database. I’m hosting around100 databases (WordPress websites plus my Laravel apps)
3. One lower-spec Redis server. I started with 8GB of RAM but ended up needing only 4GB. This serves for object caching and, in some cases page caching and it’s for queues in my apps (but this is not a topic for this time). Access to this server is also allowed only within the local network.
All of them are VMs on dedicated servers and the local network in this case is a virtual LAN network. The latency is around 0.1 ms. You can get them at Hetzner
# WordPress config
This is what surprised me most surprised. I’ve dropped all caching plugins on the market and stayed only with the WP super cache. It’s simple to set up and it works great. Serving static pages to visitors, allows page loads to be snappy regardless of the traffic.
Next to it, I’m using Redis for object caching, reducing the load on database queries.
On top of that, I use the nginx helper to clear the object cache on page/post changes.
# Cloudflare
I use Cloudflare for all my sites. It helps me squeeze a bit more performance out of everything. And it’s a great way to protect your website. I don’t care that much about what Google tells me about page speed. I can time the page load and see that it’s sub-second even with 700+ visitors hitting the server at the same time.
The bonus is using their WAF to protect against bots and attacks. Your server might be hardened and bots can’t do any harm, but being hit with tens of thousands of requests will slow down your site. Or even break the server. DDoS in a nutshell. But if you configure the WAF to display a captcha or verify the browser to all visitors not coming from your target market, the load will drop and you will also feel it.
Now, I still recommend using things like fail2ban on the server side, and Wordfence for your WordPress to protect against potential threats.
# Conclusion
That’s it. That’s all folks. I thought I to share my setup with you and maybe inspire you to think about your infrastructure. Now, whenever something goes viral I can sleep tight knowing I have everything under control.
I might go into detail if I ever start a blog but I think this covers pretty much everything.
How are you managing your servers?
[ad_2]
Nice setup.
I would add Debloat to WPSuperCache. It’s killer combo.
I have no issues with wordpress speed. I use a litespeed server and plugin with quicloud CDN
Solid setup, and great post for people to take inspiration from. It certainly can be a fine art creating the most optimal server setup.
Mine is similar, although I tend have the web/db/redis server set up per client rather than using a central setup for all (apart from your web servers which sounds like it’s per client anyway). And then slightly lower spec servers, although the clients I have tend to only have one site so that makes more sense for them.
The only additional thing I also have in place for certain clients that require it is load balancing.
Great info. I’m glad I stumbled upon it. My site is HORRIBLE right now. I’ll make some of these changes. Thanks again.
> Now, I still recommend using … Wordfence for your WordPress to protect against potential threats.
I’m on board with almost all of this post, but this point is where I disagree.
Wordfence and other security plugins attempt to do things inside of the WordPress application that are done better and more securely at the host level or via WAF. An on-box firewall, coupled with Cloudflare’s WAF, will keep your site secure without having to run everything through the WordPress application to a WP plugin.
If you’re on shared hosting and don’t have root on your server, they’re better than nothing. If you’re on a VPS or otherwise have root, they are a waste of resources.
How do you optimize your images ? And how do you upload each image ?