What actually matters
- Backups that are automatic, off-server and tested
- A supported PHP version, kept current
- Server patching, with someone responsible for it
- Monitoring that alerts a person
- Enough resources for your actual load, with headroom
Specification is rarely the constraint for a business application with a few dozen users. Whether anyone is patching the server is a much more important question.
The options
| Option | Suits | Typical monthly |
|---|---|---|
| Managed PHP hosting | Standard applications, no ops capability | £20–£80 |
| Small cloud server, managed | Most business applications | £40–£200 |
| Container platform | Teams with the capability to run it | £60–£400 |
| On-premises | Regulatory or data residency reasons | Varies |
Who patches the server?
An unmanaged cloud server is your responsibility to patch. Businesses that take one and never patch it end up running an outdated operating system with known vulnerabilities.
Either buy managed hosting, or make sure someone is named and actually doing it. The default of nobody is the common and dangerous case.
Separate the environments
- Production, staging and development genuinely separate
- Different credentials for each
- Staging blocked from search engines and from real email
- Production data not copied to developer machines without anonymising
Plan for the database
Database backups are the important ones, and they need to be off-server, retained and restorable. A file backup without the database is not a backup of a business application.
Test a restore once. It takes an hour and it is the only way to know whether your backups are real.