Brova Cloud / Managed hosting
Fast websites. Serious infrastructure.
Managed hosting and maintenance for the sites and applications Brova Digital builds. We size the server for each site, keep it updated and backed up, and the engineer who set it up is the one you talk to.
- Edge
Cloudflare
DNS, TLS, cache and WAF
- Server
Nginx + PHP-FPM
Web server and PHP, one pool per site
- Data
MariaDB + Redis
Database, with an optional object cache
The stack
Open-source software and services we run and maintain for you.
What can we host?
Pick what you're running to see the setup we'd use and the plan we'd usually start from.
WordPress: starting plan WordPress, $30 a month.
Recommended setup for WordPress
- CDN: included
- Cache: included
- Application: included
- Database: included
- Security: included
- Backups: included
Nginx, PHP-FPM and MariaDB, with a page cache and Redis object cache when the site needs them. Each site runs under its own system user and PHP pool.
Starting plan
WordPress
$30 / month, VAT included
We confirm the plan after reviewing the site.
How a site gets set up
Six steps, always in this order. How long each one takes depends on the site. Scroll to follow them.
Step 1: Assess
We review what you're running: code, plugins, database size, and traffic from your analytics or server logs if you have them.
Output: A written proposal with the plan and the price.
Step 2: Plan
We choose the setup: WordPress on our managed hosting, your application in a container, or a virtual machine of its own.
Output: An agreed setup and launch date.
Step 3: Secure
DNS, TLS certificates, backups and, for sites behind Cloudflare, WAF and bot rules are in place before launch.
Output: A site that's protected before it's public.
Step 4: Launch
New sites go live on the agreed date. Migrations get a scheduled cutover, with a way back ready before DNS changes.
Output: The site live on Brova Cloud.
Step 5: Tune
Once real traffic arrives, we adjust PHP workers, cache rules and database settings to it.
Output: Settings based on your traffic, not on a guess.
Step 6: Review
We keep the server updated and backed up, and revisit the setup when traffic or requirements change.
Output: Someone looking after the site after launch.
The architecture
What happens between a click and a page
Most requests follow the same path. The edge step applies to sites behind Cloudflare; the rest applies to every site.
Select a step, or trace a request end to end.
One request, step by step
Click through, or let it play.
A visitor opens your site.
The browser looks up your domain and opens an encrypted connection.
Performance targets
98+
Lighthouse performance score
< 1.1s
LCP: main content loaded
< 10ms
Total Blocking Time
0
Cumulative Layout Shift
- Request 1000 of 1000 requests
Requests reaching the site
- Cache 780 of 1000 requests
Answered by a cache, never reach the server
- Server 220 of 1000 requests
Dynamic, built by the application
Security at the edge and on the server
Every site gets server-side protection. Sites behind Cloudflare also get filtering before traffic reaches our server. Security here means reducing risk in layers: no host can promise that nothing ever gets through.
On every site
One user per site
Each site runs under its own system user and PHP pool, so one site can't read another site's files.
Key-only SSH
Server access by SSH key only. No password logins, no root login.
fail2ban
Addresses behind repeated failed logins to the server are blocked automatically.
Weekly malware scan
Linux Malware Detect scans every site's files once a week.
Automatic security updates
Operating-system security patches on the hosting server install without waiting for us.
Audit logging
auditd records administrative actions on the hosting server.
WordPress, the platform we host most.
Most Brova Digital sites run on WordPress, so it's the setup we've tuned furthest: PHP workers and caching, set per site.
Why this configuration
Pages for logged-out visitors can be cached; pages for logged-in users, carts and checkouts can't. On sites behind Cloudflare we cache logged-out pages at the edge and, where enabled, again in Nginx on the server. Cart, checkout, account and admin pages always bypass the cache.
# Cloudflare cache rule (WordPress), example# Cache HTML when:# http.request.method eq "GET"# and not http.cookie contains "wordpress_logged_in"# and not http.cookie contains "woocommerce_items_in_cart"# Always bypass: /wp-admin*, /cart*, /checkout*, /my-account* # Cloudflare security rules, example# /wp-login.php managed challenge# /xmlrpc.php block# /wp-admin* rate limitWhy this configuration
We set the number of PHP workers from the memory the server has: available RAM, minus the database and caches, divided by what one worker uses. Workers restart after a set number of requests, which keeps slow memory leaks in check. Each site has its own pool.
; PHP-FPM pool, one per site (example values)pm = dynamicpm.max_children = 12 ; from measured worker memorypm.start_servers = 3pm.min_spare_servers = 2pm.max_spare_servers = 5pm.max_requests = 500php_admin_value[memory_limit] = 256MWhy this configuration
Without an object cache, a WooCommerce category page can run a hundred or more database queries. When a site needs it, we enable Redis, which keeps repeat lookups in memory so most of them never reach MariaDB. Each site has its own database.
-- MariaDB, one database per site (example values)innodb_buffer_pool_size = 2G # Redis object cachemaxmemory 512mbmaxmemory-policy allkeys-lruIncluded on every WordPress site
The same baseline on every WordPress site we host.
Its own user and PHP pool
Each site runs under a separate system user with its own PHP-FPM pool, so a problem on one site doesn't spill into another's files.
Page cache and object cache, when needed
Nginx can cache pages for logged-out visitors and Redis can cache database lookups. We turn them on per site, when its traffic calls for it.
Updates with WordPress Care
With WordPress Care ($20 a month, included in WordPress Commerce), we update WordPress core, plugins and themes and check the site afterwards.
Weekly malware scan
Linux Malware Detect checks every site's files once a week, alongside automatic operating-system security updates.
Weekly backups
Every plan, with extra snapshots for sites that need them.
Turnstile on request
Cloudflare Turnstile on login, comment and checkout forms, with no Google reCAPTCHA script on the page.
Why Brova Cloud
Sized after we look
We choose the plan after reviewing the site, its traffic and its database.
You message the engineer who set it up
Questions go straight to the person who configured your site. No ticket queue, no re-explaining.
Security in place before launch
DNS, TLS, backups and, where the site uses Cloudflare, WAF and bot rules are set before it goes live.
One team for the site and the hosting
Brova Digital builds the site and Brova Cloud runs it, so there's no handoff between agency and host.
Plans
One monthly price for hosting and day-to-day operations, in US dollars, VAT included. We confirm the plan after reviewing the site.
Static
$15 / month
Landing pages, brochure sites and static front ends.
WordPress
$30 / month
Company and editorial sites on WordPress.
WordPress Commerce
$79 / month
WooCommerce stores and busy sites.
Application
$69 / month
Laravel, Node.js, Next.js, APIs and headless back ends.
Dedicated VM
Sites and applications that need resources of their own.
The stack we choose for the job
WordPress, a headless CMS or a custom application. Underneath, the same work: server updates, backups and someone who knows the setup.
Cloudflare Turnstile
Login, comment and checkout forms that attract automated traffic.
Turnstile checks that a visitor is human without a puzzle, and without loading Google's reCAPTCHA scripts on your login page, which keeps a Google dependency out of privacy reviews.
reCAPTCHA is a widely supported alternative. We use Turnstile because most of our sites already run behind Cloudflare, and it works on the rest too.
WordPress on managed hosting
Editorial teams, WooCommerce stores, multilingual publishing, and organisations that already know WordPress.
Most Brova Digital sites run on WordPress. We host them on HestiaCP with Nginx, PHP-FPM and MariaDB, with a separate system user and PHP pool for each site.
We've spent more time tuning WordPress than any other platform we host, and the settings are made per site rather than per price tier.
Payload, when the CMS is an API
Content that has to feed a site, an app, a kiosk and a newsletter from one model, with TypeScript in the same repository as the front end.
A headless CMS is the right choice when the same content has to reach more than one front end. Payload keeps the content schema in code, in the same repository as a Next.js front end.
On Brova Cloud, Payload runs as a Node.js application in a container, with its own database.
Containers, and virtual machines when needed
Applications we can package as an image, and the few workloads that need a full machine.
Applications run as containers on a separate server from the WordPress sites. They deploy from your repository. Every release is versioned, so we can roll back to the previous one.
When software needs a full machine, it gets its own virtual machine on Proxmox.
The technology, by category
What runs underneath, tool by tool. Anything that says “for sites behind Cloudflare” applies only to those sites.
Hetzner
Dedicated servers in the EU
Proxmox
Virtual machines on our servers
HestiaCP
Control panel for WordPress and static sites
Docker
Containers for applications
Nginx
Web server
Cloudflare
DNS, CDN and security, for sites behind Cloudflare
Cloudflare WAF
Managed and custom rules, for sites behind Cloudflare
Turnstile
Human check without a puzzle, on request
fail2ban
Blocks repeated failed logins to the server
Linux Malware Detect
Weekly malware scan of every site
Cloudflare cache
Edge caching for sites behind Cloudflare
Nginx FastCGI cache
Page cache on the server, enabled per site
Redis
Object cache in front of the database, enabled per site
PHP-FPM
One pool per site, sized to the server
WordPress
CMS and WooCommerce
Payload
Headless CMS, schema in code
Node.js
Runtime for applications and APIs
PHP
Runtime for WordPress and PHP applications
MariaDB
One database per site
Redis
In-memory cache, enabled per site
Docker
Each release is a new image
Git
Applications deploy from your repository
Server logs
Rotated and kept for incident review
Resend
Relay for outgoing email from hosted sites
You are not buying a server and being left alone with it.
We keep the servers updated and backed up, and we fix what breaks. When something needs attention, you talk to the engineer who configured your site.
- WhatsApp +44 7883 256391 (opens in a new tab)
- First reply within 5 minutes
- Email contact@brova.cloud
- First reply within 1 hour
- Hours
- Every day, 08:00 to 22:00 CET
Response-time targets for a first reply from a person, during support hours.
Frequently asked questions
Brova Digital clients. It's the hosting for the sites and applications we design and build. If you're not a client yet, start at brova.digital.
Yes. It's what we host most: Nginx, PHP-FPM and MariaDB, with a separate system user and PHP pool for each site. A page cache and Redis object cache are available when a site needs them.
Yes. Cart, checkout and account pages stay out of every cache, and the WordPress Commerce plan has more PHP workers for checkout traffic.
Yes. They run as containers on a separate server from the WordPress sites, each with its own database, deployed from your repository.
Yes, as a containerised application. Multi-tenancy, roles and permissions are part of the application we build with you; the hosting provides the server, the database, a certificate for each domain and backups.
Yes, as part of a Brova Digital project. We review the current setup first, schedule the switch, and keep a way back ready until DNS has changed.
Yes. The domain stays with your registrar. We point it to Cloudflare or to our nameservers (ns1/ns2.brova.cloud), and agree which during onboarding.
Yes. Every site gets a TLS certificate, issued and renewed automatically.
Yes. Weekly on every plan, with extra snapshots for sites that need them. We confirm the schedule for your site during onboarding.
Sites behind Cloudflare get its CDN and DDoS protection. We recommend it for most sites and set it up at launch. Sites on our own nameservers are served directly from our servers.
Each plan has a fixed amount of server resources, so a large spike can slow a site down. On sites behind Cloudflare, cached pages never reach the server, which absorbs much of it. If traffic stays higher, we suggest a larger plan and agree the price with you first.
Yes. Moving to a larger plan doesn't mean rebuilding the site. Moving from the shared hosting server to a virtual machine of your own is a migration we plan with you.
Yes, with WordPress Care: $20 a month on the WordPress plan, included in WordPress Commerce. We apply core, plugin and theme updates ourselves and check the site afterwards.
In the EU by default, on Hetzner servers we manage. If a project needs another region, we arrange it case by case.
Not yet. We publish an uptime target of 99.95% per month, excluding announced maintenance. A contractual SLA needs a longer measured history and a standby server, and we'll offer one when both exist.
Yes. Monthly plans can be cancelled with 30 days' notice to the end of a month; annual plans run for 12 months. The details are in our Terms of Service.
Hosting, TLS certificates, backups, server security updates and support. WordPress updates come with WordPress Care, which is included in WordPress Commerce. Prices are in US dollars and include VAT. The full list for each plan, with limits, is on the Plans page.
New features, design changes, content entry, premium plugin licences and email mailboxes. That's development work, quoted by Brova Digital.
Let's plan the hosting for your project.
Tell us what you're running and we'll recommend a plan.
Not a Brova Digital client yet? Start at brova.digital.