Skip to content
Brova Cloud home

Brova Cloud / Managed hosting

Fast websites. Serious infrastructure.

Managed hosting and maintenance for the sites and applications Brova Digital builds. We size the server for each site, keep it updated and backed up, and the engineer who set it up is the one you talk to.

Example: a WordPress site behind Cloudflare
  1. Cloudflare

    DNS, TLS, cache and WAF

    Edge
  2. Nginx + PHP-FPM

    Web server and PHP, one pool per site

    Server
  3. MariaDB + Redis

    Database, with an optional object cache

    Data

The stack

Open-source software and services we run and maintain for you.

What can we host?

Pick what you're running to see the setup we'd use and the plan we'd usually start from.

What are you running?

WordPress: starting plan WordPress, $30 a month.

Recommended setup for WordPress

  • CDN: included
  • Cache: included
  • Application: included
  • Database: included
  • Security: included
  • Backups: included

Nginx, PHP-FPM and MariaDB, with a page cache and Redis object cache when the site needs them. Each site runs under its own system user and PHP pool.

Starting plan

WordPress

$30 / month, VAT included

We confirm the plan after reviewing the site.

How a site gets set up

Six steps, always in this order. How long each one takes depends on the site. Scroll to follow them.

  1. Step 1: Assess

    We review what you're running: code, plugins, database size, and traffic from your analytics or server logs if you have them.

    Output: A written proposal with the plan and the price.

  2. Step 2: Plan

    We choose the setup: WordPress on our managed hosting, your application in a container, or a virtual machine of its own.

    Output: An agreed setup and launch date.

  3. Step 3: Secure

    DNS, TLS certificates, backups and, for sites behind Cloudflare, WAF and bot rules are in place before launch.

    Output: A site that's protected before it's public.

  4. Step 4: Launch

    New sites go live on the agreed date. Migrations get a scheduled cutover, with a way back ready before DNS changes.

    Output: The site live on Brova Cloud.

  5. Step 5: Tune

    Once real traffic arrives, we adjust PHP workers, cache rules and database settings to it.

    Output: Settings based on your traffic, not on a guess.

  6. Step 6: Review

    We keep the server updated and backed up, and revisit the setup when traffic or requirements change.

    Output: Someone looking after the site after launch.

The architecture

What happens between a click and a page

Most requests follow the same path. The edge step applies to sites behind Cloudflare; the rest applies to every site.

Select a step, or trace a request end to end.

One request, step by step

Click through, or let it play.

A visitor opens your site.

The browser looks up your domain and opens an encrypted connection.

Performance targets

  • 98+

    Lighthouse performance score

  • < 1.1s

    LCP: main content loaded

  • < 10ms

    Total Blocking Time

  • 0

    Cumulative Layout Shift

Illustrative example: not production telemetry
  • Request 1000 of 1000 requests

    Requests reaching the site

  • Cache 780 of 1000 requests

    Answered by a cache, never reach the server

  • Server 220 of 1000 requests

    Dynamic, built by the application

Security at the edge and on the server

Every site gets server-side protection. Sites behind Cloudflare also get filtering before traffic reaches our server. Security here means reducing risk in layers: no host can promise that nothing ever gets through.

How we handle security and backups →

On every site

  • One user per site

    Each site runs under its own system user and PHP pool, so one site can't read another site's files.

  • Key-only SSH

    Server access by SSH key only. No password logins, no root login.

  • fail2ban

    Addresses behind repeated failed logins to the server are blocked automatically.

  • Weekly malware scan

    Linux Malware Detect scans every site's files once a week.

  • Automatic security updates

    Operating-system security patches on the hosting server install without waiting for us.

  • Audit logging

    auditd records administrative actions on the hosting server.

WordPress, the platform we host most.

Most Brova Digital sites run on WordPress, so it's the setup we've tuned furthest: PHP workers and caching, set per site.

Why this configuration

Pages for logged-out visitors can be cached; pages for logged-in users, carts and checkouts can't. On sites behind Cloudflare we cache logged-out pages at the edge and, where enabled, again in Nginx on the server. Cart, checkout, account and admin pages always bypass the cache.

# Cloudflare cache rule (WordPress), example
# Cache HTML when:
# http.request.method eq "GET"
# and not http.cookie contains "wordpress_logged_in"
# and not http.cookie contains "woocommerce_items_in_cart"
# Always bypass: /wp-admin*, /cart*, /checkout*, /my-account*
 
# Cloudflare security rules, example
# /wp-login.php managed challenge
# /xmlrpc.php block
# /wp-admin* rate limit

Included on every WordPress site

The same baseline on every WordPress site we host.

  • Its own user and PHP pool

    Each site runs under a separate system user with its own PHP-FPM pool, so a problem on one site doesn't spill into another's files.

  • Page cache and object cache, when needed

    Nginx can cache pages for logged-out visitors and Redis can cache database lookups. We turn them on per site, when its traffic calls for it.

  • Updates with WordPress Care

    With WordPress Care ($20 a month, included in WordPress Commerce), we update WordPress core, plugins and themes and check the site afterwards.

  • Weekly malware scan

    Linux Malware Detect checks every site's files once a week, alongside automatic operating-system security updates.

  • Weekly backups

    Every plan, with extra snapshots for sites that need them.

  • Turnstile on request

    Cloudflare Turnstile on login, comment and checkout forms, with no Google reCAPTCHA script on the page.

Why Brova Cloud

  • Sized after we look

    We choose the plan after reviewing the site, its traffic and its database.

  • You message the engineer who set it up

    Questions go straight to the person who configured your site. No ticket queue, no re-explaining.

  • Security in place before launch

    DNS, TLS, backups and, where the site uses Cloudflare, WAF and bot rules are set before it goes live.

  • One team for the site and the hosting

    Brova Digital builds the site and Brova Cloud runs it, so there's no handoff between agency and host.

Plans

One monthly price for hosting and day-to-day operations, in US dollars, VAT included. We confirm the plan after reviewing the site.

  • Static

    $15 / month

    Landing pages, brochure sites and static front ends.

  • WordPress

    $30 / month

    Company and editorial sites on WordPress.

  • WordPress Commerce

    $79 / month

    WooCommerce stores and busy sites.

  • Application

    $69 / month

    Laravel, Node.js, Next.js, APIs and headless back ends.

  • Dedicated VM

    Sites and applications that need resources of their own.

Compare plans, limits and what's included →

The stack we choose for the job

WordPress, a headless CMS or a custom application. Underneath, the same work: server updates, backups and someone who knows the setup.

  • Cloudflare

    Cloudflare Turnstile

    Login, comment and checkout forms that attract automated traffic.

    Turnstile checks that a visitor is human without a puzzle, and without loading Google's reCAPTCHA scripts on your login page, which keeps a Google dependency out of privacy reviews.

    reCAPTCHA is a widely supported alternative. We use Turnstile because most of our sites already run behind Cloudflare, and it works on the rest too.

  • WordPress

    WordPress on managed hosting

    Editorial teams, WooCommerce stores, multilingual publishing, and organisations that already know WordPress.

    Most Brova Digital sites run on WordPress. We host them on HestiaCP with Nginx, PHP-FPM and MariaDB, with a separate system user and PHP pool for each site.

    We've spent more time tuning WordPress than any other platform we host, and the settings are made per site rather than per price tier.

  • Payload

    Payload, when the CMS is an API

    Content that has to feed a site, an app, a kiosk and a newsletter from one model, with TypeScript in the same repository as the front end.

    A headless CMS is the right choice when the same content has to reach more than one front end. Payload keeps the content schema in code, in the same repository as a Next.js front end.

    On Brova Cloud, Payload runs as a Node.js application in a container, with its own database.

  • DockerProxmox

    Containers, and virtual machines when needed

    Applications we can package as an image, and the few workloads that need a full machine.

    Applications run as containers on a separate server from the WordPress sites. They deploy from your repository. Every release is versioned, so we can roll back to the previous one.

    When software needs a full machine, it gets its own virtual machine on Proxmox.

The technology, by category

What runs underneath, tool by tool. Anything that says “for sites behind Cloudflare” applies only to those sites.

  • Hetzner

    Dedicated servers in the EU

  • Proxmox

    Virtual machines on our servers

  • HestiaCP

    Control panel for WordPress and static sites

  • Docker

    Containers for applications

  • Nginx

    Web server

  • Cloudflare

    DNS, CDN and security, for sites behind Cloudflare

You are not buying a server and being left alone with it.

We keep the servers updated and backed up, and we fix what breaks. When something needs attention, you talk to the engineer who configured your site.

Email contact@brova.cloud
First reply within 1 hour
Hours
Every day, 08:00 to 22:00 CET

Response-time targets for a first reply from a person, during support hours.

Frequently asked questions

Brova Digital clients. It's the hosting for the sites and applications we design and build. If you're not a client yet, start at brova.digital.

Yes. It's what we host most: Nginx, PHP-FPM and MariaDB, with a separate system user and PHP pool for each site. A page cache and Redis object cache are available when a site needs them.

Yes. Cart, checkout and account pages stay out of every cache, and the WordPress Commerce plan has more PHP workers for checkout traffic.

Yes. They run as containers on a separate server from the WordPress sites, each with its own database, deployed from your repository.

Yes, as a containerised application. Multi-tenancy, roles and permissions are part of the application we build with you; the hosting provides the server, the database, a certificate for each domain and backups.

Yes, as part of a Brova Digital project. We review the current setup first, schedule the switch, and keep a way back ready until DNS has changed.

Yes. The domain stays with your registrar. We point it to Cloudflare or to our nameservers (ns1/ns2.brova.cloud), and agree which during onboarding.

Yes. Every site gets a TLS certificate, issued and renewed automatically.

Yes. Weekly on every plan, with extra snapshots for sites that need them. We confirm the schedule for your site during onboarding.

Sites behind Cloudflare get its CDN and DDoS protection. We recommend it for most sites and set it up at launch. Sites on our own nameservers are served directly from our servers.

Each plan has a fixed amount of server resources, so a large spike can slow a site down. On sites behind Cloudflare, cached pages never reach the server, which absorbs much of it. If traffic stays higher, we suggest a larger plan and agree the price with you first.

Yes. Moving to a larger plan doesn't mean rebuilding the site. Moving from the shared hosting server to a virtual machine of your own is a migration we plan with you.

Yes, with WordPress Care: $20 a month on the WordPress plan, included in WordPress Commerce. We apply core, plugin and theme updates ourselves and check the site afterwards.

In the EU by default, on Hetzner servers we manage. If a project needs another region, we arrange it case by case.

Not yet. We publish an uptime target of 99.95% per month, excluding announced maintenance. A contractual SLA needs a longer measured history and a standby server, and we'll offer one when both exist.

Yes. Monthly plans can be cancelled with 30 days' notice to the end of a month; annual plans run for 12 months. The details are in our Terms of Service.

Hosting, TLS certificates, backups, server security updates and support. WordPress updates come with WordPress Care, which is included in WordPress Commerce. Prices are in US dollars and include VAT. The full list for each plan, with limits, is on the Plans page.

New features, design changes, content entry, premium plugin licences and email mailboxes. That's development work, quoted by Brova Digital.

Let's plan the hosting for your project.

Tell us what you're running and we'll recommend a plan.

Not a Brova Digital client yet? Start at brova.digital.