Hosting is something you set up once and rarely revisit. It works, until your client list or traffic grows and the gaps start showing, rarely as obvious problems.
A slower load here, a missed backup there. Small things, until they aren't. This checklist catches them all, performance, security, and stability, in one 10-minute pass.
What this audit covers, and what to have open
What This Audit Covers And Who It's For
This audit examines eight areas of your hosting setup:
- Server response time
- Uptime history and error patterns
- Resource utilization during peak hours
- Account isolation
- Security access and firewall controls
- SSL and certificate management
- Data residency and legal jurisdiction
- Backup location and recovery time
Built for SMBs on shared hosting or a VPS, and agencies managing a client portfolio. If your revenue depends on your site staying live and fast, it's for you. No dev skills required, just your control panel and 10 minutes.
It's not a code audit or plugin review. It catches the structural hosting issues underneath your site, the ones that affect every visitor no matter how clean your code is.
What To Have Open Before You Start
Pull these up in separate tabs before you start.
- 1Your hosting control panel (cPanel, Plesk, or your provider's custom dashboard).
- 2Your live site in one tab, and Google PageSpeed Insights at pagespeed.web.dev in another.
- 3Your host's status or uptime page. If you use UptimeRobot or a similar monitoring tool, open your latest report.
- 4Your domain's SSL certificate details (under a Security or SSL/TLS section in most control panels).
- 5Your backup logs, typically listed under a Backups tab in your control panel, so that you can confirm the last snapshot date and where that backup actually is stored.
Eight checks. Run them in order
Flag anything that doesn't land on green and return to it in the scoring section.
Check 1
Server Response Time
Paste your URL into Google PageSpeed Insights and find Time to First Byte (TTFB), the time before your server returns its first byte. Run it three times across mobile and desktop. If Diagnostics flags your root document, the server is the bottleneck, not your code.
Check 2
Uptime History And Error Patterns
Open UptimeRobot or your host's status page and look for patterns, not single events. Repeated 503s on shared hosting mean you've hit your Entry Process (EP) ceiling. Clustered 500s during busy hours point to server load, not broken code, especially if response times rise just before the errors.
Check 3
Resource Utilization At Peak Hours
Open Resource Usage in your control panel and read peak values, not averages. Averages hide the spikes that hurt visitors. On CloudLinux, watch EP, PMEM, and IOPS. If these regularly hit the ceiling, no caching plugin fixes it. The cap is the problem.
Check 4
Isolation Between Accounts
On shared hosting you sit beside hundreds of accounts, and one compromised or blocklisted neighbor drags every site on that IP down with it. Confirm PHP-FPM runs one pool per account with open_basedir enforced, then check your IP on MXToolbox. A VPS sidesteps all of this with hypervisor-level isolation: no shared file system, no cross-account exposure.
Check 5
Security Access And Firewall Control
Shared hosting hands firewall control to your host: no IP blocks, no port rules, no CSF. On a VPS, run `sshd -T | grep -E 'permitrootlogin|passwordauthentication'` and confirm both are set to no, since password SSH is a known attack vector that key auth shuts down. Then turn on 2FA in your control panel.
Check 6
SSL And Certificate Management
Click the padlock and check the expiry date: under 30 days needs attention now. Open DevTools (F12) and look for mixed content warnings flagging HTTP resources on an HTTPS page. Confirm auto-renewal with `systemctl list-timers | grep certbot`, then run your domain through securityheaders.com for HSTS, without which browsers can still attempt HTTP before the redirect.
Check 7
Data Residency And Legal Jurisdiction
Server location and host incorporation are two different things. The CLOUD Act (18 U.S.C. § 2713) compels US companies to hand over data from their servers worldwide, AWS EU regions included, and EU enterprise legal teams flag this in vendor reviews. Confirm a GDPR Data Processing Agreement is on file. No DPA is a gap for any client with EU users.
Check 8
Backup Location And Recovery Time
Find the last successful snapshot in your control panel. More than 48 hours old is a gap. Then check where it lives, because a backup on the same server as your live site is barely a backup if that server fails. Confirm snapshots ship to a separate data center, then test a single-file restore. Most teams discover their backups are broken only when they actually need them.
Green, Yellow, Red: What Each Outcome Tells You
Count your colors across all eight checks. The tally tells you whether you're patching loose ends or facing a setup that needs a real change.
Green
Working as it should.
Yellow
Worth fixing before it becomes a real problem.
Red
Already costing you in performance, security, or both.
Two or more reds across Checks 1, 2, and 3 mean a server under consistent strain. That's a pattern, not a bad day. One red in Check 4 or 5 puts every site on that server at risk, not just yours.
Move your business to Webdock
Tell us about your workload and what you're looking for. Someone from our team will get back to you within one business day with sizing, pricing and the documentation you need to evaluate Webdock.
The Difference Between A Config Fix And A Structural One
Config Fixes (Yellows)
Quick wins. Manual SSL renewal becomes automatic with a Certbot systemd timer. Missing HSTS headers take one line in your server config. Under an hour, no host change needed.
Structural Fixes (Reds)
Reds in Checks 3, 4, and 5 are different. You can't add dedicated CPU to shared hosting or get root for a custom firewall. Those aren't toggles your host forgot, they're limits in the architecture. When reds cluster around resources, isolation, or firewall control, the infrastructure has to change.
Beyond Standard VPS
Some setups need more than a bigger VPS
If your reds keep clustering around isolation and firewall control, Webdock Private Cloud gives you dedicated hardware, your own hypervisor, and full network isolation, no shared-tenancy ceiling to hit.
And Here's How Webdock Fits In For Your Needs
Most of what this check surfaces traces back to shared infrastructure. Pooled resources mean your site's behavior partly depends on your neighbors. A VPS removes that variable, but the specific VPS setup still matters.
Custom Profile Builder
Configure CPU threads, RAM, and storage to your actual workload, not the nearest preset tier.
Included by default
Every plan includes free SSL with auto-renewal, automated snapshots, and a browser-based control panel. Plans at €5.99 and above add Postmark transactional email and ImprovMX forwarding.
For agencies managing client portfolios
Each client gets an isolated, right-sized environment, so one traffic spike never bleeds into another. The Webdock API handles provisioning and one dashboard surfaces resource warnings before clients notice.
European jurisdiction
Operated under European law from Webdock's own Denmark data center, outside CLOUD Act reach. The GDPR DPA downloads straight from the dashboard, clearing a common procurement bottleneck in minutes.
Webdock Private Cloud
For workloads needing physical isolation beyond standard VPS tenancy, regulated industries or strict enterprise security, Webdock Private Cloud delivers dedicated AMD EPYC hardware with its own hypervisor, DDoS protection, and WAF, from €450/month.