PHP: Speed and Hardening
We find why a Bitrix, WordPress or Laravel site is slow and what it leaves open, and fix it at the server, the database and the configuration.
Included
- Measured before and after: TTFB and p95 on key pages, under load rather than on a single request
- PHP-FPM, OPcache and the PHP version sized to your code and the server's memory, not left on defaults
- Slow MySQL, MariaDB or PostgreSQL queries found in the log and fixed with indexes and tuning
- Redis or Valkey for sessions and data caching; static files and compression served by nginx, not PHP
- Core, module and plugin updates, and dependencies checked with composer audit
- Hardening: file permissions, open_basedir, dangerous functions disabled, admin panels and .git closed
- WAF rules for your platform, and a malware sweep if the site has already been compromised
How the work runs
We start by measuring. Request profiles under load, the database slow query log, PHP-FPM, OPcache and web server settings. Alongside that, security: versions, plugins and modules with known vulnerabilities, exposed service paths, file permissions.
The output is a written report: where the time goes, what the site leaves open, what a server change fixes and what needs a code change. The before numbers are in the report; the after numbers are in the sign-off.
We fix the server side ourselves: PHP, the database, caching, nginx, the WAF. Where the problem is in the code — a heavy query inside a loop, Bitrix component caching switched off, a plugin that loads everything on every page — we point at the line and propose the fix to your developers, or make it ourselves if agreed.
The same approach elsewhere
None of this is specific to PHP. Node.js and Python applications go through the same order: measure, profile, database, cache, configuration, hardening.
What we need from you
SSH to the server, read access to the database, and a copy of the site or a staging host we can put load on. If the site lives on shared hosting with no SSH, the first step is usually a move — quoted separately.
Where this does not apply
If the server answers quickly and the page is slow because of heavy images and third-party scripts, that is front-end work, not server work. The measurement shows it, and we will tell you.
What this draws on
These areas of the catalogue are covered by the package, or alongside it.