--- title: "WordPress Hosting, nginx and Security Guides for Stores" description: "Run WooCommerce on your own server: install it on Ubuntu or Debian, fix nginx 502 and 413 errors, set up SSL and Redis, and patch PHP security holes fast." url: "https://carthacker.com/category/hosting/" image: "https://carthacker.com/wp-content/themes/carthacker-core/assets/og/hosting.jpg?v=1793269221" publisher: "CartHacker (carthacker.com)" language: "en" --- Servers # Hosting & Security Run WordPress and WooCommerce on your own server: install guides for Ubuntu and Debian, nginx errors fixed one by one, caching, SSL certificates and the security patches to install first. ## [Redis Object Cache Made My Test Store No Faster, Until the Database Was 2 ms Away](https://carthacker.com/hosting/redis-object-cache-wordpress/) October 29, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![The red Redis logo on a dark blue background over the question Does Redis Object Cache make WordPress faster?, with the answer in green: Yes, when the database is on another server.](https://carthacker.com/wp-content/uploads/does-redis-object-cache-make-wordpress-faster.jpg)](https://carthacker.com/hosting/redis-object-cache-wordpress/) On one server Redis cut the cart's database queries from 116 to 17 and saved no time. With the database 2 ms away, the same plugin made the cart 205 ms faster, and a full Redis broke the whole store. [Hosting & Security](https://carthacker.com/category/hosting/) ## [413 Request Entity Too Large: WordPress Said 2 MB, nginx Said 1 MB](https://carthacker.com/hosting/413-request-entity-too-large/) October 29, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![The words How to fix, the number 413 in large serif type, Request Entity Too Large, and on WordPress and nginx in green, on a cream background](https://carthacker.com/wp-content/uploads/how-to-fix-413-request-entity-too-large.jpg)](https://carthacker.com/hosting/413-request-entity-too-large/) Media > Add New said the limit was 2 MB while nginx refused a 1.5 MB photo, and each of the four upload limits between a file and a store gave me its own misleading message. [Hosting & Security](https://carthacker.com/category/hosting/) ## [502 Bad Gateway nginx: I Broke a Test Store Six Ways, and the Error Log Showed Each Cause](https://carthacker.com/hosting/502-bad-gateway-nginx/) October 29, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![A copy of the nginx error page with 502 Bad Gateway in large black letters over the word nginx, and under it a dark band with the line How to fix it: 6 causes, 6 fixes](https://carthacker.com/wp-content/uploads/502-bad-gateway-how-to-fix-nginx.jpg)](https://carthacker.com/hosting/502-bad-gateway-nginx/) The 502 page looked the same all six times I broke my test store, but nginx's error log wrote a different line for each cause, and that line shows which fix you need. [Hosting & Security](https://carthacker.com/category/hosting/) ## [After the Rank Math and UpdraftCentral Breaches, I'd Replace Both With Two Files](https://carthacker.com/hosting/replace-rank-math-updraftplus/) October 23, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![The Rank Math and UpdraftPlus logos side by side under the heading WordPress security, with the line: Both breached in October. Two free files replace them.](https://carthacker.com/wp-content/uploads/rank-math-updraftplus-breached-cover.jpg)](https://carthacker.com/hosting/replace-rank-math-updraftplus/) Both attacks came through a channel a plugin keeps open to someone else's server, and for SEO tags and backups a 230-line mu-plugin and a cron script do the job with that channel closed. [Hosting & Security](https://carthacker.com/category/hosting/) ## [Patched PHP2Shell? Every Server I Checked Still Had This Turned On](https://carthacker.com/hosting/php2shell-cve-2026-115560/) October 23, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![Six terminal windows on client servers, each running php-fpm8.3 -i piped to grep session.upload_progress.enabled, and each printing session.upload_progress.enabled => On => On](https://carthacker.com/wp-content/uploads/php2shell-cve-2026-115560-featured.jpg)](https://carthacker.com/hosting/php2shell-cve-2026-115560/) Every server I had patched for PHP2Shell still had session upload progress on, the one setting PHP's new CVE-2026-115560 advisory asks you to turn off. [Hosting & Security](https://carthacker.com/category/hosting/) ## [Patching PHP2Shell on 8 Servers: What php -v Won't Tell You](https://carthacker.com/hosting/php2shell-cve-2026-109618/) October 22, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![A terminal on a patched Ubuntu server: php -v prints PHP 8.3.6 built Oct 19 2026, dpkg-query prints the package version 8.3.6-0ubuntu0.24.04.13, and zgrep counts 2 mentions of CVE-2026-109618 in the php8.3 changelog](https://carthacker.com/wp-content/uploads/php2shell-patched-php-v-still-8-3-6.png)](https://carthacker.com/hosting/php2shell-cve-2026-109618/) The PHP2Shell fix is in, but php -v won't show it on Ubuntu. How I checked, patched and restarted eight servers, and the reboot that took a mail server down. [Hosting & Security](https://carthacker.com/category/hosting/) ## [WooCommerce Hosting: Why the Expensive Hosts Aren't the Fast Ones](https://carthacker.com/hosting/woocommerce-hosting/) September 1, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![Bar chart of the share of sites on each host that gave phones a good server response in August 2026: WordPress.com 51.7%, WordPress VIP 50.0%, Pantheon 48.6%, Cloudways 31.8%, WP Engine 31.2%, Hostinger 30.4%, DreamHost 25.6%, WordPress overall 23.5%, SiteGround 21.6%, Bluehost 21.6%, Kinsta 21.3%, WooCommerce overall 12.7%, Flywheel 9.7%](https://carthacker.com/wp-content/uploads/woocommerce-hosting-server-response.png)](https://carthacker.com/hosting/woocommerce-hosting/) In Google's own data, pricey managed hosts such as Kinsta and Flywheel answer phones in time less often than cheap shared hosting, because WooCommerce speed comes from a cache, cores and distance. [Hosting & Security](https://carthacker.com/category/hosting/) ## [Why WooCommerce Is Slow: 924 ms to Build a Page, 27 ms to Serve It](https://carthacker.com/hosting/woocommerce-slow/) August 27, 2026, by [Adrian Wadowski](https://carthacker.com/author/adrian/) [![Bar chart of the server time for one WooCommerce product page on one CPU core: no OPcache 473 ms, OPcache on 100 ms, Redis with the Predis client 105 ms, Redis with the PhpRedis client 103 ms, Cache Enabler page cache 1.7 ms, nginx server page cache 1.1 ms](https://carthacker.com/wp-content/uploads/woocommerce-server-time-by-setup.png)](https://carthacker.com/hosting/woocommerce-slow/) A real WooCommerce store needs 924 ms to build a product page and serves it in 27, so the slow part is whoever falls through the cache, measured layer by layer on a 600-product test store. [Hosting & Security](https://carthacker.com/category/hosting/) --- Source: [WordPress Hosting, nginx and Security Guides for Stores](https://carthacker.com/category/hosting/), CartHacker. ## Free tools from CartHacker - [Store Speed Test](https://carthacker.com/store-speed-test/): Find the apps that slow your product page down. - [Core Web Vitals Monitoring](https://carthacker.com/plugins/core-web-vitals-monitoring/): Monitor your store's Core Web Vitals every day, for free. - [Trust Seals & Badges](https://carthacker.com/trust-badges/): Show shoppers it's safe to buy, right under Add to cart. - [QR Code Generator](https://carthacker.com/qr-code-generator/): Make a QR code you can still change after printing. - [PDF Tools](https://carthacker.com/pdf-tools/): Free online PDF tools that run in your browser: merge, split, convert, sign and protect PDFs. 39 tools, no upload, no watermark, no sign-up. - [CartHacker Premium](https://carthacker.com/premium/): one subscription, monthly or yearly, that upgrades every tool at once: - 50 trust badges in 30 languages, switched automatically - 180 days of Core Web Vitals, per page - All 39 PDF tools, unlimited and never uploaded - 200 QR codes, tracked and editable after printing - No ads on any guide or tool - Every new guide 2 weeks before the public - Product Feed Manager and new tools included - Every quota and price, tool by tool: https://carthacker.com/llms.txt