Run WordPress and WooCommerce on your own server: install guides for Ubuntu and Debian, nginx errors fixed one by one, caching, SSL certificates and the security patches to install first.
On one server Redis cut the cart's database queries from 116 to 17 and saved no time. With the database 2 ms away, the same plugin made the cart 205 ms faster, and a full Redis broke the whole store.
Media > Add New said the limit was 2 MB while nginx refused a 1.5 MB photo, and each of the four upload limits between a file and a store gave me its own misleading message.
The 502 page looked the same all six times I broke my test store, but nginx's error log wrote a different line for each cause, and that line shows which fix you need.
Both attacks came through a channel a plugin keeps open to someone else's server, and for SEO tags and backups a 230-line mu-plugin and a cron script do the job with that channel closed.
Every server I had patched for PHP2Shell still had session upload progress on, the one setting PHP's new CVE-2026-115560 advisory asks you to turn off.
The PHP2Shell fix is in, but php -v won't show it on Ubuntu. How I checked, patched and restarted eight servers, and the reboot that took a mail server down.
In Google's own data, pricey managed hosts such as Kinsta and Flywheel answer phones in time less often than cheap shared hosting, because WooCommerce speed comes from a cache, cores and distance.
A real WooCommerce store needs 924 ms to build a product page and serves it in 27, so the slow part is whoever falls through the cache, measured layer by layer on a 600-product test store.