PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchYes—you can run WordPress and a Node.js application on one VPS while hosting MySQL and MongoDB on the same machine. The practical design is to expose only Nginx on ports 80 and 443, send WordPress requests to PHP-FPM, proxy Node.js to a loopback port such as 127.0.0.1:3000, and keep both databases on local sockets or loopback. This is a sensible, low-overhead setup for modest traffic, but all five services share the VPS’s CPU, memory, storage and failure domain.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the one-VPS architecture looks like
A single VPS can host the complete stack if it is treated as a small server platform rather than as one large application. Nginx is the only service that needs public web access. It terminates HTTPS and selects the application by hostname or URL path:
As an Amazon Associate I earn from qualifying purchases.
- WordPress hostname: Nginx serves static files and passes PHP scripts to PHP-FPM.
- Node.js hostname or path: Nginx proxies HTTP and WebSocket traffic to a Node.js process listening on loopback.
- MySQL: WordPress connects through a local Unix socket or
127.0.0.1. - MongoDB: The Node.js application connects through
127.0.0.1; the database is not internet-facing. - Operations: systemd starts and restarts each application under its own non-root Unix account.
This arrangement avoids exposing database protocols, keeps the public attack surface small and lets one TLS configuration cover both applications. It also means a memory leak, disk failure, kernel problem or runaway backup can affect WordPress, Node.js, MySQL and MongoDB simultaneously.
When one VPS is appropriate—and when it is not
Good fit for a compact deployment
- A brochure site, small store or content site with moderate concurrent traffic.
- A Node.js API, dashboard or background service used by a limited audience.
- A development, staging or internal environment where operational simplicity matters more than fault isolation.
- A team comfortable patching the operating system, databases and application dependencies.
Signs you should split services
- WordPress and Node.js have unpredictable traffic spikes that compete for CPU or memory.
- MongoDB indexes or MySQL buffer pools require more memory than the host can provide while leaving room for PHP-FPM and Node.js.
- You need independent maintenance windows or must keep one application available while the other is upgraded.
- A database outage must not take down both applications.
- You require geographic redundancy, a formal recovery-time objective or a separate security boundary.
There is no universal RAM number that guarantees success. Sizing depends on traffic, plugin behavior, media volume, Node.js concurrency, MongoDB indexes, backup retention and the recovery time you can accept. Measure memory pressure, CPU saturation, disk latency and request latency before resizing or promising capacity.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Supported versions and prerequisites
Start with a currently supported 64-bit Ubuntu LTS release. WordPress’s requirements guidance, current in 2026, recommends PHP 8.3 or newer, MySQL 8.0 or newer or MariaDB 10.11 or newer, HTTPS, and either Apache or Nginx. Its advanced administration guidance, updated December 17, 2025, also expects shell or equivalent access. Do not reproduce an old tutorial that installs an end-of-life PHP or database version.
| Component | Baseline or choice | Important qualification |
|---|---|---|
| Operating system | Supported Ubuntu LTS, 64-bit | Keep the release within its security-maintenance period. |
| Web server | Nginx on TCP 80 and 443 | Use it as the public reverse proxy and TLS endpoint. |
| PHP | PHP 8.3 or newer | Install PHP-FPM and the extensions required by WordPress and its plugins. |
| SQL database | MySQL 8.0 or newer, or MariaDB 10.11 or newer | Keep the listener local unless a trusted private host must connect. |
| Node.js | A supported release line selected by the application | Pin the major version and record it in deployment notes. |
| MongoDB | MongoDB 8.0 packages for Ubuntu 20.04, 22.04 or 24.04 64-bit | Use MongoDB’s official mongodb-org repository and keep bindIp local. |
| Access | SSH, sudo, DNS and a domain for HTTPS | Prefer SSH keys and restrict SSH to trusted source addresses. |
Record the exact package versions after installation. A routine unattended upgrade should not silently move a production application to a new Node.js major version or an incompatible database release.
1. Provision and harden Ubuntu
- Create the VPS with a supported Ubuntu LTS image and a 64-bit architecture.
- Log in with the provider’s initial account, create a named administrator and grant sudo access. Disable direct root SSH login after confirming the new account works.
- Install updates and reboot if the kernel changed:
sudo apt update
sudo apt full-upgrade -y
sudo rebootAfter reconnecting, create separate service identities later for WordPress’s web process, the Node.js application and database administration. Do not run application code as root.
2. Configure the firewall before installing applications
Allow only administration and web traffic from the public internet. The following example uses UFW; adapt the SSH rule to your trusted address or VPN range rather than leaving SSH broadly reachable.
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseDo not open TCP 3306 or 27017. Local applications do not need those ports exposed, and a firewall rule is not a substitute for database authentication.
3. Install Nginx and PHP-FPM for WordPress
Install Nginx, PHP-FPM and common WordPress extensions from the Ubuntu repositories. The package names below are intentionally version-neutral; Ubuntu will select the PHP series provided by your supported release. Confirm that the selected series satisfies the PHP 8.3-or-newer WordPress baseline.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo apt update
sudo apt install -y nginx php-fpm php-mysql php-curl php-gd php-xml php-mbstring php-zip php-intl php-imagickCheck the installed PHP and FPM service:
php -v
systemctl list-units --type=service 'php*-fpm.service'
ls -l /run/php/The socket is commonly named /run/php/php8.3-fpm.sock on an Ubuntu release carrying PHP 8.3. Use the actual socket shown on your host in the Nginx configuration; do not assume the filename.
4. Install and prepare MySQL
Ubuntu documents the standard installation and systemd checks:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo apt install -y mysql-server
sudo systemctl enable --now mysql
sudo systemctl status mysqlRun the hardening flow and remove anonymous accounts, remote root access and the test database when prompted:
sudo mysql_secure_installationCreate a dedicated WordPress database and user. Use a long, unique password stored outside the web root. The example uses a database name and account that are not shared with Node.js.
Recommended Free Tools
sudo mysqlCREATE DATABASE wp_site CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wp_app'@'localhost' IDENTIFIED BY 'replace-with-a-long-random-password';
GRANT ALL PRIVILEGES ON wp_site.* TO 'wp_app'@'localhost';
FLUSH PRIVILEGES;
EXIT;The password text in this example is an instruction to replace it, not a credential to deploy. Store the real value in a password manager and in the WordPress configuration with restrictive permissions. Keep MySQL bound to its local socket or loopback interface unless a separate, trusted private host has a documented need to connect.
5. Install WordPress under a dedicated web root
Download the current WordPress package from WordPress.org, verify the archive according to the project’s published checks, and unpack it into a directory such as /var/www/wp-site. Keep each site in its own root rather than mixing it with the Node.js application’s source tree.
sudo mkdir -p /var/www/wp-site
sudo tar -xzf wordpress.tar.gz --strip-components=1 -C /var/www/wp-site
sudo chown -R root:root /var/www/wp-site
sudo mkdir -p /var/www/wp-site/wp-content/uploads
sudo chown -R www-data:www-data /var/www/wp-site/wp-contentIn a production policy that does not use dashboard-based automatic updates, keep the code owned by root and grant the web process write access only to directories that genuinely need it, such as uploads and selected cache locations. If you do permit dashboard updates, understand that a compromised WordPress process can modify more of the installation.
Create an Nginx server block for the WordPress hostname. The example uses wp.example.com and assumes the PHP socket discovered earlier:
server {
listen 80;
listen [::]:80;
server_name wp.example.com;
root /var/www/wp-site;
index index.php index.html;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
location ~* /.ht {
deny all;
}
}Enable the site, test the configuration and reload Nginx:
sudo ln -s /etc/nginx/sites-available/wp-site /etc/nginx/sites-enabled/wp-site
sudo nginx -t
sudo systemctl reload nginxPoint the DNS record at the VPS, obtain a certificate with an ACME-compatible client, and redirect HTTP to HTTPS. WordPress requires HTTPS in its current recommendations; verify that automatic certificate renewal succeeds rather than assuming the timer is working. Visit the HTTPS hostname and enter the database name, user and password created above. Set the site URL to the HTTPS address.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
6. Install Node.js without coupling it to WordPress
Choose a supported Node.js release line that your application declares, then pin that major version. Install it using the release method maintained for your Ubuntu environment and verify both binaries:
node --version
npm --versionNode.js is a cross-platform JavaScript runtime with non-blocking I/O suited to network and database work. Install the application outside the WordPress root, for example:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →sudo adduser --system --group --home /srv/node-app nodeapp
sudo mkdir -p /srv/node-app
sudo chown -R nodeapp:nodeapp /srv/node-appCopy the application source, install production dependencies and build it as the dedicated account. Keep secrets in a file readable only by that account:
sudo -u nodeapp -H sh -c 'cd /srv/node-app && npm ci --omit=dev'
sudo install -o nodeapp -g nodeapp -m 600 /dev/null /etc/node-app.envPlace values such as the MongoDB connection string, session secret and application environment in /etc/node-app.env. Never put that file beneath a public web root or commit it to source control.
7. Run Node.js with systemd on a private port
A systemd unit gives the Node.js process a defined working directory, a non-root identity, a restart policy and a controlled log destination. This example expects the application entry point at /srv/node-app/server.js and an application that honors PORT=3000 and HOST=127.0.0.1.
sudo tee /etc/systemd/system/node-app.service > /dev/null <<'EOF'
[Unit]
Description=Node.js application
After=network.target mongod.service
[Service]
Type=simple
User=nodeapp
Group=nodeapp
WorkingDirectory=/srv/node-app
EnvironmentFile=/etc/node-app.env
Environment=NODE_ENV=production
Environment=HOST=127.0.0.1
Environment=PORT=3000
ExecStart=/usr/bin/node /srv/node-app/server.js
Restart=on-failure
RestartSec=5
PrivateTmp=true
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now node-app
sudo systemctl status node-appConfirm the process is listening only on loopback:
sudo ss -ltnp | grep 3000
curl --fail http://127.0.0.1:3000/If the application listens on 0.0.0.0 despite the environment setting, change its framework configuration. Users should reach it through Nginx, not directly through port 3000.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Install MongoDB and keep it private
Use MongoDB Inc.’s official mongodb-org repository for the Ubuntu release rather than an obsolete distribution package. MongoDB’s 2026 Ubuntu guide lists Ubuntu 20.04, 22.04 and 24.04 64-bit releases as supported targets. Add the repository and signing key by following the instructions for the exact Ubuntu release, then install and enable the service:
sudo apt update
sudo apt install -y mongodb-org
sudo systemctl enable --now mongod
sudo systemctl status mongod
mongosh --eval 'db.runCommand({ connectionStatus: 1 })'MongoDB’s default bindIp is 127.0.0.1, which permits same-machine clients only. Check /etc/mongod.conf and retain that setting:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
net:
port: 27017
bindIp: 127.0.0.1Create an application user rather than allowing the Node.js process to connect anonymously. During initial setup, connect locally with mongosh, create an administrative user if your installation does not already have one, and then create a user limited to the application’s database:
Free tools Windows power users keep installed
One-click scans. No signup required.
use appdb
db.createUser({
user: "node_app",
pwd: "replace-with-a-long-random-password",
roles: [{ role: "readWrite", db: "appdb" }]
})Enable authorization in /etc/mongod.conf after an administrator exists:
security:
authorization: enabledsudo systemctl restart mongod
sudo journalctl -u mongod --since "10 minutes ago"MongoDB’s runtime documentation identifies net.bindIp and security.authorization as the controls that limit interfaces and require authorization. Never bind an unauthenticated MongoDB listener to a public address. If a later architecture adds a separate application host, bind only to a private interface, restrict the firewall to that source, enable authorization and use TLS where appropriate.
9. Put Nginx in front of Node.js
Add a second server block for the Node.js hostname. Nginx handles the public TLS connection and forwards the original host, client address and protocol. The WebSocket headers are harmless for ordinary HTTP and are required by frameworks that upgrade connections.
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 60s;
}
}sudo ln -s /etc/nginx/sites-available/node-app /etc/nginx/sites-enabled/node-app
sudo nginx -t
sudo systemctl reload nginxObtain and test HTTPS for this hostname as well. Configure the Node.js framework to trust the proxy only as appropriate; otherwise secure cookies, client IP logging or redirect logic can behave incorrectly.
10. Verify the complete request path
- DNS for both hostnames resolves to the VPS.
- Nginx passes
nginx -tand is active. - The WordPress HTTPS installer loads and can write uploads.
- PHP-FPM is running and the configured socket exists.
- The Node.js service is active and responds on
127.0.0.1:3000. - MongoDB accepts an authenticated local connection from the Node.js credentials.
- MySQL accepts the WordPress account but is not reachable from the public network.
- Only SSH, HTTP and HTTPS appear in the public firewall rules.
- Certificate renewal, service restarts and log rotation have been tested.
Capacity planning on a shared host
All services compete for the same memory and I/O. PHP-FPM worker processes multiply with concurrent WordPress requests; MySQL uses memory for buffer pools; Node.js uses heap and native buffers; MongoDB relies heavily on RAM for indexes and working data. A traffic surge or an unbounded worker setting can trigger the Linux out-of-memory killer.
Start conservatively
- Set a modest PHP-FPM worker count and increase it only after observing queueing and memory usage.
- Keep Node.js concurrency and in-process caches bounded; move large queues or caches out of process when they grow.
- Size MySQL and MongoDB caches with the other services in mind instead of assigning each database all available RAM.
- Watch disk latency and free space, not just CPU percentage. Database checkpoints, media uploads and backups can saturate storage.
- Use swap only as an emergency cushion. It can prevent an immediate crash but cannot replace physical RAM for sustained database workloads.
Record baseline memory, load average, request latency, database slow queries and disk utilization during normal traffic. Resize or split the services when those measurements show sustained contention rather than relying on a generic VPS-size recommendation.
Backups, upgrades and recovery
A snapshot of the root disk is not enough if it is stored on the same provider account or cannot be restored selectively. Back up the WordPress files, MySQL data, MongoDB data and the configuration that makes the services reproducible:
- WordPress uploads, themes, plugins and the generated configuration file.
- MySQL with a consistent logical dump or a storage-level method appropriate to your version.
- MongoDB with a method that preserves the databases and users you need to recover.
- Nginx server blocks, PHP-FPM overrides, systemd units, firewall rules and deployment notes.
Send backups to storage outside the VPS, encrypt them, define retention and perform a restore drill on a separate host. A backup that has never been restored is an assumption, not a recovery plan.
Patch Ubuntu, Nginx, PHP, WordPress, Node.js dependencies, MySQL and MongoDB on a planned schedule. Read release notes, test in staging where possible and keep a rollback path. Monitor service health, disk utilization, memory pressure, failed SSH logins, certificate expiry and backup freshness. Set log rotation limits so diagnostic logs cannot fill the disk.
Private database administration
When you need a GUI or command-line session from your workstation, use an SSH tunnel or a private network rather than opening database ports. A tunnel forwards a local port through an authenticated SSH session while MySQL or MongoDB remains bound to loopback. Remove temporary tunnels when finished, and never add a broad “allow from anywhere” firewall rule for convenience.
Alternatives to one VPS
| Option | Advantages | Costs and trade-offs |
|---|---|---|
| One VPS for everything | Lowest operational overhead, one host to secure, low internal latency and simple networking. | Shared CPU, RAM, storage and failure domain; one outage affects every service. |
| Separate application and database hosts | More resource headroom and better failure isolation; databases can be protected on a private network. | More patching, monitoring, network policy and recurring cost. |
| Managed database service | Provider-managed backups, upgrades, replication and monitoring can reduce database administration. | Ongoing service fees, network latency, vendor limits and less control over configuration. |
| Managed WordPress or application platform | Less server maintenance and often simpler deployment workflows. | Platform constraints, migration work and pricing tied to usage or features. |
Compare alternatives using failure isolation, available CPU and RAM, I/O headroom, backup and restore responsibility, patching effort, database exposure, scaling path, geographic latency, support and total monthly cost. MongoDB’s own documentation identifies hosted MongoDB as an option when installation and operations outweigh the value of local control.
Common failure modes and fixes
502 Bad Gateway from Nginx
Check that PHP-FPM or the Node.js systemd unit is active, that the configured PHP socket exists, and that the Node process is listening on 127.0.0.1:3000. Read /var/log/nginx/error.log and journalctl -u node-app for the precise failure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWordPress reports a database connection error
Verify the database name, account, password and host in the WordPress configuration. Test the same credentials locally with the MySQL client, then inspect MySQL service status and logs. Do not “fix” the error by exposing port 3306.
Node.js cannot connect to MongoDB
Confirm that mongod is running, bindIp is still loopback, the connection string names the right database, and authorization is enabled with a user that has the required role. Check the application environment file permissions and systemd logs.
Memory pressure or random restarts
Inspect memory and swap usage, PHP-FPM worker counts, Node.js heap behavior and MongoDB/MySQL cache settings. Reduce concurrency, stop nonessential jobs, add temporary swap only if necessary, and move a service to another host if pressure is persistent.
HTTPS works for one hostname but not the other
Check DNS, the Nginx server_name, certificate coverage and the HTTP-to-HTTPS redirect for each virtual host. Run the renewal command manually in a safe window and verify that the resulting certificate is served by Nginx.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Final production checklist
- Supported Ubuntu LTS and recorded package versions.
- SSH keys, restricted administration source and a tested sudo account.
- Public firewall rules limited to SSH, HTTP and HTTPS.
- Nginx serving both hostnames with valid HTTPS certificates.
- WordPress on PHP-FPM with the current PHP and database baseline.
- MySQL local-only, hardened and limited to a dedicated WordPress account.
- Node.js running as a non-root systemd service on loopback.
- MongoDB local-only with authorization enabled and an application-specific user.
- Secrets outside web roots with restrictive permissions.
- Off-server backups for files, both databases and service configuration.
- Restore drill, patch schedule, monitoring, log rotation and certificate-renewal test completed.
With those controls in place, one VPS is a coherent deployment for modest workloads: Nginx is public, PHP-FPM serves WordPress, Node.js stays behind the reverse proxy, and both databases remain private. Move to separate hosts or managed services when measured resource contention, recovery requirements or failure isolation justify the added complexity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
