Every WordPress site you run on InstaWP — a 10-second sandbox or a WooCommerce store doing real revenue — sits on infrastructure we build, tune and operate ourselves. This is a technical primer on exactly what that stack is, layer by layer, and what you get on each plan.
No marketing abstraction: the actual web servers, the actual cache, the actual edge, and the actual bill.
Table of Contents
The Stack, Layer by Layer
Here’s the path every request to your site takes:
Visitor → InstaCDN (global edge) → InstaShield (WAF / DDoS / bot) → Nginx (TLS 1.3, HTTP/2 & HTTP/3) → Apache 2.4 → PHP-FPM → Object Cache → MariaDB on NVMe SSD
Underneath it all is premium NVMe cloud compute with dedicated vCPU allocated per site plan — not oversubscribed shared hosting, and not a reseller account on somebody else’s platform.
1. Compute
Every page WordPress serves has to be built first. Themes load, plugins fire, queries run, and only then does HTML come out the other end.
WordPress builds a page in a single process, so what you feel is how fast one core can work, not how many there are. When we specced our new generation of servers, that is the number we optimized for.
What’s in a new-generation server
- CPU: 8-core AMD Zen 5
- Memory: 64 GB DDR5 ECC
- Storage: NVMe SSD on ZFS
ECC memory corrects single-bit errors in RAM instead of letting them quietly corrupt what is in flight. ZFS underneath means snapshots are cheap, which is what makes daily backups practical without a performance tax.
Same WordPress version, same plugins, same content, same software on both sides. We measured page generation on the server itself, so no network distance is involved. Median of 25 requests.
| What you’re doing | New generation | Previous generation |
|---|---|---|
| Loading the homepage | 49 ms | 83 ms |
| Loading a blog post | 49 ms | 81 ms |
| Running a site search | 46 ms | 78 ms |
| An AJAX request | 28 ms | 49 ms |
| Opening wp-admin | 39 ms | 67 ms |
| Opening the posts list | 40 ms | 67 ms |
| Opening the block editor | 76 ms | 127 ms |
| A REST API request | 2.7 ms | 3.7 ms |
Two honest notes on that table. This is generation time on the server. What a visitor experiences also includes network, images and third-party scripts. And our previous-generation servers carry more live sites than the new ones, so a small part of the gap is neighbour load rather than silicon. We quote what a site actually experiences on production hardware, not a lab number.
Check it yourself. The free WP Benchmark plugin from the WordPress repository scores our new generation 9.9 against 9.2 on the previous one. Same tool, same test, and you can run it on your own site.
Need more than this? These specs cover our standard production plans. Some workloads do not fit a standard plan, and for those we build to order: dedicated hardware up to 96 cores, with memory and NVMe sized to match.
High-volume stores, large catalogues, membership platforms carrying heavy logged-in traffic. Tell us the workload and we will spec the machine around it. Talk to us.
2. Edge — InstaCDN
The first thing a visitor’s request hits. InstaCDN (powered by Bunny’s edge network) caches and serves your site worldwide, so your assets are delivered from a location near your user instead of a round trip to your origin.
- Basic (Starter): 10 edge locations — fine for regional traffic and staging.
- Premium (Plus and above): the full global network — 120+ edge locations — with HTTP/3, instant purging, and custom edge rules.
- Bandwidth scales with your plan: 10 GB on Starter up to 200 GB on Elite.
Changing tier doesn’t touch your DNS. You upgrade, the edge coverage changes, your domain keeps working.
3. Security — InstaShield
InstaShield is a managed web application firewall that sits at the edge, in front of your origin. Threats are filtered before they ever reach your WordPress install — no security plugin to configure, no third-party WAF to wire up.
- Basic (Starter): core WAF rules based on the OWASP Top 10.
- Advanced (Plus and above): adds bot protection, Layer-7 DDoS mitigation, and vulnerability scanning.
Bot detection uses behavioural fingerprinting rather than blunt IP blocklists, so genuine visitors are verified transparently — no CAPTCHA walls, no false positives eating your conversions. Suspicious traffic is either challenged or banned at the edge.
4. Web Layer — Nginx + Apache
We run a hybrid, because picking one costs you something.
- Nginx out front: TLS 1.3 termination, HTTP/2 and HTTP/3, Brotli and GZIP compression, static asset delivery.
- Apache 2.4 (Event MPM) behind it: dynamic PHP via
proxy_fcgi, and full.htaccesssupport.
That .htaccess support is the point. A pure-Nginx host quietly breaks a long tail of WordPress plugins that rely on rewrite rules and redirects. You get Nginx’s speed at the front door without giving up the compatibility WordPress actually assumes.
5. PHP Runtime
- The PHP 8.x series, selected per site — not a global platform default you’re stuck with.
- OPcache is allocated per PHP worker.
- A php.ini editor in the dashboard: override
memory_limit,upload_max_filesize,max_execution_timeand the rest yourself. No support ticket. - Modules including imagick, redis, ionCube Loader, memcache, pdo_mysql, intl and curl.
6. Object Cache
Page caching only helps anonymous visitors. The moment someone logs in, adds to cart, or hits a dynamic dashboard, WordPress goes back to the database for every query it can’t remember.
An in-memory object cache (included from the Plus plan up) keeps those query results in RAM. That’s the single biggest win available to WooCommerce stores, LMS platforms, membership sites and anything with logged-in traffic — the exact workloads where a “fast” host usually stops being fast.
Caching and faster cores solve different halves of the same problem. Object cache spares WordPress the repeat database work. Faster cores speed up everything that still gets built from scratch: the editor, the dashboard, search, checkout. That is why the block editor opens in 76 ms on our new servers instead of 127 ms, and why the person building the site feels it all day.
7. Database & Storage — MariaDB on NVMe
MariaDB (drop-in compatible with MySQL) on NVMe SSDs. Slow database reads are the most common bottleneck in a WordPress site that “feels slow for no reason”, and NVMe plus a regional deployment is most of the fix.
Site Plans: What Each Tier Actually Gets
Plans are per site, not per account. A $5 brochure site can sit next to a $25 store in the same dashboard, each billed for what it is.
| Plan | Best for | CPU | Disk | CDN | Shield | Backups | Price |
|---|---|---|---|---|---|---|---|
| Sandbox | Dev & staging | 1 | 5 GB | – | – | Monthly | $2/mo · ~$0.07/day |
| Starter | Tiny sites & blogs | 2 | 10 GB | 10 GB Basic | Basic | Weekly | $5/mo · $0.17/day |
| Plus | Small, dynamic sites | 3 | 20 GB | 30 GB Premium | Advanced | Daily | $9/mo · $0.30/day |
| Pro | Medium sites | 4 | 35 GB | 75 GB Premium | Advanced | Daily | $15/mo · $0.50/day |
| Turbo | eCommerce | 6 | 50 GB | 125 GB Premium | Advanced | Daily | $25/mo · $0.83/day |
| Elite | High-traffic | 10 | 75 GB | 200 GB Premium | Advanced | Daily | $45/mo · $1.50/day |
Change a site’s tier on any day — up or down — and billing prorates from that day. No migration, no downtime, no lock-in.
Regions & PHP Workers
Pick your region at site creation and deploy close to your audience: United States, United Kingdom, Europe (Germany), Australia, and Singapore.
Each site gets dedicated PHP workers — a worker is one process handling one request at a time, with roughly 512 MB of memory each. Workers scale with your plan, so your site isn’t queuing behind a noisy neighbour on a shared pool. That concurrency is what carries a checkout page through a traffic spike.
The Whole Platform, On Every Tier
We don’t paywall the essentials. From a $2 sandbox to a $45 Elite site, you get the full developer toolkit:
- SSH, SFTP & WP-CLI — full shell access on every site, from the browser terminal or your own machine.
- Git, Composer & your tooling — deploy the way you already work, including GitHub Actions. Push triggers an atomic release: zero downtime, with rollback.
- One-click sandbox → production — build on a sandbox, promote it when it’s ready. No re-migration.
- Custom domains + free SSL — auto-provisioned, auto-renewed.
- .htaccess and php.ini — yours to edit.
- Live logs — tail them from the dashboard while you debug.
- Free migration in — self-serve, zero-downtime.
- Real human support — on every plan, typically under 2 minutes.
Built for AI Agents: InstaMCP + the InstaWP CLI
This is the part of the stack most hosts don’t have at all.
InstaMCP exposes WordPress over the Model Context Protocol, so an AI agent — Claude, or whatever you’re building with — can operate a real site directly: read and write content, inspect the database, manage plugins and themes, read logs, diagnose a fatal. Not a chatbot bolted onto an admin screen. Actual tool access to a real WordPress install, governed and scoped.
Pair it with the InstaWP CLI and the REST API and the whole platform becomes scriptable: spin up a disposable site, run a test suite against it, snapshot it, throw it away. That’s the loop AI-assisted development actually needs, and it’s why “10-second WordPress” matters far more now than it did when we started.
Available on every plan.
Beyond Hosting: Management, Images, Staging
InstaManage — site management (Plus and above)
Delivered through the InstaWP Connect plugin, pre-installed on your site:
- Uptime, SSL & performance monitoring: multi-region checks, response-time history, Core Web Vitals scores, plus email and Slack alerts when a site goes down.
- Vulnerability scanning — known CVEs in your plugins, themes and core, flagged before someone else finds them.
- Activity logs — who changed what, when.
- Scheduled & bulk updates, and one-click PDF client maintenance reports.
On Sandbox and Starter it’s a $2/mo add-on. Basic management of unlimited connected sites — including sites hosted elsewhere — is free.
InstaOptimizer — image optimization (Pro and above)
Automatic compression and modern formats (WebP / AVIF), delivered from the edge. No image plugin, no external image CDN, no extra bill.
Staging, snapshots & 2-way Sync
- Staging sites off any production site — test the risky change somewhere that isn’t live.
- Snapshots & templates ($1/mo each) — save a full site blueprint and relaunch it in one click. This is how agencies stop rebuilding the same starter site.
- 2-way Sync — push content and files between staging and production in either direction, instead of hand-merging.
Backups & restore
Automatic off-site backups with one-click restore of the whole site: monthly on Sandbox, weekly on Starter, daily on Plus and above. Restores land in the same region — nothing to reconfigure.
Billing: Daily, Per Site, Nothing Metered
The bill is the part most hosts make you guess at. Here it is in full.
- Each live site is billed daily, at its plan’s rate (midnight UTC). We total it across your sites and charge your card once a month.
- We do not meter traffic, CPU, RAM or bandwidth for billing. Your cost is the number of live sites and the tier each one is on. A traffic spike does not produce a surprise invoice.
- Cut a site’s cost any day by parking it as a $2 sandbox, or delete it to stop billing entirely. (Pausing alone keeps a site on its tier and still bills.)
- No setup fees, no cancellation fees, no annual prepay.
- $25 in free credits when you add a card — enough to run a Starter site for months before you pay anything.
A typical agency mix of ~10 client sites (5 × Starter + 3 × Plus + 2 × Turbo) runs about $102/mo.
Add-ons
Every production tier bundles the essentials. These are the genuine extras:
- Snapshots & Templates — $1/mo each (or $2 for an instant capture)
- Site management — $2/mo on Sandbox & Starter (free from Plus)
- 2-way Sync — usage-based
- White-label domain — $5/mo, run sites on your own branded domain instead of ours
Migrating In
Moving a site to InstaWP is free and zero-downtime, and it’s self-serve — our AI-assisted migration copies the site, verifies it, and lets you test the copy on a temporary URL before you touch DNS.
- Start a migration at migrate.instawp.com, or import from your existing host directly in the dashboard.
- Test the copy on its temporary InstaWP URL — plugins, checkout, the lot.
- Point your DNS, or use InstaWP’s free ALIAS record to cut over without touching nameservers.
- Decommission the old host once you’re happy.
Because you’re testing a copy before switching DNS, the whole thing is reversible. The only migration we charge for is moving a site off the platform — and you can always do that too.
Agencies: our Agency Program adds human-led migration help and cashback on migrated sites.
For Agencies: Resell the Whole Thing
Hosting is the one recurring cost in an agency stack you can flip into a profit centre. On InstaWP you can run client sites under your own branded domain, hand clients a white-labelled portal (WaaS), and keep the margin between what a site costs you and what you charge for it — while every site still gets the same CDN, WAF, backups and monitoring described above.
Wrapping Up
What you’re getting, in one list:
- Infrastructure we own and operate — a 120+ location edge, a managed WAF, NVMe, and dedicated workers per site.
- The full developer toolkit on every tier, including the $2 one.
- A platform an AI agent can actually drive, over MCP.
- A bill you can predict to the day.
InstaWP is backed by Automattic, and more than 120,000 developers and agencies have created over 2 million sites on it.
Ready to see the stack? Spin up a sandbox in under 10 seconds, then promote it to production when you’re happy — billed by the day, cancel by deleting.
FAQs
What happened to InstaWP Live / WP Cloud?
It was our old managed-hosting layer, running on a third-party platform. It’s legacy. Existing sites on it keep running, but all new sites are hosted on InstaWP’s own infrastructure — the stack described here. Nothing is being handed off to anyone.
How am I billed?
Per site, per day, at that site’s plan rate — totalled and charged monthly. Traffic, CPU, RAM and bandwidth are not metered for billing.
Do I still need Cloudflare?
No. InstaCDN and InstaShield already cover SSL, edge caching, WAF and DDoS protection. You can still use Cloudflare for DNS if you prefer.
Do I get object caching?
Yes, from the Plus plan up. It’s the biggest win for WooCommerce and any site with logged-in users.
Can I change plans later?
Any day, up or down, from the site dashboard. Billing prorates from that day. No migration, no downtime.
Is migration really free?
Migrating in is free and zero-downtime. The only migration we charge for is moving a site off the platform.
