WooCommerce management
with full hosting and plugin control.

WooCommerce is a PHP application with MariaDB/MySQL — performance depends 60–70 % on the server setup, not on plugins.

Our standard stack:

• PHP 8.3 with OPcache + JIT
• Nginx or LiteSpeed web server with page cache
• Redis as object cache — massively offloads the database on recurring queries
• MariaDB with InnoDB tuning matched to server RAM
• HTTP/3, Brotli, image CDN (Bunny, Cloudflare) for static assets

For larger shops additionally:

• Database read replicas
• Split frontend load (FrankenPHP / Caddy)
• Separate cron worker for long WooCommerce background tasks

For hosting we offer three paths — all in Frankfurt, EU data processing as the technical prerequisite for GDPR-compliant operation:

• Hetzner Cloud / Hetzner Dedicated, admin-managed by us — best performance per euro, maximum customisation freedom
• Fly.io Frankfurt with container setup — good for shops with bursty traffic profiles or multilingual geo-routing requirements
• Raidboxes managed WordPress — if you prefer to hand hosting ownership to a specialist, we run performance and plugin optimisation on top

WordPress core and WooCommerce core are updated every few weeks — critical security patches sometimes ad hoc.

Our standard process:

• Update first on staging — clone of production
• Automated smoke tests — product view, cart, checkout, login
• Manual clicks through the most important backend areas
• Only on a green staging test deploy to production
• Database backup taken right before the update as a safety net

For major versions (e.g. WooCommerce 9 → 10) we check in advance:

• Plugin compatibility notes
• Custom code hooks
• Deprecated functions

If a plugin or custom code needs adjustment, we do this in the hour quota or as a separate fixed-price package.

We give no guarantee that every update runs frictionless — that depends too much on the plugin stack and custom code we haven’t all written ourselves — but we take responsibility if an insufficiently checked update on our side causes a production bug.

Standard in DACH mid-market: a grown WooCommerce shop has 50–80 active plugins, many of them free versions with premium-upsell loops, some not updated in years, others duplicated (two cache plugins, three image optimisers, four SEO plugins).

Quarterly we walk through the plugin stack:

• Which plugin vendor maintains actively?
• Which had security issues in the last 12 months?
• Which function is actually still used, which comes from a project 4 years ago?

Consequences:

• Weak free plugins are replaced with licensed premium alternatives — typically: WP Rocket instead of 3 cache plugins, ACF Pro for custom fields, RankMath/Yoast premium for SEO, WooCommerce Subscriptions / Bookings only where actually used
• Plugins with weak maintenance are replaced or superseded by custom code in a mini-plugin we maintain ourselves
• Unused plugins are deactivated and removed after a 30-day observation

Result after 6–12 months: typically 30–50 % fewer active plugins, a clearly documented stack with ownership per plugin.

Standard setup for WooCommerce tracking:

• GA4 via Google Tag Manager
• Consent Mode v2 for GDPR-compliant pre-consent behaviour
• Cookie banner via Borlabs Cookie or Complianz
• Server-side tagging optional — own GTM container on Stape, Fly.io or Hetzner

For performance-marketing tracking — as a server-side path instead of just a browser pixel, significantly improves data quality (especially after iOS privacy updates):

• Meta Conversion API
• TikTok Events API
• Pinterest Conversion API

Critical and frequently misimplemented: enhanced e-commerce events mapped correctly — `view_item`, `add_to_cart`, `begin_checkout`, `purchase` with items array, coupons, shipping, tax. With standard plugin setups items are often missing or values are off. We set this up cleanly, validate with GA4 DebugView and Tag Assistant, and document the tag mapping.

GDPR disclaimer: we cleanly implement the technical prerequisites for GDPR-compliant tracking — the legally binding assessment (cookie-banner categories, IP-anonymisation rules, consent logging) must be done by your lawyer or data protection officer.

Standard backup setup:

• Daily off-site snapshots of the entire hosting environment (file system + database)
• Continuous WAL streams of the database for point-in-time recovery on larger shops
• Retention: 30 days daily, 12 months weekly, long-term quarterly snapshots in a separate storage region
• Restore test once per quarter — we actively verify that backups are really recoverable, instead of relying on a "backups run daily" tick

Security hardening:

• WordPress XML-RPC disabled by default (except when demonstrably needed)
• Login brute-force protection with 2FA for admin accounts via WP 2FA or Wordfence
• Automatic blocking of suspicious IPs
• Web application firewall (Cloudflare WAF or ModSecurity rules)
• Regular vulnerability scans against the plugin stack via Patchstack or Wordfence

On security incidents:

• Immediate isolation
• Forensics — which file compromised, which entry path?
• Recovery from clean backup
• Post-mortem report

We don’t make a blanket "100 % secure" guarantee — no one can honestly do that — but we reduce the attack surface to a controllable minimum.

Within the retainer’s hour quota, typical operational shop adjustments are included:

• Theme tweaks — colour or typography updates from a brand refresh, header/footer changes, new landing-page templates
• Smaller custom functions in a mini-plugin we maintain — coupon rules, tax-logic adjustments for DACH, B2B-specific price logic, EAN/GTIN management on products
• Adjustments to WooCommerce emails — order confirmation with correct tax breakdown under DE/AT/CH law, shipping email templates
• Maintenance of shipping profiles, tax classes, payment methods

Larger custom development is scoped separately as fixed-price projects and may run in parallel to ongoing management:

• New configurator
• ERP interface
• New marketplace connection
• Multilingual B2B pricing

We don’t transform a shop into an architectural nightmare by squeezing heavy logic into `functions.php` "real quick" — custom code lives in standalone versioned plugins with clear ownership.