Scalable WordPress on AWS, Azure, or Google

One question that frequently comes up when people compare WordPress VIP to other solutions is why would you choose VIP instead of hosting your own scalable WordPress install on one of the major cloud providers? 

WordPress can be installed and hosted on Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP). However, for most organizations, this will be more expensive, both in terms of the hosting infrastructure required and the need for additional people dedicated to management and support.

Business considerations when choosing between cloud providers and WordPress VIP

One of the biggest differences between hosting with WordPress VIP and cloud providers like AWS, Azure, and GCP is price. We offer predictable pricing based on unique visitors per month, regardless of the infrastructure we require to support those visitors. Enterprise cloud providers require you to design and build your own infrastructure, which becomes more expensive the more visitors you have.

Hosting and infrastructure

One key area where cloud providers get more expensive quickly is in hosting and infrastructure costs. When your website gets a huge burst of traffic due to breaking a news story or receives seasonal increases due to annual events like tax season, you need infrastructure in place to support that traffic increase. 

WordPress VIP includes features to help you scale in the moments of peak traffic without any intervention on your part. Cloud providers require your team to design the infrastructure required to support traffic bursts and turn on and off extra resources when needed.

WordPress VIP also keeps core WordPress up-to-date when software updates are released. AWS, Azure, and GCP require you to staff your own team of people to make these updates.

Customer support and SLAs

Our VIP support team is available to help you 24/7 if critical issues arise. Cloud service providers will support outages of their products, but you are required to staff your team with experts who can troubleshoot your specific configuration and any WordPress issues that come up as part of your system design.

Performance and operations considerations

We already hinted at some of the key considerations that impact your hosting and infrastructure. Below are some of the key areas where you will need to choose between. The general tradeoff is between focusing on content and adding additional expertise to support the infrastructure that hosts the content.

Integrations

WordPress VIP supports REST and GraphQL APIs out of the box. This allows you to easily integrate with other third party apps without hosting them yourself. Cloud service providers will expect you to add additional infrastructure like compute, database, and storage, for any additional features you want to add via a third party.

Reliability and scalability through horizontal and vertical scaling

WordPress VIP is designed to scale both vertically and horizontally as your website traffic increases. A cloud service provider will expect you to add more compute as you need it and manage the resources that host your database. We handle that scaling automatically as part of the VIP service. 

Azure, AWS, and GCP expect you to understand the load balancing and content delivery network functionality required for your website traffic. This capability is included in the WordPress VIP offering with no configuration required by you.

Caching of objects, pages, and queries is also part of WordPress VIP. A cloud service provider requires additional configuration to support caching and you will need to maintain that configuration.

Search

WordPress includes search functionality out-of-the-box, but it is fairly limited for the volume of content found on most media and government websites. Adding enterprise search to WordPress VIP is as simple as turning it on for your account. Adding enterprise search functionality for cloud service provider hosted WordPress requires custom code built by your team or a third party vendor.

Monitoring tools

WordPress VIP includes tools in a dashboard that make it easy to monitor what’s happening with your website. While cloud service providers include monitoring tools, the burden rests with your team to define what needs to be monitored in order to understand whether things are running smoothly or not.

DDoS prevention

Cloud service providers offer platform-level features that make it possible to do things like rate limiting, throttling, and IP restrictions to reduce the potential for malicious attacks. This is another case where AWS, Azure, and GCP expect you to build this capability into your infrastructure in order to take advantage of it. With WordPress VIP, all of these protections are available out of the box.

Security and compliance considerations

Security and compliance are both key considerations in deciding where to host your website. WordPress VIP offers security by design and is currently the only FedRAMP-authorized WordPress platform. AWS, Azure, and GCP expect you to implement security solutions by building what you need on top of their infrastructure.

Security by design

When it comes to security, cloud service providers put the burden on your team to decide how to protect your website. With WordPress VIP, we handle the security so that you can focus on content.

Software supply chain

Vulnerability scanning and reporting are built into WordPress VIP to give you peace of mind. Cloud service providers expect you to manage this functionality on your own, requiring additional software and expertise to manage it.

Network

Firewall protection is a standard part of WordPress VIP. Cloud service providers offer the ability to add firewall protection if you want it. 

Host

Cloud service providers expect you to harden the operating system and server configuration for your individual hosting use case. WordPress VIP secures the OS and servers underlying our service to protect you from vulnerabilities.

Application and file system

Our read-only file system, in combination with the rest of our secure-by-design implementation, protects against common data security and web application vulnerabilities. Cloud providers place the responsibility for application security on your team.

Encryption

Encryption both at-rest and in-transit maintains data confidentiality throughout WordPress VIP. Here again, a cloud provider requires you to set this up yourself.

Audit logging and user activity monitoring

Knowing who accessed a system is key to complying with regulations and provides an audit trail when things go wrong. WordPress VIP can monitor users across environments for a clear picture of all activity. Monitoring for user activity also provides for proactive deactivation of inactive users. Cloud providers require you to create your own audit and activity monitoring process. 

Security scanning

Automated code scanning and limiting included with VIP prevents both unintentional and malicious code changes from impacting your website. Cloud providers expect you to create and execute your own security scanning plan.

Government specific considerations

Most of the features discussed here are specific to all websites. But there are also some security and compliance considerations unique to the government sector:

Governance, risk, and compliance

WordPress VIP is FedRAMP authorized, demonstrating our adherence to government standards and regulations. While Google Cloud, AWS, and Azure are all FedRAMP authorized, they don’t offer an enterprise grade FedRamp authorized WordPress configuration. When a government organization builds out a WordPress website on a cloud provider, that organization is responsible for the specific configuration and whether or not it complies.

Accessibility

With WCAP 2.0 AA compliance, including Section 508, WordPress VIP offers inclusive design for website visitors, publishers, and builders with disabilities. Cloud service providers do not consistently meet accessibility guidelines across individual products within their offerings.

Recurring third-party compliance review

Our hosting services undergo annual penetration testing, accessibility reviews, and required FedRAMP review to maintain compliance with government standards. Building a website with a cloud provider will require passing these reviews based on your own unique configuration.

Final verdict on cloud service providers vs. WordPress VIP

WordPress VIP and cloud service providers like AWS, Azure, and GCP serve different website hosting needs. WordPress VIP provides you with the tools your team needs to focus on publishing content, without burdening you with staffing to support the underlying infrastructure. 

We maintain the underlying software and handle security. We also allow you to scale predictably as your website visitors increase without the surprise of a massive hosting bill.

Cloud service providers like AWS, Azure, and GCP give you infinite choice around how you build out the infrastructure for your website. With these choices comes the responsibility for maintaining all aspects of your website, from the servers used for hosting, to the software patch cycle required for maintenance and security, to the individual features required to scale when traffic increases.

Key takeaways

Cloud service providers have their place. If you have an engineering team dedicated to building and maintaining cloud infrastructure for other parts of your organization, you may already be staffed with the right expertise to build and host your WordPress website. 

But the right team isn’t the only consideration. It’s also important to consider whether that team has the bandwidth to take on an additional project and if they will dedicate the resources to provide you with the level of support you need. Cost becomes a factor when you need to scale up additional cloud services to handle increased load during peak traffic times.

With WordPress VIP you get a team of experts dedicated to making sure our infrastructure can handle all the traffic your website gets, while keeping your website secure and compliant with any laws and regulations you’re expected to follow. Our pricing model is predictable with every new website visitor. You can focus on the content for your users and deploy the budget required to maintain separate infrastructure toward other projects.