Every layer of the stack, standardized.
The shared map of WordPress hosting infrastructure — 47 layers from the metal to the market, and the 254 products that fill them. Hosts declare their stacks against this taxonomy; market share is measured on it.
47 of 47 layers · the metal → the market
depth 1/6 · very bottom
The underlying servers WordPress sites run on. General-purpose clouds (Hetzner, Vultr, AWS…) appear here as infrastructure; providers that also operate WordPress hosting — like DigitalOcean via Cloudways — additionally have a host profile.
Switching cost. Infrastructure is the deepest layer and the hardest to move; everything above sits on it.
How metal is sliced and scheduled: the hypervisor carving servers into VPS and cloud instances, and the container orchestration that container-native hosts run instead. The panels that provision and resell those instances sit one layer up, in Shared & VPS Panel.
Switching cost. The deepest switch in the stack: moving hypervisor means requalifying images, tooling, and every automation above it. Broadcom's 2023 VMware acquisition reset cloud-service-provider licensing, which is why this layer moved for a lot of providers who had not planned to move.
The Linux distribution the fleet runs on.
Keeping tenants off each other on shared infrastructure — per-user filesystem jails, cGroup CPU and memory limits, and database governors that stop one account starving the rest of the node or reaching their neighbours' files.
Switching cost. Isolation is wired into account provisioning and the panel; swapping it means rebuilding how every tenant is created and limited.
Staying patched on software you have not upgraded — kernel patches applied live without rebooting, and security support for Linux and open-source components past their end-of-life.
Switching cost. Extended support buys time on an unupgraded base; the migration it defers only gets larger.
Operating-system and server-level protection on the hosting nodes themselves.
The engine serving requests — and one of the larger per-server license items in the incumbent stack.
The PHP version sites actually execute on — multi-version selection, and security support for versions past their community end-of-life. Roughly half the PHP on the web is EOL, so this layer is a choice between paying for extended support or upgrading sites off it.
Switching cost. Extended-support subscriptions keep EOL versions patched but do not move sites forward; the debt compounds with every release skipped. The route is decided by the OS: CloudLinux servers get hardened PHP in the distro, while cPanel's add-on is sold only to servers that are not on it — and TuxCare, a CloudLinux brand, supplies the patches either way.
The database engine every WordPress site reads and writes on every request — the load-bearing layer under the application, and the one hosts most often tune or fork for performance.
Switching cost. Engine choice is mostly compatible on the surface but replication, tooling, and version support diverge; migrations are dump-and-restore under load.
depth 2/6 · deep
Control panels purpose-built for operating managed WordPress hosting.
Panels that manage WordPress servers on any cloud — the agency and self-hoster control plane.
The control panel plus billing, provisioning, and customer management.
Switching cost. Billing + provisioning data is the stickiest operational layer to migrate.
The one-click installer that puts WordPress on the server — licensed per node and wired into the panel, it is how most shared and VPS customers create a site in the first place.
Switching cost. Installer choice follows the panel; migrating means re-provisioning every app entry customers installed through it.
Domain registration and reseller infrastructure — often the first touchpoint before hosting.
Customer mailboxes and outbound deliverability — consistently the riskiest piece of any migration.
Authoritative DNS serving for customer domains.
Issuing and renewing certificates for every domain on the fleet. Free ACME automation reset the economics here; the paid CAs still hold the OV/EV and warranty end.
Switching cost. ACME automation is portable; paid certificates are not, and multi-year prepaid inventory is the switching cost.
depth 3/6 · mid-stack
Protection running inside WordPress itself: malware scanning, login hardening, and firewall rules applied at the application level. Distinct from Edge Security, which filters traffic before it reaches the server, and from Virtual Patching, which shields known plugin vulnerabilities without touching their code.
Shielding known plugin and theme vulnerabilities without editing their code.
Malware removal and hacked-site cleanup after an incident.
Network-level filtering at the edge — WAF, bot blocking, and DDoS absorption before traffic ever reaches the origin server.
Global edge caching and content delivery for fast, distributed page loads.
Server-side caching and runtime acceleration — object caches, opcode caches, and HTTP accelerators that set the performance ceiling.
SpeedyCache· Softaculous
LiteSpeed Cache· LiteSpeed Technologies
NitroPack
FlyingPress
Perfmatters
Airlift· BlogVault
Jetpack· Automattic
Autoptimize
WP Fastest Cache
ShortPixel
Smush· WPMU DEV
Optimole· Themeisle
RabbitLoader
Uxify
WP Rocket· group.one
AccelerateWP· CloudLinux
W3 Total Cache· Newfold Digital- WP Super Cache· Automattic
- Imagify· group.one
Caching, optimization, and Core Web Vitals tooling.
Generating static versions of WordPress sites — shrinking the attack surface and the performance budget at the same time.
depth 4/6 · upper-mid
Automated off-server backups and one-click restores.
Plugin/theme updates, regression testing, rollbacks, white-label reports.
Switching cost. Maintenance is the highest-margin recurring upsell in hosting today.
Moving sites, databases, and accounts between hosts and panels.
Switching cost. Migration tooling is the single biggest determinant of how hard it is to leave a stack.
Spin up staging environments and sync changes to production.
Uptime monitoring, alerting, and status pages for the fleet.
Getting a site's own mail delivered — password resets, order receipts, form notifications. PHP mail() from a shared IP lands in spam, so hosts and site owners route through an authenticated relay instead. Distinct from the mailbox hosting in the Email layer.
Switching cost. Deliverability reputation builds on the sending domain and IP; switching relays resets warm-up and risks a spam-folder window.
depth 5/6 · high
AI-assisted site generation and AI agents for building and running WordPress sites.
Pre-built site templates and pattern libraries for fast launches.
Fast, flexible starter themes to launch sites on.
Visual page builders for designing WordPress sites.
Form builders for lead capture and workflows.
Spin up instant demo environments to show prospects a live site.
Visual feedback and client collaboration on WordPress sites.
The tooling developers build and run WordPress sites with.
depth 6/6 · tippy topProductized, recurring care plans — the highest-margin upsell in hosting.
White-label WP care, builds, and enterprise delivery.
Store platform plus checkout and funnel-conversion tooling.
Real-user session monitoring and AI-driven experience optimization — the top of the performance stack, where speed turns into revenue.
Site-level data that feeds hosting upsells and pro-services leads.
Resellable SEO tools and one-time SEO foundation services.