Wordpress Cloud Hosting

Scalable Wordpress Cloud Hosting on Managed Amazon Web Services solutions; including monitoring, support SLA, maintenance, and backups.


  • Optimised Managed Hosting Stack built on AWS
  • Experienced Wordpress Hosting provider since 2008
  • High Availability scalable hosting platforms
  • AWS best practice solutions
  • 24/7 solution monitoring
  • Dedicated support phone number and email
  • Automated provisioning for fast deployment
  • 99.99% availability SLA
  • Data stored in UK as standard
  • Offices in Manchester, London and Lancaster


  • UK Based Support Team
  • Fully managed infrastructure lets you focus on development
  • 24/7 365 monitoring
  • Easy to reach by phone or email
  • AWS certifications in the team
  • Multiple data migration methods and tools
  • Fully managed service to reduce client staff overheads
  • Unlimited technical support by LPI trained team
  • Provide application level support as part of managed hosting contract
  • Wordpress toolkit integration to control panel available


£450 an instance

  • Education pricing available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 12

Service ID

5 9 7 5 5 4 8 6 2 2 3 1 3 2 7


Nublue Tom Ashworth
Telephone: 0800 033 7074

Service scope

Service constraints
Hosting will be configured for any solution requirements, provided that it requires a Linux (preferably Ubuntu or CentOS) environment.

Planned maintenance will be agreed in advance and any required downtime will be scheduled with timescales to suit both parties.
System requirements
  • Linux environment
  • Ubuntu
  • CentOS

User support

Email or online ticketing support
Email or online ticketing
Support response times
Monday to Friday - 9-5 - 1 business hour
Saturday, Sunday, Public Holidays - 9-5 - 3 business hours
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), 7 days a week
Web chat support
Web chat
Web chat support availability
9 to 5 (UK time), 7 days a week
Web chat support accessibility standard
WCAG 2.1 A
Web chat accessibility testing
Onsite support
Yes, at extra cost
Support levels
We only provide fully managed solutions so there are no tiers of support to provide apart from these. Any costs associated with the support required and provided will be included in the cost of the solution itself. Support is triaged by our support team and directed to the appropriate teams for resolution. Specific account managers can be assigned if required for your needs as part of your agreement.
Support available to third parties

Onboarding and offboarding

Getting started
This is highly dependant on the needs of the user and will be discussed on a case by case basis. Simple management and access tasks would be covered on initial sign up. More complicated queries would be handled via the support team upon request. Scheduled meetings for discussion, planning or training are also encouraged. Documentation is provided again for simpler tasks, but can also be developed depending upon individual client needs.
Service documentation
Documentation formats
  • PDF
  • Other
Other documentation formats
  • Google Docs or Microsoft Word
  • Informational Guides on our website
End-of-contract data extraction
This depends entirely upon the needs of the user. Access can be provided to extract data themselves, or we can provide copies of the data according to client requirements if that is preferred. We do not attempt to hold client data at the end of a contract and will always work as far as possible to accommodate the needs of a user to obtain their data.
End-of-contract process
The contract includes any agreed services for a defined period of time. At the end of the contract, all services included in the contract are deactivated and decommissioned. Any extension to these dates would be agreed in advance and require an additional cost to complete. Any data required by the customer from the solutions before the services have terminated will be co-ordinated and enabled as required before the end of the contract.

Using the service

Web browser interface
Using the web interface
If required a Plesk control panel can be set up to allow users to manage their hosting through a web interface. This would allow them to perform basic hosting administration, such as (but not limited to) creating webspace for domains; administering settings, configuration, and environment per-domain; managing and creating databases; managing and creating on-demand backups; managing email setups. This control panel also includes an optional Wordpress management toolkit to help keep sites up to date, and perform simple maintenance tasks such as additional backups.
Web interface accessibility standard
WCAG 2.1 A
Web interface accessibility testing
Command line interface
Command line interface compatibility
Linux or Unix
Using the command line interface
Command line access can be provided depending upon the needs of the client, for instance to allow operation of Git or to run shell commands. Root access to solutions is not provided as this is a managed service.


Scaling available
Scaling type
  • Automatic
  • Manual
Independence of resources
Each instance is provisioned independently through Amazon Web Services.
Usage notifications
Usage reporting
  • Email
  • Other


Infrastructure or application metrics


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Amazon, Plesk, Cloudflare, Fastly, Sucuri, Litespeed, R1soft, eNom, Nominet

Staff security

Staff security clearance
Staff screening not performed
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Backup and recovery

Backup and recovery
What’s backed up
  • Full solution backup via Amazon Snapshots
  • Granular backups on or off server of database(s)
  • Granular backups on or off solution of files
  • Backups on or off solution of email
  • Wordpress backups via optional control panel toolkit
Backup controls
Users cannot control high-level backup schedules. Changes to the schedule provided are possible upon request and may result in an additional cost depending upon the request.

Users can make on-demand backups on the solution itself if a hosting control panel is provided as part of the solution. These backups utilise disk space within the solution and so an upgrade to available resources to accommodate this may be required.
Datacentre setup
Multiple datacentres with disaster recovery
Scheduling backups
Supplier controls the whole backup schedule
Backup recovery
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Service operates consistently, 24 hours a day, 7 days a week. Availability for support for issues not covered by our 24/7 monitoring operates as per support hours detailed under the User Support section. Ability to contact support outside of hours for critical issues can be included for a cost as part of the agreement. SLAs and agreements for any refunds due would be discussed as part of any solution contract depending on the requirements and budget of the client.
Approach to resilience
Hosting is provided by Amazon Web Services, however, alternatives are available if required. Our unique implementation details are available upon request.
Outage reporting
We report service outages via multiple channels to nominated stakeholders. (Typically The Product Owner) Automated notifications - Monitoring alert - JIRA alert - Email - Text Manual notification - Call - Online chat

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
We can operate a detailed hierarchy of access permissions. Your hosting is 'self managed', allowing a superuser to manage others permissions. By default access to Nublue Ltd systems are restricted to private company IPs via VPN and root/superuser access is restricted to Nublue Ltd usage only.
Access restriction testing frequency
At least once a year
Management access authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Devices users manage the service through
Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information
You control when users can access audit information
How long user audit data is stored for
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
ISO/IEC 27001
Information security policies and processes
Nublue Ltd is part of the CTI Holdings Ltd group. Under this group, the CTI Digital Information Services Team (IST) has been established to manage information services within the organisation, chaired by a Technical Director or Director. The IST is made up of appropriate senior organisational managers. It exists, in part, to: Ensure that Nublue Ltd and its staff and students meet the requirements of extant UK legislation and regulations in relation to Information Security; Ensure that there is clear direction and visible management support for security initiatives within the organisation; Ensure that appropriate risk management assessments are resourced an undertaken; and Promote security through appropriate commitment and adequate resourcing.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Hosting is provided in a default configuration with restricted access. Changes to configuration are performed by Nublue in many cases, allowing us to control and manage updates. Significant required updates are planned in advance and scheduled with the client. Major updates are tested across an evolving suite of environments for safety before deployment.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
We automate patch deployment in a staged manner across our infrastructure. We keep platforms as uniform as possible in terms of underlying stack, so that we can halt updates/determine safety of the update process in a staged, safe manner. Emergency updates and patches will be applied out of hours where possible.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We utilise Naemon monitoring, as well as Twilio, Cerberus, Maldetect, Modsecurity, Fail2ban and New Relic. Service operates consistently: 24 hours a day, 7 days a week. Issues noted by our monitoring are acknowledged within 15 minutes and worked on immediately. Stopping the initial threat vector is prioritised, and we then work with the client for further remediation once this has been completed.
Incident management type
Supplier-defined controls
Incident management approach
Any issue discovered by our monitoring creates an issue, that alerts our support team to a problem. This is then acknowledged and investigated. Out of hours alerts will escalate to the full team if not acknowledged in time. All issues are documented and reported, and reviewed the following morning if it occurs out of office hours. Clients will be contacted if there are further actions required; if actions were required from ourselves; or if there is a recurring issue.

Secure development

Approach to secure software development best practice
Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart

Energy efficiency

Energy-efficient datacentres
Description of energy efficient datacentres
We use Amazon Web Services - their policy can be found here -


£450 an instance
Discount for educational organisations
Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.