Leadership asks for "a more reliable host" after three incidents this quarter. Engineering wants cloud migration in six weeks. Nobody listed where DNS points, who pays the domain expiring in forty days, or tested whether yesterday's backup actually restores.
Replacing a host without audit means moving undiagnosed problems by truck — and creating new ones: mis-tuned DNS TTL, broken MX mail, forgotten certificates. A proper audit first answers one simple question: what breaks, where, and is it really hosting?
Five layers to audit, in order
| Layer | Questions | Tools / evidence |
|---|---|---|
| Contract | SLA, exclusions, renewal, support | Contract PDF, past tickets |
| DNS & domains | TTL, MX, expirations, split DNS | whois, dig, registrar |
| Infra | Region, plan type, limits | Panel, invoice, traceroute |
| Application | Cache, queries, scheduled tasks | slow log, APM, EXPLAIN |
| Data | Backup, restore, retention | Timed restore test |
Migrating without validated Data layer is Russian roulette with production.
Performance: separate origin, database, CDN
Spend two hours on targeted diagnosis. First measure origin TTFB without CDN — direct IP request or bypass header. Record p95 latency on critical pages: login, checkout, search. Analyse slow query log over twenty-four hours and isolate the five costliest queries. Check PHP-FPM worker saturation at peak hours. Finally, calculate CDN hit ratio if a CDN is in place.
If origin TTFB stays under two hundred milliseconds but UX is slow, suspect heavy front end — JavaScript, unoptimised images. If TTFB exceeds one second with idle CPU, look at database or N+1 queries. If CPU hits one hundred percent on modest traffic, sizing or noisy shared neighbor comes into play.
See TTFB diagnostic and Missing MySQL index for these two frequent causes.
Security and access: the inventory nobody has
List panel and SSH accounts: who has access, is two-factor authentication enabled? Check OS, PHP, and TLS versions — end of life approaching? Verify automatic certificate renewal. Look for .env files or SQL backups on publicly reachable disk. Finally, document log retention and access under GDPR.
Ask the host for twelve-month incident history — not only theoretical SLA on the marketing page.
Backups: the deciding test
Backup audit is not brochure reading. First identify frequency, retention, and storage location — same account, encryption, region. Then restore to an isolated environment and time the operation. Verify integrity: user count, latest order recorded. Finally note what is not included: email, DNS, object storage.
Restore failure or duration over four hours is P0: migration or fix before any SEO or redesign work.
When to migrate vs optimize
| Finding | Usual action |
|---|---|
| Missing SQL indexes | Application fix and DBA work |
| No CDN for media | Object storage plus CDN |
| Shared saturated by neighbor | VPS same host |
| Documented SLA breach | Negotiate or migrate |
| Non-consented non-EU region | Compliance migration |
| Recurrent incompetent support | Migration |
The peak: audit serves decision — not pre-made decision
Migration has real cost — DNS, email, regressions, temporary double run. Audit makes it optional, or calm because evidence is documented.
Decide and move forward without blind spots
Build a full inventory — DNS, access, stacks — in a shared spreadsheet accessible to the whole team. Schedule a restore test this week, not "when we have time." Write a findings report classified P0–P3 with an owner per action. Identify thirty-day quick wins: cache, indexes, scheduled task alerts. Launch migration only if structural gaps are documented in writing. Compare alternatives via directory and compare tool, and see Audit a provider for the contractual angle.
Frequently asked questions
Where do you start a hosting audit?
Start with full inventory — domains, DNS, servers, databases, backups, access, contracts. Then measure TTFB, 5xx errors, and test real restore before judging brand. Without inventory, you confuse symptoms and causes.
How do you tell host vs code problems?
Compare idle CPU versus saturation, slow queries, origin versus CDN latency. Low CPU and slow site: suspect app or database. Saturated CPU on modest traffic: sizing or shared neighbor.
Must you migrate after an audit?
Only if contract/reality gap or product limits are structural. Else cache, SQL indexes, observable scheduled tasks, or plan upgrade often suffice — without brand change.
What documents to request from current host?
Contract, SLA, backup policy, DPA if personal data, twelve-month incidents, plan details — CPU, I/O, included support.
Auditing means measuring before moving — not picking the van before opening the attic.