Security Baseline SSH hardening, firewall rules, fail2ban, TLS, headers, and dependency risk review. SSH keys only + disable root UFW/iptables policies Let’s Encrypt / TLS config
Performance Opcode cache, DB tuning, caching layers, gzip/brotli, queue workers, and CDN. PHP‑FPM/Nginx tuning MySQL/Postgres config Redis & object cache
Reliability Backups, restores, logs, health checks, and process supervision for uptime. Automated daily backups Logrotate & retention Systemd/pm2 supervision
Cost & Scale Right‑sized VMs, storage, and alerts to avoid surprise bills while staying fast. CPU/RAM sizing CDN/egress strategy Autoscale options
DevOps & CI/CD Zero‑downtime deploys, env secrets, staging, and rollbacks. Git‑based deployments .env secrets & rotation Blue/green basics
Policies Access control, least privilege, audit logs, and incident runbooks. RBAC & SSO (where possible) Audit & change history Runbooks & drills