Drupal hosting & managed services

Zoocha provides Drupal hosting on Linux only, standardising on Ubuntu 22.04 LTS and 24.04 LTS. Ubuntu LTS offers long-term security updates, predictable release cycles and a rock-solid base for performance tuning and compliance. The inclusion of the use of Ubuntu Pro, ensures security coverage for the maximum possible time.

Our web stack is fully hardened and Drupal-optimised, with CIS-aligned baselines, least-privilege access, and automated patching. We run the latest supported PHP (PHP-FPM with OPCache), tuned Nginx, HTTP/2 and HTTP/3, TLS best practice and Brotli/Gzip compression. Stack components such as MySQL/Aurora, Redis and Varnish are configured for Drupal workloads, including cache, session and connection tuning. We also support adjunct services like Solr, Elasticsearch and Typesense.

Linux gives us consistent environments from developer laptops to production, which reduces surprises and speeds releases. The platform is continually evolved through benchmarking, penetration tests and operational feedback, ensuring flexible architectures without proprietary lock-in.

AWS CloudWatch is our primary logging platform, capturing and correlating events across your stack. We ingest logs from Drupal, PHP-FPM, Nginx/Apache, MySQL or Aurora, Search (Solr, Elasticsearch or Typesense), Varnish, OS syslogs, ALB or ELB, CloudFront, WAF and GuardDuty. Metric filters, dashboards and alarms provide real-time visibility and faster troubleshooting.

For auditability, CloudTrail records user and API activity across your AWS accounts, supporting investigations and compliance reporting with defined retention policies and access controls. Application errors are tracked in Sentry.io, giving stack traces, release tags, user impact and alert routing to our service desk and on-call engineers.

Where required, we integrate with your SOC and SIEM, forwarding streams to platforms such as Splunk. PII-aware redaction, least-privilege access and tamper-evident storage support ISO-aligned governance and incident response.

Our pipelines are built around Git-based workflows with automated quality gates and predictable releases.

• CI with GitHub Actions and/or Jenkins for build, test, lint and security scanning (SAST/Dependency Audit)
• Pull request checks, required reviews and status gates before merging to main
• Immutable artefacts and image registries for reproducible deployments
• CD to AWS using Terraform plans and application deploy jobs, with environment promotion from dev to stage to production
• Blue/green or canary strategies, automated smoke tests and instant rollback
• Secrets handled via OIDC to AWS and least-privilege IAM
• Slack notifications, release tagging and deployment logs for full traceability

We build and manage hosting environments with an Everything as Code approach. Infrastructure is provisioned using Terraform with reusable modules, version control, peer review and automated plans to give predictable, repeatable builds and a full audit trail. Drift detection and state management help maintain consistency across development, testing, and production environments.

For configuration management, we use AWS Systems Manager, including Automation, State Manager and Session Manager, to apply baseline hardening, patching, inventory and runbook execution at scale. Parameters and secrets are managed via Parameter Store and AWS KMS, keeping credentials out of code. Server access is brokered through Systems Manager for tighter control and logging. Combined with CI/CD pipelines, this model enables rapid, low-risk changes, consistent compliance with ISO controls and fast recovery, while reducing manual steps and configuration drift.

We operate a complete monitoring suite that covers availability, performance, infrastructure and security, with real-time alerting and clear runbooks:

• External uptime and keyword checks using StatusCake and UptimeRobot for independent availability verification and keyword/content assertions
• Application Performance Monitoring with New Relic for transaction traces, error rates, slow queries, browser timings and synthetic tests
• Infrastructure and platform telemetry via AWS CloudWatch for CPU, memory, I/O, network, autoscaling and ELB/ALB health
• Security monitoring through AWS GuardDuty, WAF logs and managed antivirus on hosts, plus vulnerability scanning and alerts
• Centralised dashboards, alert routing and on-call escalation integrated with our ITIL service desk

Zoocha is a Cloudflare Agency partner, and its product offering is our preferred CDN (and has been for nearly a decade) for Drupal due to its blend of performance and security at a global scale. We leverage intelligent caching, HTTP/2 and HTTP/3, Argo Smart Routing, and lossless image optimisation with on-the-fly format conversion (e.g. WebP/AVIF) to accelerate page loads. 

Security is layered with managed WAF rules, robust DDoS mitigation, Bot Management, rate limiting and custom block rules. Turnstile helps reduce spam and abuse without user friction. 

Cloudflare integrates cleanly with Terraform for repeatable configuration-as-code, and supports advanced use cases with Page Rules, Transform Rules, Cache Reserve and Workers when needed.