Patch every server, prove every site.

A server update is easy to run and hard to trust. The Orchestrator patches the whole fleet: the operating system, the web server, PHP and certificates. Then it checks what every site actually serves, and gives you a list per site.

Join the waiting list See a real job

For agencies and hosts that look after client servers. Set up for you, not handed over.

A server patch, in plain words.

You do not need to run servers to see why this is a pain. There are many sites on one server, and no easy way to know that every one of them took the fix.

A server has many parts to patch

The operating system, the web server, PHP and certificates all need their own updates. WordPress, Magento and Drupal all run on PHP. When a hole is found in any of them, its maker releases a fix.

An upgrade swaps the program

The server gets the new version and has to start using it. Do it badly and a site can break. Skip it and the hole stays open.

A version number is not proof

A server can report the new version while a running service still uses the old code. Some hosting panels fix the hole and keep the old number. Neither shows up in a version check.

Plan, approve, then prove every site.

The Orchestrator is the agent that does the work. A person on your team approves the plan before the server is touched.

  1. Brief it

    Name the server and the fix. The agent finds every service that runs PHP on the box, including any written by hand.

  2. Approve the plan

    It dry-runs the update first and reads everything it would install, replace or remove. You approve the plan, or change it.

  3. Measure before

    It records status and page size for every site, twice, so pages that change on every load do not read as failures.

  4. Patch, then prove

    It applies the update, restarts what needs it and checks every site again, from what each one serves.

You read the plan before the server is touched.

The plan lists each step, the risk and what gets checked. A PHP restart affects live sites, so the plan says so. You approve it, change it or reject it.

  • The risk is written in the plan
  • Every site is named in the checks
  • Nothing changes until you approve

What we check, and why.

Each check exists because a real update once looked fine without it.

What we checkWhy it matters
Status and page size for every site, twice before the changeSome pages change size on every load. In one round, 13 of 41 sites did, and a single reading would have shown 13 false failures.
The same checks after the changeA page that returns 200 at the same size is strong evidence it serves what it did before. A change in either one is flagged with the reason.
The PHP version each site is served byThe package manager and the server's command line can both report the new version while a site still runs the old one.
Every service that runs PHPAn update restarts the services it knows about. A service written by hand is missed.
One admin login page per platformAdmin pages break in ways the home page does not.

What you get, and what you can sell.

A patch you cannot show is hard to charge for. A list per site is not.

A list per site.

At the end of every round you get the result for each site, not a single green tick for the server. Send it to the client, or keep it for your own records.

  • Status and page size, before and after
  • The PHP version each site is served by
  • Every difference written down with its reason

A stop-gap when no fix exists yet.

On release day the fixed package does not always exist for your server. The agent can add a temporary setting that closes the hole in every PHP version on the box, reload each PHP service, and check through the live site, not the command line.

  • Undo is one file
  • Checked through the live pool, not the command line
  • The plan notes that a PHP version installed later will not carry it

Part of a maintenance retainer.

Patching sits alongside plugin and core updates and small client requests. See website maintenance

A real job: 25 customer sites on one server.

The update ran cleanly. The check is what found the part of it that had not worked.

The service that kept the old version.

The Acme client's server ran 25 customer sites in their own pools, under a service written by hand. After the update, the package manager and the command line both said 8.2.35. The standard PHP service had restarted. The hand-written one had not.

It was still serving 8.2.33 from memory. The per-site check read the version off what each site served, so it found it. The fix was restarting that one service.

Example based on a real job, details changed.

Nine servers in ten minutes, on one release.

On the day of another security release, no fixed package existed for any of them. The agent added the stop-gap setting to every PHP version on each box, reloaded each PHP service and checked through the live pool. Nine servers took ten minutes.

Example based on a real job, details changed.

Platforms it covers.

The server work and the sites on it. Counts are from our own delivery records, 29 October 2026.

Questions agencies ask about patching

  • Why is a version number not proof?

    Because a server can report the new version while a running service still serves the old code. Some hosting panels also fix the hole and keep the old number. So we read what each site actually serves.

  • Can it break a client site?

    Yes, as any update can. That is why we record status and page size for every site before and after, and why you approve the plan first. If something differs, you see it with the reason.

  • What is a PHP upgrade?

    It is replacing the PHP that runs your clients' sites with a newer version. A security update stays on the same line and fixes known holes. A move to a new major version is bigger and changes more, so it gets its own plan.

  • Can you patch before a fixed package exists?

    Sometimes. For some PHP flaws a temporary setting closes the gap until the real fix arrives. On one release we put it on nine servers in ten minutes. Undo is one file.

  • Does it work on cPanel servers?

    Yes. We have patched cPanel servers, where a fix can arrive without a new version number. That is one more reason we check what the sites serve.

  • How much does it cost?

    The Orchestrator is priced on a call, because setup depends on how many clients and platforms you bring. Join the waiting list and we will be in touch.

  • Something else on your mind?

    Ask us directly and a developer will reply.

    Ask a question

Show every client their server is patched.

Join the waiting list. When your place comes up, we will show you the Orchestrator proving a patch round on one of your own servers.

Join the waiting list See a real job