PHP hosting with automatic updates

fortrabbit is managed PHP hosting where the platform updates itself and the application does not. The operating system, the PHP runtime, the MySQL component, the TLS certificates and the backup service are maintained and patched by fortrabbit following upstream security advisories, with no maintenance window to book and no server to log into. PHP 8.1 through 8.5 are available, with 8.5 as the default for new environments; the major version is chosen per environment in the dashboard and switches in minutes, and patch releases within that version are applied by fortrabbit. What fortrabbit never updates is the software in the repository: Laravel, Craft CMS, WordPress, plugins and Composer dependencies stay at the version the developer deployed. That is deliberate. An unattended CMS update can break a site at night with nobody watching, and the developer who owns the code is the one who can test the upgrade on a staging environment first.

# Updates applied by fortrabbit

• Operating system and container images
• PHP runtime and its extensions, within the chosen major version
• MySQL component
• Apache, TLS certificates, the deploy service
• Backup service and object storage

# Updates applied by the developer

• Framework and CMS core: Laravel, Symfony, Craft CMS, WordPress, Statamic …
• Plugins, modules, themes
• Composer and npm dependencies
• The PHP major version, when the code is ready for it

The split is written down on the security page: we run the stack below the app, the developer owns the code on top. The reasoning for leaving application updates alone is on the no X page.

# PHP versions and end of life

An environment can stay on an older release while a dependency catches up, and move when the code is ready. The PHP component docs cover memory, processes and settings per plan.