Managed Hosting vs Self-Hosting: Who Handles Critical PHP Security Updates?

Eva Wong

IceWhale author

Eva Wong is the Technical Writer and resident tinkerer at ZimaSpace. A lifelong geek with a passion for homelabs and open-source software, she specializes in translating complex technical concepts into accessible, hands-on guides. Eva believes that self-hosting should be fun, not intimidating. Through her tutorials, she empowers the community to demystify hardware setups, from building their first NAS to mastering Docker containers.

Conceptual guide: WHO OWNS THE PATCH?. Provider scope; Your obligations; Verified outcome.

Choose managed hosting when a provider explicitly covers the runtime maintenance and response work you need. Choose self-hosting when local control is valuable and you can maintain the services or arrange competent support. Neither choice eliminates application ownership.

Choose based on who can reliably maintain the runtime, deploy supported fixes, and verify recovery. Managed hosting only covers the responsibilities included in its service terms; self-hosting leaves those operational decisions with you or the administrator you appoint.

Compare responsibilities before comparing fees

Task	Managed service: verify scope	Self-hosted service: assign owner
Host and runtime patching	May be included; request exact boundaries	Operator or contracted administrator
Custom app and plugin updates	Often separate from platform upkeep	Application owner
Backups and restoration	Confirm coverage, retention, and restore process	Design and test the complete recovery path
Emergency access restriction	Confirm authority and response channel	Operator controls network routes
Compromise investigation	May require another support service	Operator coordinates investigation

These are questions to ask, not promises about every hosting plan. A managed virtual machine, a managed application, and an unmanaged VPS can place very different obligations on the customer.

Five questions for a provider

Which PHP installations and customer-built containers do you patch?
How do you handle unsupported branches and incompatible applications?
What evidence confirms the running service uses the fix?
Can you restrict access while a patch is pending, and who authorizes it?
What recovery and incident-response work is included in the agreement?

Ask for the supported escalation route and any contractual response commitments. “Automatic updates” is too broad without knowing the package source, deployment type, and exceptions.

What self-hosters take on

You control the schedule, data location, software selection, and network policy. You also need to track advisories, select compatible releases, maintain backups, and verify changes. Time away from home or a busy workweek can become part of the risk if nobody else can administer the service.

Reduce that burden by running fewer public services, documenting the stack, and assigning a backup operator for important workloads. A simple maintained deployment is often easier to operate than a flexible collection of abandoned experiments.

Compare total effort honestly

Managed hosting has recurring fees and scope limits. Self-hosting has hardware, storage, power, backup, and administration costs. Put a realistic value on your maintenance time and the consequences of downtime. Avoid treating a hardware purchase as a complete replacement for operating work.

A hybrid arrangement can fit some households: keep private media and backups on a ZimaCube 2 while placing a public business website with a provider that meets its support requirements. Document data movement and backup ownership across both environments.

Use the PHP incident as a readiness check

Pick one service and write a short responsibility statement: the runtime maintainer, the deployment operator, the person checking compatibility, and the recovery owner. Confirm the statement against the actual service plan or your own procedures.

If you cannot identify an accountable person for a critical step, close that gap before adding another app. Security maintenance works when responsibility reaches the running system, not when it stops at a product description.

Explore ZimaCube 2 Personal Cloud Home NAS for your private storage and self-hosted application setup. Software security depends on the installed services, their configuration, and verified updates.

Continue the PHP security series

Sources and scope

Checked October 22, 2026. Deployment advice must be matched to your application and vendor documentation; these articles do not establish product-specific exposure.