The Tech Stack Behind a Modern WordPress Agency: What We Use at CODE TỐT

Every agency has a tech stack. But not every agency has a deliberate one.

When we started CODE TỐT in 2018, our stack was whatever worked last week — a random mix of shared hosting, free plugins, and duct-taped solutions. It got the job done for the first few clients, but as we grew to 16 people and 175+ projects, we learned the hard way that an ad-hoc tech stack creates technical debt faster than any single bad decision.

This article breaks down the exact tech stack we use today at CODE TỐT — the tools, platforms, and workflows that let a Vietnamese agency of our size compete with firms from anywhere in the world.

Why a Deliberate Tech Stack Matters

Before diving into the specifics, it’s worth understanding why we invested time in standardizing our stack. Three reasons:

• Onboarding speed: A new developer should be productive on day two, not week six. A consistent stack means every project looks familiar.
• Support efficiency: When you manage 50+ client sites, supporting five different hosting panels, three caching plugins, and two page builders is a nightmare. Standardization reduces cognitive load.
• Quality control: A known stack means known failure modes. We’ve debugged every issue in our stack at least once — the second time is always faster.

As we discussed in our project structure framework, consistency is the foundation of predictable delivery.

Layer 1: Hosting & Infrastructure

Server Management: RunCloud

RunCloud is the backbone of our hosting operations. We use it to manage all client servers — currently spread across multiple VPS providers. RunCloud gives us:

• One-click WordPress installation with proper Nginx/OpenLiteSpeed configuration
• Staging environments that mirror production
• Automated backups with off-site storage
• SSL certificate management via Let’s Encrypt
• Server monitoring and alerting

We chose RunCloud over alternatives like Cloudways or WP Engine because it gives us full server-level access while abstracting away the tedious parts of server management. For an agency running 50+ sites, the ability to SSH in and fix things directly is non-negotiable.

Web Server: OpenLiteSpeed

All our production servers run OpenLiteSpeed. It’s faster than Apache for WordPress (especially under concurrent traffic), has built-in caching, and integrates seamlessly with the LiteSpeed Cache plugin. We consistently see 40-60% faster Time to First Byte (TTFB) compared to equivalent Apache setups.

DNS & CDN: Cloudflare

Every client site goes through Cloudflare — even the small ones. The free plan provides:

• DDoS protection (essential for WordPress sites)
• Global CDN with automatic optimization
• SSL/TLS termination
• WAF rules for common attack patterns
• Argo Smart Routing (paid, but worth it for high-traffic sites)

We also use Cloudflare’s API to automate DNS record management during migrations — a topic we covered in our PageSpeed optimization guide.

Layer 2: WordPress Core & Development

Theme Development: Custom ACF + Gutenberg Blocks

We build all client themes from scratch using a custom starter theme based on Underscores, extended with:

• Advanced Custom Fields (ACF) Pro for flexible content fields
• Custom Gutenberg blocks (via ACF’s block registration) for client-editable sections
• SCSS compiled via Webpack for maintainable stylesheets
• Tailwind CSS (utility-first) for rapid prototyping, then refined into custom CSS

We moved away from page builders like Elementor and WPBakery in 2022. The reason was simple: page builders lock clients into a specific ecosystem, create bloated HTML, and make performance optimization nearly impossible. Our custom block approach gives clients the same editing flexibility with none of the baggage.

Version Control: Git + GitHub

Every project lives in a private GitHub repository. We use a simplified Git flow:

1. main — production-ready code (deployed via manual SCP or rsync)
2. develop — staging branch for integration testing
3. feature/* — individual developer branches

We don’t use automated CI/CD for WordPress theme deployment yet — the risk of overwriting client content or plugin updates is too high without a proper staging workflow. Instead, we use a semi-automated process: feature branches are merged to develop, tested on staging, then manually deployed to production.

Layer 3: Performance & Security

Caching: LiteSpeed Cache

LiteSpeed Cache is our caching plugin of choice — it’s the only plugin that can fully leverage OpenLiteSpeed’s server-level cache. Key configurations:

• Page caching with cache-control headers
• CSS/JS minification and combination
• Image optimization with WebP delivery
• Database optimization (scheduled weekly)
• Critical CSS generation

Security: NinjaFirewall + Cloudflare WAF

Security is a multi-layer game. Our stack includes:

• NinjaFirewall (MU plugin) — PHP-level firewall that catches attacks before WordPress even loads
• Cloudflare WAF — edge-level filtering for known attack patterns
• RunCloud’s built-in firewall — server-level port blocking and fail2ban
• Automatic plugin updates — managed via RunCloud’s dashboard

This three-layer approach has blocked thousands of attacks. In 2025 alone, NinjaFirewall blocked over 12,000 login attempts across our managed sites.

Layer 4: Monitoring & Maintenance

Uptime Monitoring: Better Uptime

We use Better Uptime for external monitoring. It checks every client site every 60 seconds and alerts our team via Telegram when a site goes down. The average response time from alert to fix is under 15 minutes.

Performance Monitoring: Google Search Console + PageSpeed Insights

For performance tracking, we rely on:

• Google Search Console — Core Web Vitals reports for real-user data
• PageSpeed Insights API — automated weekly checks via custom scripts
• LiteSpeed Cache’s built-in crawler — warms the cache daily

We built a custom internal dashboard that aggregates these metrics across all client sites. It flags any site that drops below a 90+ performance score so we can investigate proactively.

Layer 5: Client-Facing Tools

SEO: Rank Math

Rank Math is our SEO plugin of choice. It’s lightweight, integrates with Schema.org markup, and provides a clean interface for clients to manage their own SEO metadata. We configure it once per project with standard templates for title tags, meta descriptions, and Open Graph data.

Forms: Fluent Forms

For contact forms and surveys, we use Fluent Forms. It’s faster than Contact Form 7, has better spam protection, and integrates with popular CRM tools. Clients appreciate the drag-and-drop builder.

The Stack at a Glance

What We Don’t Use (And Why)

Equally important is what we’ve deliberately excluded:

• Page builders (Elementor, WPBakery, Divi): Bloated HTML, poor performance, vendor lock-in
• Shared hosting: Unpredictable performance, no isolation between sites
• Free SSL-only setups: Cloudflare’s free plan is strictly better
• cPanel: RunCloud’s interface is cleaner and more WordPress-focused

Key Takeaways

A deliberate tech stack isn’t about using the shiniest tools — it’s about choosing tools that work together, scale predictably, and minimize cognitive load for your team. Our stack evolved over years of trial and error, and it continues to evolve as new tools emerge.

If you’re building a WordPress agency, start with the hosting layer (RunCloud + Cloudflare is a solid foundation) and build upward. Don’t try to implement everything at once — each layer should solve a real problem you’re experiencing today, not a hypothetical one.

This article is part of our series on agency operations. Read next: How We Structure WordPress Projects at a Vietnamese Agency.