Skip to content
yetkil.

Web server

My own infrastructure

A single server carrying forty sites, kept running by me for years.

My own projects and the sites of former clients live on this server. Setup, migration, hardening, certificates, backups and monitoring are all mine. This is what sits behind the sentence "I can handle the server side too".

40 sites

Hosted and administered on one server

100% HTTPS

With certificates that renew themselves

24/7 monitoring

So a problem is caught before you notice it

Why this is here

This is not client work either. But “servers and DevOps” appearing on a service list does not mean the person actually runs servers. On mine it does: I have been running this one for years, and I am the one who gets up when something breaks at night.

What lives on it

Alongside my own projects, the sites of clients I worked with in the past are hosted here. Around forty sites in total: corporate sites, e-commerce systems, older PHP applications and content sites. All on one machine, isolated from each other with separate users and separate PHP pools.

The work

Migration. The sites were moved from an old machine to a clean server I built from scratch. During the move, the old and new responses were compared site by site; content, URLs and admin routes came out identical.

Security. SSH is key-only on a non-standard port with root login disabled. Script execution is blocked inside upload directories, sensitive file extensions are refused, and failed login attempts are banned automatically. Administrative access also has a VPN in front of it.

Certificates. Let’s Encrypt certificates were issued for every site and renew automatically. A site whose certificate quietly expires is no different from a site that is down.

Backups and monitoring. Database and file backups run on a schedule; disk, memory and service health are watched. The goal is simple: when something breaks, I should hear about it before the client does.

The point

If a new project needs a server, I do not have to ask anyone else. I already do the same work, from provisioning to hardening, on my own infrastructure.

Next case

KRCPACK: The off-the-shelf portal cost ten times as much. We built theirs in forty hours.

Let us start

One hour on a call clears up most of it.

Tell me what you are trying to do, and we will work out what can be done, how long it takes and whether it is genuinely needed. A free analysis, planning and introductory call.

WhatsApp
Message on WhatsApp
Phone
Show number
Email
e-posta
Based in
Guimarães, PortugalSamsun, Türkiye Based in Portugal, in Türkiye every couple of months.

Legal

Privacy notice

Last updated: 24 September 2026

This site carries no advertising trackers, behavioural profiling or third-party marketing cookies. Personal data is processed only when you fill in the contact form, and only so that I can reply to you. Google Analytics, used for visit statistics, runs only if you accept it.

Who is responsible

Uğur Yetkil is the controller for the personal data processed on this site. The business operates from Türkiye; you can reach the controller through any of the contact channels on this site.

What is collected

Only what you type into the contact form: your name, company, email address, phone number if you give one, the tier you are interested in, and your message.

There is no sign-in, membership or payment on this site, so nothing else is collected.

Why it is processed

The sole purpose is to reply to your enquiry and run the conversation that follows. This data is not added to a marketing list, not used for newsletters and never sold to third parties.

Legal basis

Processing rests on Article 6(1)(b) GDPR, as steps taken at your request before entering into a contract, and on Article 6(1)(f) as a legitimate interest. For enquiries from Turkey, Article 5/2-f of the KVKK applies.

Who it is shared with

Form submissions are delivered through an email service and a messaging service used for notification. These providers are used solely to deliver the message; your data is not shared for advertising.

Cloudflare Turnstile is used for bot protection. Turnstile does not build a profile that identifies you.

If you accept measurement, visit data is passed to Google through Google Analytics. If you decline, that transfer never happens.

How long it is kept

If your enquiry does not lead anywhere, the record is kept for at most twelve months and then deleted. If we begin working together, the data is kept for the duration of the contract and any statutory retention period that applies.

Cookies and visit measurement

Visit counts are measured with Cloudflare Web Analytics. That counter uses no cookies, writes nothing to your browser and does not identify you, so it runs without asking for consent.

Google Analytics 4 is also used. Because Google Analytics sets cookies, it loads only if you accept it. Until you do, the script is never added to the page; declining takes no action on your part, as that is already the default state.

If you accept, the pages you visit, the link that brought you here, your approximate location and your device and browser details are sent to Google. Your name, your email address and anything you type into the form never enter this measurement. Google may also process this data on servers outside the European Union.

You can change your choice at any time: the “Measurement preference” link at the foot of the page reopens the consent strip. When you decline, measurement stops and the cookies Google Analytics left behind are deleted from your browser.

Apart from that, your browser may store a functional value such as your language preference; it does not identify you.

Your rights

Under the GDPR and the KVKK you may ask what data is held about you, request correction or erasure, object to processing, and ask for your data to be transferred.

To exercise any of these, write to the email address on this site; your request is answered within thirty days at the latest.

Data inside client projects

Delivering the service may require technical access to data held in a client’s systems. The confidentiality clause in my standard service agreement applies, and I will also sign the GDPR or KVKK data-processing agreement your company uses.

Privacy notice