Engineering Glossary · Integrations
APIs, and Where the Milliseconds Go
One third-party endpoint having a slow afternoon can add half a second to a page that was otherwise fine, and nothing in your own code changed.
The short answer
An API is a settled HTTP contract between two pieces of software — and on a web server, every outbound call you make sits inside your response time, because PHP blocks until the far end answers.
That is the part worth internalising. A shipping quote, a stock check or a licence ping is not free: it is added to time-to-first-byte on every request that triggers it. The repair is never 'find a faster API'. It is to measure which call is expensive, cap it with a timeout short enough to fail rather than hang, and move anything the visitor does not need to see into a cron run or a cached transient.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
Web APIs run over HTTP. A request goes to an endpoint, a structured response comes back, almost always as JSON. Your site sits on both sides of that arrangement: it calls out to payment gateways, mapping services and shipping quotes, and it publishes endpoints of its own — WordPress exposes a REST API under /wp-json/ whether you went looking for it or not.
Keys and tokens are the caller's identity. They authorise software to act in your name, which puts them in the same risk class as a password: kept out of the repository, scoped to the narrowest permission the job needs, and rotated the moment one might have escaped.
Measure the call before you blame the server
Start at the response, not in the code. Run curl -o /dev/null -s -w '%{time_starttransfer}' against the page that feels slow, five times, and take the median — the first hit after a cache purge is never representative. If that number is comfortable on a static page and ugly on the one page that quotes delivery rates, you have located the expensive call without reading a line of PHP.
On WordPress, Query Monitor's HTTP API panel lists every outbound request the page made, with the duration and the calling component beside it. That panel answers 'which plugin is phoning home on every page load' faster than any profiler, and the culprit is usually a licence check rather than the integration you were suspicious of.
What a good number looks like
On a cached page there should be no outbound call at all, and TTFB under 200 ms is a fair target. On an uncached page that genuinely has to ask someone else, budget the call out loud: 300 ms is tolerable, a second is not, and past two seconds your visitor is waiting on infrastructure you have no control over and no visibility into.
Compare like with like while you are at it. Subtracting time_connect from time_starttransfer separates server thinking time from connection setup, so a slow handshake to a distant endpoint does not get blamed on your own PHP.
Timeouts, retries and the failure you have not had yet
WordPress's HTTP layer defaults to a five-second timeout, and five seconds of a stalled endpoint is five seconds of a held PHP worker. The pool of workers is finite, so a third party having a bad afternoon can queue every request on the site behind its own outage. Set the timeout to the shortest value the integration tolerates — two or three seconds for anything non-critical — and let it fail cleanly instead of hanging.
Then decide what failure means. A stock lookup that times out should render with the last known figure, not a fatal error. Store the last good response in a transient or in Redis with an expiry that matches how stale the data may safely be, and an upstream outage degrades to slightly old numbers rather than a white screen.
Where this lands on HostingFast
The developer-focused plans carry SSH, Git and Composer, so curl, WP-CLI and a real shell are available for the measurements above rather than a plugin approximating them. PHP version is set per site from the control panel, which matters the day an SDK needs a version the rest of your account has moved past.
Already hosted somewhere slower? We migrate the whole site free, usually within 24 hours, and it keeps serving visitors the entire time. The neighbouring entries worth reading next are Webhook, Cron Job, Redis and Encryption.
A glossary with the mechanism left in
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the command that measures it and the number that counts as good.
Order an annual plan and the first year of your domain registration costs you nothing.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Mechanism, not vocabulary
Each entry says how the thing works underneath, because you cannot tune what you only recognise by name.
A number to aim at
Where a target exists — TTFB, timeout, payload size — the entry names it rather than saying 'as fast as possible'.
Tools named explicitly
curl, WP-CLI, Query Monitor, the browser network panel: whichever one actually answers the question gets named.
The failure mode first
How this breaks under load, and what it looks like in a log, before any advice about how to configure it.
Wired to its neighbours
API runs into Webhook, Cron Job and Redis, because one term rarely resolves a production problem on its own.
This term, landed
API defined, measured, budgeted and located in your own account — enough to act on, not just enough to nod at.
Quick Start
From order to online
- 1
Time the page from a shell
curl -w '%{time_starttransfer}' against the URL that feels slow, five runs, median. That one number settles whether the delay is server-side at all.
- 2
Attribute the cost to a single call
Open Query Monitor's HTTP API panel, or wrap a timer around each request in your own code. You are hunting the component making the call, not the endpoint being called.
- 3
Cap it, cache it, then re-measure
Drop the timeout, store the last good response, run the same curl loop again. If the median has not moved, you fixed the wrong thing — put it back and look elsewhere.
Built In
Loaded onto every plan
- Real SSH, plus Git and Composer, on the developer-focused plans
- PHP version set per site from the panel, not once per account
- Staging environments, so a change gets measured before it ships
- cPanel, so every tutorial and every backup format already matches
- WebP image conversion built in, at no extra cost
- Daily backups with self-service restores you run yourself from the panel
- Upgrades applied in place — changing plan is not a migration
- WordPress Toolkit handling core and plugin updates for you
- Mailboxes on your own domain, included with the plan
- Spam and virus scanning on every mailbox by default
Frequently Asked
What people ask us most often
What timeout should an outbound API call use?
Shorter than instinct suggests. WordPress defaults to five seconds, and a five-second stall holds a PHP worker for the whole of it. Two to three seconds covers anything non-critical. A payment authorisation may legitimately need longer, but then it should be the only slow thing on that request. Whatever you choose, decide in advance what the page renders when the call does not answer.
How do I find which API call is slowing a page down?
Two steps, in order. curl -w '%{time_starttransfer}' against the URL confirms the delay is server-side rather than in the browser. Then Query Monitor's HTTP API panel — or a timer wrapped around each request in your own code — attributes the milliseconds to a named component. More often than not it is a plugin licence check running on every page load, not the integration you assumed.
Is it safe to cache an API response?
For read traffic, almost always. Keep it in a transient or in Redis with an expiry that matches how stale the data may safely be: an hour for shipping bands, a minute for stock counts, never for a payment result. The point is that the visitor stops paying for the network round trip, not that the data has stopped changing.
Can one site run PHP 8 while another stays on an older release?
Yes — PHP is set per site from the control panel, so a legacy application and a current one can run side by side inside one account. Extensions and per-site tuning sit on the same screen, and none of it needs to go anywhere near a support ticket.
Keep reading
Encryption
The mathematics under HTTPS and at-rest storage — what it protects, and what it actually costs in CPU.
WordPress
The platform behind roughly four in ten websites, and the one whose performance profile you will spend the most time tuning.
Best API Backend Hosting
What genuinely matters for an API backend: worker counts, timeout policy and where the database sits.
Drupal Hosting
Drupal with Composer, Drush and per-site PHP control on tap.
WordPress Hosting
WordPress on LiteSpeed with staging and daily backups — tuned rather than merely supported.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Measure it on faster hardware.
NVMe on every tier, LiteSpeed inside the server, SSH where you need it — and a renewal price identical to the one you signed up at.
View Drupal Hosting plans