It’s been a while, eh!
I took down the site in a hurry thinking it had been compromised. Turned out it was my phone that had been infected with a trojan. The server had remained secured.
Now it’s a new host, working on top of nginx and hhvm. Seems to work well except WordPress pretty permalinks seem to be a pain. I’ll fix it sometime later.