Doing basic web hosting right: Drake.Hosting

A little pet project of mine is to get a fully automated cPanel web and email hosting service up and running for friends and family.

I’d charge around £5-£10 a month for basic web and email hosting to cover my own costs (I don’t pay for the servers or cPanel licenses, but I do have to pay for the automation systems which, as a matter of fact, are cheaper than my previous Times iPad subscription).

There will be some caveats, namely:

  • No SSH access.  Not unless I *really* trust you. Almost everything can be achieved through FTPS or through cPanel.  I’ll make sure the server is running in tip-top condition and handle anything that requires a more hands-on approach.
  • I’ll be using the latest versions of PHP (5.6), MariaDB (10.0.22+), Apache 2.4.17 – multi-version PHP option to come a bit later (once I’ve had a chance to test it).  If these versions change, I’ll ensure to test on another server first, and will then email all concerned before deploying it on main service.
  • No legacy code.  If your CMS/app does not support PHP 5.6 or Apache 2.4.x, I don’t want to know.  I’ve seen far too many problems with legacy code being responsible for defaced sites, or sites being hijacked to launch attacks on others.
  • No domain or SSL registrations.  I can help you buy your own domain or SSL, but there won’t be any integrated option for ordering them.  Yet.  Principally because it requires that I become a business and e-commerce merchant.
  • That said, I’ve installed (currently trialing) Softaculus for those that are not familiar with installing their own scripts.  It should do a decent job of keeping scripts up to date.
  • No priority support during normal working hours.  I will keep an eye on the service (and my email), but obviously my full-time job takes complete precedence.  There will be a support ticket system that you can use to submit any support requests. Also note: this service is no way intended to compete against my employers.  If you need more resources and/or immediate/full-time support, you’ll need to go and buy a server from them. (I am, of course, able to recommend a package for you.)  As a systems administrator of over 19 years, plus the Memset cPanel expert, I’m pretty confident of ensuring high availability of all services that I run.
  • DNS is handled on the server, with automatic propagation through a series of worldwide secondary nameservers.   So if the server did go down, DNS records will be preserved until everything comes back online.  All new accounts using my nameservers will be set-up with DKIM and SPF records automatically.
  • All services will be protected via SSL (using * addresses).  This includes cPanel, web mail, IMAP and POP3 access.  Note: SMTP authentication is required if you’re going to use an email client rather than web mail.
  • SpamAssassin is the default anti-spam system.  I do not recommend you delete spam from the server if you set a baseline spam score – this can lead to false positives being deleted forever.  I’d suggest you use your own email client to handle any filtering of spam wherever possible.

A brief look at the support/ordering site below:


I’m still developing the service, so I’ll post more information here as and when.

NaNoWriMo a go?

I tried last year, and I failed.

But this year I’m determined to take part in National Novel Writing Month (NaNoWriMo).  I have my ideas, but I just need to bash them out on the ol’ keyboard.  And that’s been the problem.  At the end of a working day, I have about as much enthusiasm for sitting at a keyboard than a pig farmer has for letting the PM have a poke around their farm.

Plus Microsoft’s Office 2016 hasn’t exactly been playing nice with El Capitan.  So I’ve been thinking about revisiting Google Docs again.

My biggest problem with Docs all this time is the whole pagination issue with Microsoft Word.  It doesn’t align up properly UNLESS – I’ve found out – you use the Calibri font (which is the default font that Word 2016 ships with under OS X).  That seems to be the best way of ensuring that pages line up between Google Docs and Microsoft Word and vice versa.  So we’ll give that a go.

To force me to put words down on a daily basis, I’m abandoning my daily morning ritual of reading the newspapers on my iPad pre-shuttle-to-Dunsfold-Park coffee break at Starbucks or Costa and have bought a cheap Dell Chromebook 11.  It’s a device that runs Google’s Chrome OS and utilises my Google Apps for Work account to work on and offline.  Therefore I can easily bash out text on a proper keyboard, within the confines of Google Docs anywhere, and then sync it up with the copy stored in my Google account.

I’ve also ditched Dropbox.  It’ll save me £11/month – everything is going to Google Drive now.  I was also sick to death of the Dropbox for Business ads.

So here’s hoping that Archibald Codswallop and The Curse of the Were-Honey Badger is a success.  Or at least, is finished by the end of November.

My Top Support Annoyances

From the perspective of somebody who has to do this for a living.

I cannot access WHM / Remote Desktop / SSH

So many people keep losing their passwords, or if they remember their passwords, are still somehow able to enter them incorrectly too many times and consequently get themselves locked out of the system.

WHM (Web Host Manager – its part of the cPanel hosting control panel system) is the biggest culprit.  There’s a process called cpHulk daemon which can – if configured to do so – block people from accessing the server if a password is entered incorrectly too many times.  It is an indication that somebody is having to enter their email password manually and is getting it wrong (number 1 reason people get locked out in my experience), similarly for FTP access (number 2 reason), or they’ve forgotten their cPanel or WHM password.

One thing that would cut this down is if people were using password managers.  You can free ones, but my recommendation is for 1Password from AgileBits.  They have versions for OS X, Windows, iOS and Android devices.  It can store any confidential information, but passwords are its speciality.  It can also generate strong passwords.  Moreover, so much more.  All you need to do is to remember ONE password.  That is all.

My other advice is to set-up an SSH public/private key pair and upload the public key to your cPanel/Linux server.  By doing this, it allows you to access your server (hopefully you’ve remembered to set a password for the key – and use 1Password to remember it for you) if you get yourself locked out.

Not leaving the root/Administrator password to be able to log in and resolve an issue

If you have managed support with your hosting company and didn’t leave them your root or Administrator password, you’ll find that it’ll take much, much longer to get your problem resolved.

It is particularly frustrating if a hard drive has failed, Apache has gone TITSUP (Total Inability To Support Usual Performance), or the server has run out of disk space (a very common problem).  We cannot do anything unless we have your root password.  Different web hosting companies have different ways of handling this, but most allow you leave the password in a secure, private environment.

I have managed support, please can you install Super Walrus V?

The first thing to know about Managed Support Club is it is not a direct replacement for a full-time systems administrator.  A systems administrator can cost you anywhere between £20k – £60k+ a year depending on the level of complexity (and the experience of the sysadmin) you require.

Managed Support can cost between £50 – £150 a month, and gives you at least a basic level of systems maintenance.  It should cover configuring and maintaining a basic LAMP (Linux, Apache, MySQL and PHP or Windows (IIS) system.

What it does not do is to provide you with a systems administrator who will set-up and configure a full set of super high availability clustered services including all the front end servers, the firewalls, the database backends (including SQL replication) and pushing content to all the CDNs and keep it all maintained for you.  Otherwise managed support beyond the initial set-up is usually limited to each server in the cluster for maintaining the OS and underlying LAMP stack.

Much of any managed support service is automated  – e.g. stuff such as OS updates/patches, control panel software updates is applied automatically overnight.  However, you could ask for specific configuration to be applied (such as SSL configuration, basic MySQL tuning and optimisation, Apache tuning, installing additional OS software and so on), or have them look at a particular issue.

What it managed support would not cover is the installation or support of your expensive Super Walrus V program, or whatever exotic third party program or script you need.  Most managed support contracts would not support third party applications such as Magento, WordPress, Drupal or so on.

The point is – there are limits as to what managed support can and can’t cover.  Always check before buying.  Look at your internal IT support structure first.

Not testing your backups

Even if you are paying for a managed backup service, it is your data.  You should take the time to perform test restores from time to time (once a week, once every two weeks or once a month) to ensure that it works.  If things do not work, it may not be the fault of the hosting company.  If your computer or server is playing up, the data being backed up may be compromised and, therefore, restoring a backup may be a waste of time.

It is also important for backups to be held locally on the premises.  It may be on a desktop/laptop.  It may be on an external hard drive.  It may be both.  However, it is vital to have local backups.

I simply cannot stress enough how important it is to have multiple backups too.

Never assume that just because it looks to be working that it is.  Test, test, test.

Not listening to what you are being told

I hate to say I told you so to customers, but I’ve told them so.

I come across many problems where if a client had only spent a little more money or has attempted to investigate what I’ve told them, it would have saved them considerable headaches.

This includes:

  • Security advice (e.g. keeping WordPress up to date)
  • Using a firewall (whether something like UFW or CSF or if your web hosting provider has one – using that – or even a combination thereof)
  • Using malware detection software (“maldet” is a very good open source program)
  • Keeping PHP and Apache up to date (so many compromised servers due to legacy code which means that customers are reluctant to update PHP and Apache or MySQL)
  • Use of a web application firewall (either Mod_Security, or a third party service such as Sucuri, CloudFlare or Incapsula – yes, they can be expensive if protecting multiple sites, but it’s a small price to pay)
  • Cramming as many sites as possible onto a single cPanel server and wondering why it’s slow and/or it keeps on running out of memory.

I understand that one of the problems is of cost – but everything costs money.  Spending a bit of extra money for your hosting helps things in the long term.  There isn’t a “cheap” option – not unless you are technically proficient.

Think of it as DIY.  If you have a go, and you do well, you can make considerable savings.  However, if (like me) you are a walking disaster area with a brush or hammer, you’ll want to pay people to do it for you – and this costs money.

Things I have done this week..


  • Joined the Labour Party (just waiting for my super fun membership pack to arrive – *jumps up and down excitedly*)
  • Tried to join Natwest (for preferential overdraft rates – not that I’m using an overdraft, but if I do use an overdraft, I’d like preferential rates) and failed – not because I’m a liability, but because it took too friggin’ long.  Actually, I joined in the first week of September – not this week.  During the time I have been waiting, my existing bank started offering support for Apple Pay.  On reflection, not joining Natwest was probably a good thing overall.
  • Got new business cards:


  • Bought a new Apple gadget (having sold the old one) – more news on that in a bit
  • Upgrading to iOS 9 (and very nice it is too – the best thing is the trackpad/cursor gesture on the iPad.  Makes it so much easier to move around blocks of text to insert/edit stuff.  It’s a shame they haven’t made it available on the iPhone.
  • Joined the company Rugby World Cup sweepstakes thingy.  I have England.  I reckon I stand a good chance of winning all the money.