The Blog

What actually happens when you type a URL

You type a web address, press Enter, and a page shows up. It feels instant, which is a little unfair to everything that just happened. At least six...

The certificate that expired on a Friday evening

An online shop selling hand-made furniture ran for three years on a certificate bought once and renewed by hand each time. The reminder emails went...

Choosing a Host

There is no best host, only one that fits what you are building and how much of the work you want to do yourself. A host that is perfect for a...

What DNS propagation really is (and what it isn't)

The word propagation suggests that when you change a DNS record, the update is pushed outward across the internet like ripples in a pond. Nothing of...

Setting Up Email for a Domain

Getting mail to arrive is easy. Getting it to arrive in the inbox takes five records and a little patience. The five are MX (where mail for your...

Why a padlock does not mean a site is trustworthy

Many people were taught, reasonably at the time, to look for the padlock before typing a password. The advice was good in 2010. It is incomplete now...

All articles

The accountant who was impersonated

A one-person accounting practice received an angry call from a client who had paid an invoice to a new bank account. The email asking for the change...

The bakery whose map listing pointed at a dead page

A neighbourhood bakery had a website built by a friend five years earlier, then moved to a cheaper plan when the friend stopped taking calls. The...

The band that lost its mailing list

A local band collected email addresses at gigs with a paper sheet and typed them into a plugin on their website. After a hosting move, the plugin's...

The online course and the video bills

A fitness instructor sold a video course through her website and uploaded the videos directly to her hosting account. The first month, forty students...

The estate agent and the twelve-megabyte slideshow

An estate agent's homepage opened with a full-screen slideshow of eight property photos. Each one was a camera original of about 12 MB, resized only...

The hobby forum and the registration flood

A small forum for vintage radio enthusiasts woke up to find 4,000 new members overnight. None had posted yet. Over the next days the accounts began...

The restaurant that put its menu in a PDF

A restaurant added its menu as a PDF to the website, scanned from a printed copy. It was an image of text, forty megabytes, and not searchable.

The local news site and the comment spam

A volunteer-run local news site enabled comments on every story. For a year it was lively and polite. Then spammers discovered it, and each article...

Two sites on one account, one infection

A freelance web designer, working alone, kept three sites on one hosting account: two for clients and one for her own portfolio. The arrangement made...

The hobbyist and the home connection

A hobbyist with a spare Raspberry Pi and a free weekend decided to host his own website from the spare room. He installed a web server, wrote a few...

The podcast whose episodes lived on a free plan

A hobby podcaster recorded a weekly show about restoring vintage bicycles. He had no budget for podcast hosting, so he did what many beginners do: he...

The school fundraiser that crashed at its best moment

A primary school ran an online auction to raise money for its new library. Parents and local businesses had donated about sixty items: a signed...

The agency and the staging site that got indexed

A small web agency built a new website for a client, a regional furniture retailer, on a staging subdomain. Staging is the normal practice: a private...

The blogger and the vanishing domain

A food blogger had run her recipe site for six years. It had a modest but loyal readership, a few hundred posts, and a steady trickle of search...

The club newsletter that went to spam

A local cycling club had sent a monthly newsletter from its own domain for years: route changes, a ride calendar, a photograph of whoever fell in the...

The developer and the leaked key

A freelance developer was building a small booking system for a client, a physiotherapy practice. Late one evening he pushed his work to a public...

The nonprofit and the unclaimed subdomain

A charity once used a third-party service to handle event registration. To make it look like part of the charity's own site, the volunteer who set it...

The photographer and the 4 MB hero image

A wedding photographer was disappointed that her new site loaded slowly. It looked wonderful on her office computer, and the pictures were exactly...

The portfolio with a certificate warning

A freelance designer had a lovely portfolio. She had spent weeks on the case studies, photographed her work properly, and written text she was...

The shop that moved on a Friday afternoon

A small online shop selling hand-thrown ceramics decided to change hosts. The owner was happy with the site itself but the old plan had become slow...

The translator who lost her portfolio to a lapsed plan

A freelance translator paid for her hosting once a year. It was the sort of expense she only thought about when it appeared, and for four years it...

The tutor who wanted a proper email address

A private tutor had a free webmail address on her business cards and wanted something with her own name on it. Parents were occasionally hesitant...

The nonprofit site that only one volunteer understood

A community garden's website was built by a volunteer who knew what he was doing and kept everything in his own head. He was generous with his time...

Backups Done Right

A backup you have never restored is a theory. Most people find out which side of that line they are on at the worst possible moment: a hacked...

Choosing a Host

There is no best host, only one that fits what you are building and how much of the work you want to do yourself. A host that is perfect for a...

Choosing a Domain Registrar

The best registrar is the one you will not have to think about. It renews on time, tells you early when something is wrong, lets you leave without a...

Setting Up Email for a Domain

Getting mail to arrive is easy. Getting it to arrive in the inbox takes five records and a little patience. The five are MX (where mail for your...

How DNS Works, Start to Finish

DNS is the system that turns names into addresses and a lot more. It is also the part of the internet that fails in the most confusing way, because...

Moving a Site from HTTP to HTTPS

Moving a site from HTTP to HTTPS is almost always worth doing, and for most sites it is a short job. The certificate is the easy part. The time goes...

Moving a Domain to a New Registrar

A domain transfer is routine when it is done in the right order and a headache when it is not. The registrar change itself is mostly paperwork...

Website Security Basics

Most hacked sites were not targeted. Nobody read your About page and decided you were interesting. A scanner, running continuously from somewhere...

SSL File Formats

Certificate files cause more confusion than the cryptography ever does. You are handed a zip containing example.com.crt , ca-bundle.crt and perhaps a...

SSL Certificates Explained

You almost certainly need a certificate. Any site with a login, a form or a payment page needs one, browsers flag sites without one, and search...

Setting Up a Staging Site

A staging site is a private copy of your website where you can break things safely. You apply the update, try the redesign, install the unfamiliar...

Setting Up a CDN Without Breaking Anything

Adding a CDN takes about ten minutes: sign up, change a DNS record, watch the site carry on working. Adding one correctly takes an afternoon, because...

Hardening WordPress, Step by Step

None of these steps is difficult. Most take a few minutes, and almost all of them are free. Together they remove the easy ways in, which matters...

Making WordPress Faster

Most slow WordPress sites are slow for the same few reasons: no page cache, oversized images, too many plugins, an old PHP version, and a pile of...

Maintenance windows and change control

Many outages begin with a planned change. Hardware wears out slowly and predictably, and a provider can buy spares for that. A configuration edit, a...

Cooling

Nearly all the electricity that goes into a server comes out again as heat. A single rack of ordinary servers can put out as much heat as several...

Disaster recovery sites

A disaster recovery site is a second location able to take over if the first is lost. It can be a hot standby, running in parallel and ready to take...

Why redundancy still fails

Spare parts do not prevent every outage, because many outages are not caused by parts. Three examples that have been written about publicly make the...

Fire detection and suppression

Water sprinklers and electronics are a poor combination, so data halls often use other methods. Very early smoke detection systems sample the air...

Monitoring: sensors everywhere

A data hall is full of sensors: temperature and humidity at rack level, power draw on each circuit, water leak detection under raised floors, door...

The network

A hosting provider's connection to the internet is not a single cable. It is a set of links to several upstream carriers, plus connections to...

Peering, transit and why your host's network matters

A hosting provider reaches the rest of the internet in two ways. It buys transit from larger networks, which carry its traffic anywhere. It also...

Power

A data centre is, at heart, a very large and very well-organised electrical installation. The servers get the attention, but most of the engineering...

Racks, rows and cages

Servers are mounted in standard-width racks, measured in rack units of 4.4 centimetres. A typical rack has 42 of them. Racks stand in rows, with...

Remote hands and hardware swaps

When a disk fails in a server hundreds of kilometres away, somebody has to walk to the rack. Data centre staff provide a service often called remote...

Physical security

A facility that stores other people's websites and customer data is serious about who can get in. Typical measures include perimeter fencing, staffed...

Storage

Hard drives fail. That is a statistical certainty, not a rare accident, and storage design starts from that assumption. In a classic server, several...

Energy, water and the footprint of hosting

Data centres use roughly one to two percent of the world's electricity, and the figure is growing as more computing moves to them. Operators work on...

The virtualisation layer

Most hosting today runs on virtual machines or containers. A hypervisor divides one physical server into many virtual ones, each with its own...

Buying a name that already has a past

The aftermarket, where people sell domains to each other, can solve the problem of a perfect name being taken. Someone registered it years ago, never...

Brand first, keyword second

There are two ways to name a site. One uses the words people search for, like a plain description of the service. The other uses a distinctive brand...

Why a clever ending can be a risk

Domain hacks, where the ending completes a word, are memorable: a name that reads naturally across the dot. The appeal is obvious. The short, punchy...

What your registration data reveals

Registering a domain requires contact details: name, address, email and phone. For years these appeared in public WHOIS lookups, and spammers...

Clean up old DNS records

Over time, a domain collects records for services you tried and abandoned. A trial of a landing-page builder, a shop on a hosted platform, a status...

A domain is also your email address

Many people think of a domain as a website address, but for a lot of small businesses its most important job is email. A message from you@yourdomain...

What really happens when a domain expires

Expiry is not a cliff, but it is a slope, and the exact timing varies by registry and registrar. A typical .com goes through these stages.

Matching your domain, handles and email

A name appears in three places: the domain, the social profiles and the email addresses. When they match, customers find you without effort. When...

How many domains should you own?

For most projects, one main domain, plus a small number of defensive ones, is plenty. Each extra name adds a yearly bill, a renewal to track and a...

International names and look-alike letters

Domain names can contain letters beyond the basic Latin alphabet: accents, Cyrillic, Greek, Chinese and more. These internationalised names are...

Read it as one long string

Domains have no spaces, and that causes trouble. In a sentence the gaps tell the reader where one word stops and the next begins. In an address they...

Retiring a domain without losing its value

When you move to a new name, the old one carries traffic, links and recognition. Treat it as an asset to hand over, not to abandon. A domain that has...

Reading domain prices without being fooled

Registrars compete fiercely on the first year, and often sell below cost to win the customer. The business model depends on renewals, transfers and...

Protect what you have

The cheapest security measures for a domain are also the most effective. Losing a domain is rarely a clever attack on your server. It is usually a...

Renewal is the real price

Registrars compete on the first-year price and make their money on renewals. A domain that costs less than a coffee in year one can cost ten times...

Say it out loud

Before you buy a name, say it to three people and ask them to write down what they heard. If two of them spell it differently from you, you have...

Choosing the ending

.com is still what most people type by default, which is worth real money. If your ideal name is taken on .com, there are three real choices: pick a...

Trademarks: check before you fall in love

A domain can be perfectly available and still be a legal problem. If your chosen name is the same or confusingly close to a registered trademark in...

When someone else holds your name: a short guide to disputes

If somebody has registered a domain that infringes your trademark, and appears to be using it in bad faith, there is a process designed to resolve...

Reading an access log

Your web server writes down every request it handles. That file, the access log, is the most reliable account of what happens on your site. Analytics...

How automatic certificate renewal works

Automatic renewal sounds like magic, but the mechanism is straightforward: a program proves to a certificate authority that it controls a domain, and...

Backups: full, incremental, snapshots and the 3-2-1 rule

A backup is a copy you can restore from. Everything else is detail, but the details decide whether the copy saves you. Plenty of people have a backup...

Caching, layer by layer

Nearly every speed improvement on the web is some form of "do not do that work again." Caching is the practice of keeping a copy of something...

When a CDN helps, and when it gets in the way

A content delivery network sits between your visitors and your server. It keeps copies of your files in many locations, answers most requests itself...

Cookies, sessions and why logins fight with caches

The web is stateless by design. Each request arrives with no memory of the previous one: the server answers it, forgets it, and meets the next...

Cron jobs and the strange case of WP-Cron

Cron is the scheduler built into Unix-like systems. You give it a command and a time pattern, and it runs the command whenever the pattern matches....

The database behind your website

A WordPress page is not a file. There is no about-us.html sitting on the disk waiting to be sent. Your posts, comments, settings and menus live in a...

Who actually owns a domain, and how transfers work

You do not buy a domain the way you buy a chair. You register the right to use a name for a period, up to ten years at a time, and renew it before...

Why email is the hardest part of hosting

If you ask people who run websites for a living what gives them the most grief, many will say email. A website either loads or it does not. Email can...

Reading an error log without panic

When a page shows a blank screen or a bare "500 Internal Server Error", the useful message is almost never on the page. It is in the error log, a...

Firewalls and WAFs: what they stop and what they do not

People use the word firewall for several different things, and mixing them up leads to false confidence. Someone says "we have a firewall" and means...

IP addresses, and why there are two kinds

Every device that talks to the internet needs an address, and for decades that meant IPv4: four numbers between 0 and 255, such as 203.0.113.25 ....

Why your site slows down at 3 p.m.

A common support ticket reads something like: the site is fast in the morning and crawls in the afternoon, nothing has changed, what is going on?...

Why a padlock does not mean a site is trustworthy

Many people were taught, reasonably at the time, to look for the padlock before typing a password. The advice was good in 2010. It is incomplete now...

What a control panel actually does

A hosting control panel is a web interface for tasks that would otherwise need a terminal. Behind the buttons sit ordinary configuration files and...

PHP-FPM, and why your pages wait in line

Most WordPress sites run on PHP, and PHP does not run inside the web server any more. Modern setups use PHP-FPM, a separate service that keeps a...

Ports: why the web lives on 80 and 443

An IP address finds a machine. A port number finds the program on that machine. Think of the address as a building and the port as a door number. A...

What DNS propagation really is (and what it isn't)

The word propagation suggests that when you change a DNS record, the update is pushed outward across the internet like ripples in a pond. Nothing of...

Redirects: 301, 302 and the chains between

A redirect is a server saying "not here, go there". The browser follows without you noticing. They are essential whenever addresses change: moving to...

SSH, SFTP and keys: moving files and running commands safely

FTP is older than the web and sends passwords in plain text. It is still offered by many hosts, and it should be avoided. The replacements are built...

The TLS handshake in slow motion

Before a browser sends your password to a website, two things have to happen. The two sides must agree on how to scramble the conversation, and the...

Certificate authorities and how browsers decide who to trust

Your browser has never heard of most websites, yet it decides within milliseconds whether to trust their certificates. It can do that because it does...

What time to first byte actually measures

Speed tests report a number called time to first byte, or TTFB. It is the delay between the browser sending a request and receiving the first piece...

Shared, VPS, dedicated and cloud: what actually differs

Hosting plans are named in a way that suggests a ladder, with shared at the bottom and dedicated at the top, and a cloud somewhere floating above. In...

What actually happens when you type a URL

You type a web address, press Enter, and a page shows up. It feels instant, which is a little unfair to everything that just happened. At least six...

What a web server actually does

A web server is a program that waits for requests and answers them. The two names you will meet most are Apache and Nginx, with a few others like...

The auto-reply that answered itself eleven thousand times

A mid-sized company, the sort with a shared mailbox for general enquiries and a helpdesk system bolted on the side, set up an out-of-office reply on...

The autoscaler that scaled to meet the bots

A small software startup ran its public site and product pages on a platform with auto-scaling, because the founders had been burned before by a...

The backup that could not be restored

A hobbyist forum, the kind run by one volunteer admin for a community of a few thousand people interested in the same obscure subject, had a nightly...

The firewall rule that blocked the payment provider

An online shop selling craft supplies had a bad few days. A burst of suspicious traffic hit the site: login attempts against the admin area, scripted...

The IPv6 record pointing at nothing

A nonprofit that runs a community advice service moved its website to a new host. The migration was done carefully by a volunteer: files copied...

The CAA record that blocked its own certificate

The IT administrator at a small accountancy firm read a security checklist and took it seriously. One item said to publish a CAA record, which tells...

The CDN that served one customer's basket to another

A small boutique selling handmade homeware put its site behind a CDN to make it faster. The setup guide offered an option to cache everything...

The migration that forgot the cron jobs

A small publishing company moved to a new host over a weekend. The work was done carefully: files copied, database imported, DNS switched, forms...

The launch-day database that ran out of connections

A local theatre put tickets for its autumn season on sale at noon and announced it on social media a day earlier. At 12:03 the site began returning...

The contact form that mailed an expired domain

A small manufacturer's contact form sent enquiries to an address at a domain the owner had used years ago for a previous business. He had let that...

The domain contact who no longer worked there

A company wanted to transfer its domain to a new registrar. The registrar's confirmation email went to the technical contact on file, a former...

The disk that filled up overnight

A VPS hosted four or five small sites without problems for two years. One morning all of them returned errors, and the database would not start....

The scheduled job that ran twice

When an online business moved from one server to two, to be safe, it copied the whole server image. That image included the crontab, with a nightly...

The plugin that emailed every order to someone who had left

Years earlier, a shop's order notification plugin had been configured to send a copy of every order to the developer who built the site. He later...

The certificate that expired on a Friday evening

An online shop selling hand-made furniture ran for three years on a certificate bought once and renewed by hand each time. The reminder emails went...

The mailbox that filled up and bounced the best client

A consultant used a single mailbox on her hosting plan for several years and never deleted anything. Every proposal, every invoice, every forwarded...

The image that cost a month's hosting

A photographer on a pay-by-usage cloud plan published a picture that was picked up by a popular forum. People embedded it directly in their posts...

The HSTS setting that broke the intranet

After a security review, an administrator enabled HSTS on the company's main domain with the option that includes all subdomains, and a long expiry....

The one-line .htaccess edit that took three sites down

An administrator added a redirect rule to a shared .htaccess file in a parent folder, which three sites inherited. The syntax was nearly right, with...

The twenty-four hour TTL on the day the server died

A site's DNS records had a TTL of 86,400 seconds, a full day, set years ago by a default. Nobody had chosen it; it was just what the registrar's DNS...

The redirect loop nobody could see

A developer put a site behind a CDN to speed it up and switched on the CDN's setting for "flexible" encryption, which encrypts the connection between...

The redesign that lost its old addresses

A consultancy of about twenty people relaunched its website with new page names and a cleaner structure. The designer was proud of the result: short...

Two nameservers, one provider, one bad afternoon

A small agency of eight people was proud of its redundancy. Its domain listed four nameservers, two on each of two different-looking hostnames, and...

The PHP upgrade that broke the checkout

The owner of a small online shop selling handmade ceramics received an email from her host: PHP 7.4 had reached end of life and would be retired from...

The plugin update that took down the store

A shop selling garden furniture ran on WordPress with WooCommerce, and its owner had switched on automatic updates for plugins. That is usually a...

The upload folder that exceeded its quota in a night

A primary school used a gallery plugin on its WordPress site to publish photographs from events. The plugin did what such plugins do: for every...

The contact form that blacklisted the server

A neighbourhood association had a contact form on its website. It sent each message to the secretary using PHP's built-in mail() function, and it had...

The robots.txt that told everyone to go away

A regional estate agency commissioned a new website from a freelance developer. While building it on a temporary address, the developer did what...

The certificate on one server, but not its twin

A company ran its site behind a load balancer with two identical web servers. When the certificate was renewed, the administrator installed it on the...

The sitemap that listed forty thousand junk URLs

A furniture retailer added a filter system to its catalogue: colour, material, price band, size. Each combination produced a unique address, and a...

The database backup left in the public folder

A freelancer made a quick database export before an update and saved it as backup.sql in the site's public folder, because it was convenient. He...

The forced HTTPS that locked out the admin

A site owner installed a plugin that forces HTTPS. He also had a server rule doing the same thing, and his hosting company's proxy was passing...

The staging site that emailed real customers

A developer copied a production database to a staging site to test a new order workflow. The copy contained real customers and real email addresses...

The sale that started at the wrong hour

A retailer scheduled a flash sale for 9 a.m. The shop software was set to the store's local time. The server's clock, which a plugin used to trigger...

The wildcard certificate renewal that broke the mail server

An organisation used one wildcard certificate for its website and also installed the same files on its mail server. The web side renewed itself...

The www that was not there

A consultancy launched a redesigned site and shared the address on a printed brochure as www.example-consulting.com . The team had tested the bare...

1989 to 1991: A proposal and a single computer

In March 1989 Tim Berners-Lee, then working at CERN, circulated a proposal for a system to link documents across the lab's computers. His manager's...

1993 to 1996: The first hosts

The NCSA's Mosaic browser appeared in 1993 and made the web visible to people who were not computer scientists. Web servers such as NCSA httpd, and...

1994 to 1996: Encryption arrives

As the first online shops appeared, people wanted to send card numbers without them being read in transit. Netscape introduced SSL in the mid-1990s...

1995 to 1999: Dynamic sites and the domain rush

PHP was first released in 1995 and MySQL the same year. Together with Linux and Apache they formed the stack that would be called LAMP, and they made...

1998: A new body for names

The domain name system had been run by a small group of individuals and organisations under US government contracts. In 1998, ICANN was created as a...

2000 to 2005: Dot-com aftermath and the rise of blogs

The bursting of the dot-com bubble thinned out the first wave of hosting companies, and the survivors consolidated. Hosting became a commodity...

2001: Control panels and VPS

Around 2001, commercial control panels such as Plesk appeared alongside cPanel, and operating-system-level virtualisation made it possible to divide...

2004 to 2008: Everyone becomes a publisher

Blogging platforms, photo sharing and social sites made publishing routine. Shared hosting boomed, with providers advertising ever bigger storage...

2006 to 2012: The cloud arrives

In 2006 Amazon launched S3 for storage and EC2 for computing, letting anyone rent capacity by the hour with a credit card. The idea that...

2012 to 2014: New endings and a serious bug

In 2012, ICANN opened applications for hundreds of new top-level domains, and the first appeared in 2013. Names ending in .shop, .blog, .app and...

2013 to 2019: Containers, free certificates and HTTPS everywhere

Docker appeared in 2013 and popularised containers, a lightweight way to package an application with its dependencies. Orchestration tools such as...

2016: When DNS fell over

In October 2016, a huge botnet built from poorly secured cameras and routers directed a flood of traffic at Dyn, a major DNS provider. Many...

2018: Privacy law reshapes the registry

When the European GDPR came into force in May 2018, the public WHOIS system, which listed names, addresses and phone numbers of domain holders, ran...

2020: A sudden shift online

In 2020, much of daily life moved online within weeks. Shops, schools, clinics and cinemas needed websites or bigger ones. Hosting providers saw...

2020 to today: Edge, automation and email grows up

HTTP/3, built on QUIC, was standardised in 2022 and is now supported by the major browsers and many CDNs. Serverless and edge platforms run small...

Myth or Fact: Domains and DNS

Domain names collect folklore faster than almost anything else in web hosting. Part of the reason is that the system is old, built from several...

Myth or Fact: Email

Email looks like a simple system: you press send and a message arrives. Underneath it is a pile of standards written over four decades, and nobody...

Myth or Fact: Hosting and plans

Hosting is sold on a few headline words: unlimited, guaranteed, secure, cloud. They are real words with real meanings, but in marketing they are...

Myth or Fact: Speed and WordPress

Speed advice has a long shelf life and a short fact-check. Half of what gets repeated in forums and sales pages dates from an era of slower servers...

Myth or Fact: Security

Most security folklore is half right, which is what makes it hard to correct. Somebody did once get hacked through a particular plugin, somebody else...