Hosting Company taking the Mickey

Forums › IT Pro and developers › Hosting Company taking the Mickey

kingjj

1731 posts

Uber Geek
+1 received by user: 450

ID Verified

Trusted

#293720 9-Feb-2022 21:18

Both the GM and Ops Manager of my wife's work resigned at the end of last year leaving the owner to do what all great owners do and decide not to replace them. The owner made several staff "go to's" (team leaders without the title or pay rise) and gave staff more autonomy to do what they want (considering they deal with a lot of Central Government and financial information this is very risky).

My wife has taken on some of the duties of the Ops Manager (without the pay rise or title change of course) and has under taken an audit of suppliers at the behest of the owner.

Today she talked to their web developer and got a break down of monthly outgoings for all things website related.

They have been paying a certain large NZ 'cloud company' (a mix of a fair few well known NZ ISP's) $573.39 per month for the following VPS, for many years:

2 vCPU's

4gb's RAM

22gb's Storage + 7 day backup retention (onsite)

Plesk Web Pro

Managed Compute (includes 'standard patching')

Managed Compute (includes 'enhanced management and monitoring') [nearly half the total bill]

A single IPv4 address

NZ Hosted

Their developer pointed out that they were still running PHP 5.6 up until today (when an upgrade was requested) and that the Plesk version was so out of date that they couldn't actually upgrade to PHP7.4 (the latest version they could upgrade to) without doing several cycles of Plesk upgrades. This server hosts a Wordpress site - public facing. I don't know what OS they are on, nor the hardware specs. When they requested an upgrade of PHP the provider initially recommended leaving it be as it could break their site...

They've also been paying $40 a month for a premium DNS provider with failover A records... they only have 1 Server/IP and have only had one for many years.

I'm shocked that neither their developer nor the provider have ever taken a look at the account and checked if it is still fit for purpose. My wife will start the move tomorrow to a business grade NZ shared hosting provider and Cloudflare Pro. They really don't need much, the site gets some traffic but not enough to justify a VPS (they'd be lucky to push more than 10gbs a month).

I've suggested that she contact their current provider and make a complaint about the complete lack of care their 'enhanced management' package has provided and seek out a refund. Am I overreacting here thinking that leaving them on a PHP version that was EOL over 3 years ago (I doubt the OS is anymore up-to-date) is beyond careless and reckless? Especially when it hosts a Wordpress install?

The old GM was a technophobe and put everything like this into the too hard basket hence an audit only happening now.

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#2864407 9-Feb-2022 21:38

That sure sounds like a security exploit waiting to happen. I would make sure to do a full scan of the files on the site as well to check for possible injected exploits.

Good on your wife getting the site off of this "solution" and onto something proper.

If the WordPress install have been kept up to date there should have been some warnings there are well on PHP versions. WordPress recommends PHP 7.4 in its own audit in the CMS. So might be worth it to go through that install and check that everything is well there as well.

Jarle Dahl Bergersen | Referral Links: Want $50 off when you join Octopus Energy? Use this referral code
Are you happy with what you get from Geekzone? Please consider supporting us by making a donation or subscribing.

kingjj

1731 posts

Uber Geek
+1 received by user: 450

ID Verified

Trusted

#2864411 9-Feb-2022 21:47

jarledb:

That sure sounds like a security exploit waiting to happen. I would make sure to do a full scan of the files on the site as well to check for possible injected exploits.

Good on your wife getting the site off of this "solution" and onto something proper.

If the WordPress install have been kept up to date there should have been some warnings there are well on PHP versions. WordPress recommends PHP 7.4 in its own audit in the CMS. So might be worth it to go through that install and check that everything is well there as well.

Great suggestions. I dread to think of what could be lurking. Their developer will deploy a new install of WordPress and customise it again for them as part of the move. Funnily enough WordPress has been giving them all sorts of warnings for years but the people in charge of updating content didn't know what they meant so have ignored them.

Its interesting that WordPress recommends PHP 7.4 considering that was EOL in November last year?

timmmay

20859 posts

Uber Geek
+1 received by user: 5350

Trusted

Lifetime subscriber

#2864413 9-Feb-2022 21:55

Wordpress recommends "At least PHP 7.4". It's not unusual for providers of all types to leave a working system alone, but no patches isn't great.

That spec of server costs $20 in AWS Lightsail but there's no service with it, its "here's your VM".

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#2864414 9-Feb-2022 21:56

What can I say about PHP and its versions... There was a long while after the release of PHP 7.4 where there were a lot of PHP modules that wasn't updated or available for it.

I would be worried about 7.4 if it was EOL for security updates. But that will only happen in about 1 1/2 years. See PHP Currently Supported Versions

At the moment you will have less headaches using 7.4 than going to the next version which is 8.0. A lot of plugins and themes for WordPress still don't support PHP 8.0 and you better make sure you don't have plugins, themes or customisations that use any functions of PHP that has been deprecated in 8.0.

insane

3325 posts

Uber Geek
+1 received by user: 1006

ID Verified

Trusted

2degrees

Subscriber

#2864419 9-Feb-2022 22:08

Based on that list of services I *think* I know who the provider is.

If I'm right, then I suspect the patch management only covers OS patches and no installed applications inc PHP, WordPress etc etc. Keeping those up to date would be the responsibility of the customer/user.

Some providers use the term VPS to represent a single server running 100's of VMs and heavily oversubscribed. Others use the same term for virtualised servers running on true mission critical hardware that can tolerate hardware failures and has better performance etc, so you could be getting the latter.

Sounds like you want managed hosting and not a managed server. WPengine does a great job of this if you're OK with the site being offshore. I'm sure there are sufficiently good options within NZ too.

xpd

Geek of Coastguard
14116 posts

Uber Geek
+1 received by user: 4579

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#2864458 10-Feb-2022 07:58

If its just running a Wordpress site, then should be straightforward to do a backup of it and move elsewhere.

Unfortunately theres a LOT of companies out there who have a basic site and paying a premium price on it.

Getting scalped not just by the hosts, but by the web developers - $1000 to setup a WP site with a free template and $200 a month "maintenance" isn't unheard of.

XPD / Gavin

LinkTree

New World

Shop on-line at New World now for your groceries (affiliate link).

kingjj

1731 posts

Uber Geek
+1 received by user: 450

ID Verified

Trusted

#2864528 10-Feb-2022 09:44

insane: Based on that list of services I *think* I know who the provider is.

If I'm right, then I suspect the patch management only covers OS patches and no installed applications inc PHP, WordPress etc etc. Keeping those up to date would be the responsibility of the customer/user.

Some providers use the term VPS to represent a single server running 100's of VMs and heavily oversubscribed. Others use the same term for virtualised servers running on true mission critical hardware that can tolerate hardware failures and has better performance etc, so you could be getting the latter.

Sounds like you want managed hosting and not a managed server. WPengine does a great job of this if you're OK with the site being offshore. I'm sure there are sufficiently good options within NZ too.

Agreed, they need a managed solution, the current thought process is to move to a shared environment with their developer taking on responsibility for managing the WordPress install. Likely one provided by their ISP. Most of their traffic comes from Aus/US/UK so offshore would be fine for them however the owner is a bit old fashioned and wants it in NZ.

I'm told the current service level agreement covers server and software patching/maintenance, if they're paying 200+ a month for someone to run apt every so often and do no further than the contract is pointless in my mind.

My wife's work is a small fish and the current provider won't blink at losing them.

kingjj

1731 posts

Uber Geek
+1 received by user: 450

ID Verified

Trusted

#2864535 10-Feb-2022 09:50

jarledb:

What can I say about PHP and its versions... There was a long while after the release of PHP 7.4 where there were a lot of PHP modules that wasn't updated or available for it.

I would be worried about 7.4 if it was EOL for security updates. But that will only happen in about 1 1/2 years. See PHP Currently Supported Versions

At the moment you will have less headaches using 7.4 than going to the next version which is 8.0. A lot of plugins and themes for WordPress still don't support PHP 8.0 and you better make sure you don't have plugins, themes or customisations that use any functions of PHP that has been deprecated in 8.0.

Understood. Thankfully their WP install is vanilla with a custom theme and some forms on top. As long as WP base supports it they would fine.