Is it feasible to self host websites for small businesses? I’m trying to do some research on the amount of infrastructure and stuff you have to know from a security standpoint… I’m fine with building and hosting stuff locally for me but I’m tempted to move to hosting some of my business sites as well.
Does anyone have experience and can give me some advice one way or the other?
It depends on what it is really + convenience. There are lots of morons out here running basic info sites on full beefy datacenter VMs instead of a proper cloud webhost service.
The most you’d be getting out of cloud is reliability. Self host assumes you don’t have any bottlenecks (easy enough to pass), but also 99% uptime which is impossible unless you are running with site redundancy (also possible, but I doubt how many people own multiple properties with their own distribute or private cloud solution).
if 95% uptime is acceptable, and you don’t live in an area with outage issues from weather, I’d say go for it. Otherwise, you can find some pretty cheap cloud solutions for basic websites. Even a cheapo VPS would probably work just fine.
Self hosting websites? Easy
Self hosting something for a business? Run for the hills. It will not end well and you would be much better off with something more business standard.
As someone who’s set up and managed critical business applications I would say that it’s perfectly fine to host your own provided you have decent hardware that’s capable of doing what you need and as a dedicated business line to provide connection.
If you try to run mission critical business applications on a home internet connection you’re going to have a really bad fucking time. But hosting business critical applications on appropriate hardware and a 1Gb/s business connection with an SLA is going to meet 95-98%% of all business applications.
If something like that sounds expensive or too difficult to do then it’s too expensive or too difficult for you to host yourself. Just go with a provider and sidestep self-host.
I think it’s also important to consider how critical the website is. Worked for and with companies where their website being down wouldn’t be a major issue and others where it would stop them being able to operate.
There is also a scalability aspect. All companies start off small.
Is it feasible to self host websites
yes
for small businesses
NOPE
Well, you say your business sites, so I assume you’re okay with downtime. I would absolutely not self-host sites for someone else’s business, because if something happens to the hosting (ISP outage, power outage, bad update, hardware failure, accidental deletion, misconfiguration, ISP block, flood/fire/storm, theft, I can go on) then it’s my ass on the line. Simple hosting is cheap, spend the few bucks for a lot more peace of mind.
Exactly. It’s not just downtime to worry about, either. It’s disks filling up. It’s hardware failure. It’s DNS outages. It’s random DDoS attacks. It’s automated scans of the internet targeting WordPress. It’s OS, php and database upgrades. It’s setting up graphing, monitoring, alerting and being on-call 24/7 to deal with the issues that come up.
If these businesses are at all serious, pay for professional hosting and spend your time running the business.
Yeah, pay somebody else to be responsible for the server uptime and the bandwidth. Somebody who specializes in providing that.
I think the answer depends a lot on the use case of each business’s website and what the business owner/employees expect from it.
Is the website a storefront? You’ll be spending a lot of time maintaining integration with payment networks and ensuring that the transaction process is secure and can’t be exploited to create fake invoices or spammed with fake orders. Also probably maintaining a database of customer orders with names, emails, physical addresses, credit card info, and payment and order fulfillment records… so now you have to worry about handling and storing PII, maybe PCI DSS compliance, and you’ll end up performing some accounting tasks as well due to controlling the payment processing. HIPAA compliance too if it’s something medical like a small doctor’s office, therapist, dialysis clinic, outpatient care - basically anything that might be billable to health insurance.
Does the business have a private email server? You’ll be spending a lot of time maintaining spam filters and block lists and ensuring that their email server has a good reputation with the major email service providers.
Do the employees need user logins so that they can add or edit content on the website or perform other business tasks? Now you’re not just a web host, you’re also a sysadmin for a small enterprise which means you’ll be handling common end-user support tasks like password resets. Have fun with that.
Do they regularly upload new content? (e.g. product photos and descriptions, customer testimonies, demo videos) Now you’re a database admin too.
Does the website allow the business’s customers to upload information? (comments/reviews/pictures/etc, e.g. is it Web 2.0 in some way) god help you.
You’re going to expose this to the public internet. It will be crawled, and its content scraped by various bots. At some point, someone will try to install a cryptominer on it. Someone will try to use it as a C2 server. Someone will notice that you’re running multiple sites/services from one infrastructure stack and attempt to punch their way out of the webhost VM and into the main server just to poke around and see what else you’ve got there. Someone will install mirai and try to make it part of a DDOS service provider’s network.
What I can tell you, working for a company hosting data for the UK NHS.
Is that hosting is easy, I have a very reliable homelab. I keep things up to date and make sure to secure things the best I can.
But security is hard, there are many things to secure. Blind spots you didn’t even know you had.
The bast way to look at security, it to start with secure and dial things back so that it works.
It’ll be vastly cheaper and easier to just get hosting somewhere.
Wordpress hosting (edit: THIRD PARTY Wordpress hosting, Bluehost and Hostinger are decent I think, see below) is fine for most small businesses and starts at about $10/mo. You can go fancier and more reliable and go up to $30/mo or something, or if you really need your own VPS you can go with Vultr or Hostinger and get a pretty similar price range for pretty much whatever you want to do.
I think the only reason to self-host is if you have some crazy special hardware or legal issue, or your own dev stuff that you don’t want/need to push to “the cloud” to put it online. Otherwise it’s such a buyer’s-choice market that it’s hard to justify.
Yeah… and unless you really, really enjoy configuring your own stuff and tinkering, a hosting service is much easier.
I happen to be insane, and enjoy that stuff. And it’s not a business server (well, not anything big anyway).
Yeah. I’ve run plenty of services from a computer sitting in someone’s office, or in my living room, while they’re in-production-while-in-development. Sometimes it makes sense. But it’s just not something you want to deliberately aim for as the solution. What if the power goes out? What if your motherboard dies? What if the toilet overflows when you’re not there, and floods the place?
Just get a dedicated service and pay them their $10/month and have them worry about all that crap for you.
What are you trying to run? a VPS is pennies, and a phyiscal server isn’t much more. We have a bunch of servers that are $40 a month each and they come with 5 usable IPs, 32 gigs of ram, 1tb SSD etc. The cost of getting a static IP for home will be almost as much as a server. If you want less you can get less for a lot less money.
I’ve self hosted my own personal website for years now and it’s not really an issue outside of the power going out and my IP changing. I just update DNS and move on. But if this is for an actual work? Just pay the $10 a month, not having to worry about it is worth that money.
I would go for something more reputable like AWS or Azure.
where are you getting servers that cheap
This is one.
If you’re in Canada, Rogers (nee Shaw) and Telus small business plans both offer ‘static’ IPs (Shaw’s residential plans aren’t officially static, but they rarely change on a residential modem unless you are always switching out hardware). Telus business fibre 1GB plan offers up to 5 static IP addresses.
Then you must purchase one or more domain names and assign them to your IP address… depending on your business’s needs even small consumer hardware can run a web server just fine.
Have a backup strategy though! And be sure you actually test the restore procedure on a periodic basis!
Linux backups can range from home-grown ‘rsync’ scripts and hot-plug external drives as backup, to more fancy ‘Time Machine’ like backup things (I honestly forget what’s out there for Linux right now, I have my own rsync scripts to back up to external drives).
My home server is my own, but if money is on the line you want proper backup and failover even. Most Linux distributions are easy-peasy to set up with Apache or nginx web servers but if you’ve never set those up you’ll need to study lots of tutorials and manual pages.
If you don’t want to tend to security and backups yourself though, it might be best to find a hosting service.
Well I hope everyone here has some experience.
I spent $200 on a mini PC. The only thing business is essentially a landing page.
Yunohost handles the security and really the majority of technical stuff for me but it’s still going to require some learning. I’m happy to help as much as I can.