Hosting WordPress in the Home Office

Home hosting is nothing new to us – as during our decades of web-hosting, for one reason or another there have been times when hosting servers at home made sense, from a cost and security viewpoint and other times when the unforeseen had removed all other options.

For us, COVID has indeed provided a wake-up call and despite potential to host everything in the cloud and content delivery networks ensuring your content is visible globally, as 2020 unfolded, reviews for some of the largest cloud based VPS providers confirmed our believe that cloud hosting is fine until the sky falls in – then excuse after excuse lead us to believe that even the providers did not know the reason for the variable performance.

In a world of GDPR – security and privacy are at the forefront of everyones minds and cloud/CDN hosting providers would not tell me exactly where my data is located and how secure it is during a pandemic. This prompted us to reassess the risks and implications of hosting our servers at home. Our thought process was as follows:

Hardware and Cooling:

Sometime in the early part of the 21st century we managed a hand full of servers, a few hundred sites and we had Dell Rack mounted and Tower Servers on shelves under the stairs. They had integrated cooling which worked well but the fan and hard drive noise level was considerable. The heat pumping from under the stairs was also significant and the additional domestic power consumption more than doubled.

Fast forward a decade and we had cloud based VPSs and just one camera server at home running on a dedicated Windows 10 machine which built to gaming spec, dual purposed nicely as a multi-display desktop PC. Powered on 24/7 the Thermaltake Integrated 3 fan cooler, on the Intel 6800 series CPU coped extremely well and the fan noise negligible. The 2 x 2TB M.2 SSDs meant storage was neither a bottle-neck or an ambient noise contributor. We had a PFSense Community Edition – Linux based Firewall running in a Hyper-V Virtual machine and replacing our 2 x cloud based VPSs with 2 x additional Hyper-V Virtual Machines on the Camera Server had no visible impact at all.

If you have a windows 10 machine you have or can leave running 24/7 a Linux Virtual Machine will consume very little resources. If you have windows 10 professional – enable Hyper-V and that will host a couple of Linux VPSs nicely. If you have an old PC in the loft with much lower hardware spec you will more than likely be able to set it up to perform acceptably as a dedicated Linux machine, as the needed system resources are much less. Armed with an Ethernet port once setup on the network, the control panel installation and management will take place via SSH remote login. Additional cost so far – zero to negligible as we are capitalising on existing camera server hardware.

Power Supply Strategy

The power supply strategy for our camera server was aimed at keeping it running 24/7. As a rule – in our area we do not suffer from power cuts, however, we have suffered power loss to the power sockets due to faults on appliances causing an earth fault trip on the ring main. A damaged extension lead trapped in a door, an old soldering iron and an ageing TV were the culprits if memory serves. It is not the end of the world if the camera server goes offline for a short period, but hardware damage and possible data corruption due to sudden power failure were the risks we sought to mitigate by installing an additional MCB and RCD in the consumer unit to isolate the server power supply from the domestic ring main.

This was a more cost effective solution than installing a small UPS to keep the server running whilst any trips were reset. In reassessing the risks – as we do not plan to host customer sites on our home hosted VPSs added to the camera server, we elected to keep the current power supply arrangement and adapt if needed.

You need to do your own assessment of the likelihood of power-loss and the impacts. If necessary a small UPS to maintain the power supply to the server and network hardware and if necessary invoking a graceful shutdown of the server is an option for consideration. If unplanned server downtime is not an option – then you will likely need a double conversion UPS and a small generator. These smaller units are not as expensive as they once were, although practical siting, cable routing  and generator noise and exhaust need serious thought in a residential setting.

Broadband Connection

There was a time when only a leased line to a premises would provide the type of network connectivity needed to host a web-server. When we ran our dedicated servers under the stairs, we had Plusnet and a Telewest residential Broadband connections with dynamic IP addresses which all things considered worked quite well – although quite costly. Fast forward to today and the Virgin Business full monty 500MBPS package with 5 fixed IP addresses was working fine. Our 2 additional VPSs slotted nicely into the two spare IP addresses added to the PFSense NAT setup.

Our camera servers are monitoring remote cameras – hence the meaty broadband package. You do not need anywhere near this spec to host a few WordPress websites regardless of popularity. If the LAN is properly configured using decent ethernet cables, network interface cards and switches, then there is no reason why a VPS cannot be connected via a 10MBPS connection. If a fixed IP address is available – all the better, as some search engines may react negatively to dynamic IPs. Other than that there are cost effective solutions to enable use of a dynamic IP for server home hosting.

Nameservers/DNS

In the web-hosting world commercial web-hosts once made a big deal about hosting your own nameservers and perceived benefits of being able to give customers nameserver addresses which matched the brand. Domain registrars require at least 2 different DNS server addresses to function which lead to the assumption that at least 2 server IP address would be needed. The thinking behind the domain registrars requirement for 2 DNS servers, is continual availability and the idea is for the DNS servers to be geographically dispersed. Ie. not in the same part of the world – let alone on the same server.

Faced with the home hosting challenge of 1 IP address, we soon came across a couple of DNS server exchange sites where we would be slave to someone else’s master and vice versa. All of this was necessary to enable the onboard bind server to function which enabled DNS zones to be managed locally. This sounds complex because it is and we picked up the server management work for may confused customers. Then a few zone edit type sites popped up where their name servers could be used at the registrar and the DNS zones managed on their site. Then this service started to appear in data-centre account control panels and we were soon past the requirement for multiple IP addresses to host a server. Fast forward to today –  no need to manage DNS locally unless absolutely necessary. Most domain registrars provide DNS control panels with the registered domain names pointed to their nameservers by default. Using the registrars control panel – Host records and MX records can even point web and mail requests to different servers if needed.

SSL/HTTPS

Talking of IP addresses – there was a time when the World Wide Web was mostly HTTP based. One of the key reasons for this is that HTTPS required the purchase/installation of an SSL certificate, also a dedicated IP address and hence HTTPS was normally only seen on sites were commercial transactions and suchlike took place. This was a real pain and web-hosts often invested in server level wildcard SSL certificates but had to be selective in where they hosted servers to ensure availability of additional IP addresses. Thankfully SNI put a stop to that. Long story short – Server Name Indication is an extension to the Transport Layer Security protocol which enables presentation of multiple SSL certificates enabling transmission of HTTPS over a single IP address.

So for a home hosted server with a single IP address – multiple WordPress sites and the server itself can be secured using SSL certificates, so our WordPress sites can be accessed via the HTTPS protocol.

Router/Firewall

Our server farm below the stairs used what was known as IP Masquerading, to effectively forward the traffic based on a set of rules in the configuration file, effectively hiding the IP addresses of the servers. The broadband connection would come in on one network interface card (WAN) and provide connectivity to the (LAN) via a second network interface card hard wired via Ethernet switches. The server running the IP Masqerading would implement IP tables type filters between the interface cards creating the equivalent of a NAT Firewall. Much of this is not needed today as NAT and IP/Port forwarding functionality is built into modern day routers.

Todays multi-IP address setup is the only reason for the PFSense Firewall/Router. The Virgin Business design intent is to distribute the network workload across the 5 IP addresses and by default simply serves them to internal clients via its DHCP server. So we popped the router into modem mode and ran an ethernet cable to the camera server mapped to the virtual WAN interface of the Hyper-V virtual machine running PFSense. The camera server LAN interface feeds connects to the cameras via a number of ethernet switches and also feeds a Linksys Velop Mesh Network which distributes the WiFi. The two additional VPSs simply connect to the virtual LAN with applicable ports forwarded in PFSense.

To host a few WordPress sites on a VPS using a single IP address, standard router functionality should be fine.

To get to our VPS we will point the domain names at the Router WAN IP address and either setup port forwarding in the router or DMZ. DMZ stands for Demilitarized Zone and exposes all resources on the assigned device to the public internet so should be used with care. If the router has port forwarding options – it is much more sensible to forward traffic on port 80 (http) and 443(https) to the IP address of the VPS. Any other ports needed can be setup in the same way. I would sooner setup 20 – 30 port forwarding rules than enable DMZ

To setup or WordPress hosting VPS we will install a web-hosting control panel. This will need port forwarding setup to access discrete ports for the admin interface addition to ports 80 and 443. More on that in a minute – but that leads us nicely into probably the decision which will have the biggest impact. Web Hosting Control Panel.

Selecting the FREE Web Hosting Control Panel

A control panel… for just a few WordPress sites I hear you say…… I guarantee installing it will be quicker than playing with the Linux Desktop applications or playing with IIS/Docker. A control panel is also much more than a means to setup a website and install WordPress. The control panel provides context to the plethora of tools available in a Linux VPS. From choice of web-server, database server, PHP versions, firewall setup and if you are really lucky you will get automated installation of Free SSL certificates and one click install of WordPress.

Evolution Of FREE Web Hosting Control Panels

We setup our first Redhat Linux Server and marvelled at the XWindows desktop – which was not a patch on Microsoft Windows but it had menu options to control apache, mysql, ftp and iptables which were things we understood in the web-hosting world, but whilst we got the network setup completed we did not get much further. Long story short we paid for a Plesk Licence and installed the unlimited version and watched the SSH terminal as it installed automatically and then provided the link to login to the admin panel. We logged in and we had domains purchased and sites setup in minutes.

The Plesk automated installer had very conveniently pulled all the server resources together and even installed any bits that where missing – but it also came at a fantastic price and every year there were upgrades which added to the cost. We decided to explore the world of free. We had a look at Webmin which seemed as complex as Redhat Xwindows, later on Virtualmin but couldn’t get that to work. Then we had a look at Zpanel which seemed to work but freakily got a mention in the news regarding a security hole. Then we had a look at ISPconfig and couldn’t run the installer and we were just about to fork out for more Plesk upgrades when we tried the free version of CentOS Webpanel which looked very light and simple with a big feature list.

It installed fine but one of the stated capabilities which was multiple versions of PHP appeared to need a workaround and I could see from the active community forum some bugs were still being ironed out. I needed PHP5 and PHP7 so selected PHP7 and followed the instructions to place a .htaccess file in the root folder of the site and bingo multiple versions of PHP solved one of the big problems I was having at the time.

CentOS Web Panel development began to pick-up pace

It seemed like we were waiting for features such as site stats for an eternity. They finally appeared along with integration with letsenrypt auto-SSL and then the IP management interface and then NGINX and when I logged into the user control panel a new option called addons had appeared where WordPress, Joomla and Prestashop were listed for 1 click auto install. This panel was feeling quite solid as Plesk would occasionally misbehave and CWP never never errored at all. I had not paid a penny it was truly free.

We always have 2 servers running as we use tried and trusted features on the production machine and explore new and advanced server features on the 2nd. Having transferred our sites to the production server and confirmed stable running, we duplicated the setup on the 2nd machine with Apache + Nginx setup in the web-server configuration. We also ran some trials with Varnish – more on that later but came back to the Apache & Nginx combination. We setup new sites with auto-SSL and tested the 1 click WordPress install in the user panel. It worked like a charm, see below:

View the detailed setup guide or follow the quick start guide below which will download the installer and files directly from the repository. Start a terminal session and login as root.

Quick start guide

1. hostname: srv.example.com
2. yum -y install wget
3. yum -y update
4. reboot
5. cd /usr/local/src
6. wget https://centos-webpanel.com/cwp-el7-latest
7. sh cwp-el7-latest

• Control Panel Update Check every 4 hours

  Default version is 24 hours

• Unlimited number of accounts
• More advanced security limits per account
• Mod Security latest OWASP rules with automatic updates.
• Mod Security latest Comodo WAF rules with automatic updates.
• Varnish Cache Server advanced setup by using RAM as cache storage

  For best performances

• PHP selector option is enabled.

  Allows working with multiple php versions

• Slave DNS integration and Slave DNS Clusters
• Dashboard CPU/IO Live Performances
• Security advisor

  Checks your server and lets you know how to improve the security of your server (we continuously add new checks for the security improvement).

• Yum Package/Update and repository manager GUI
• Removes CWP donation blue notification box from the admin area
• Automatic update of service like: phpMyAdmin, Roundcube, etc.
• cPanel Migration tools
• CWP API

  Use with custom scripts or billing like whmcs to manage accounts

• PHP/PHP-FPM Selector

  Run multiple versions at the same time

• CentOS 7: cgroups

  Most advanced resource limiting for cpu,ram,disk I/O

• Security Tools

  Maldet Scan, RKHunter Scan, Lynis Scan, SymLink Scan

• Monit

  Advanced Server Monitoring with email notifications and service restart and actions

• Resellers Panel

  Reseller Panel is part of the user panel.

• Clustering manager
• Spamassassin

  Config and scan per mailbox

Our Thoughts

For the management of just one site – or a single user with a number of similar sites, the non-pro version of CWP will suffice. We have installed this for many users, some of whom have managed their own server and others managed by us and there is no downside in terms of functionality especially in the WordPress Hosting context:

• The YUM GUI for Server Software Package updates is not available – however, open a terminal and it is as simple as typing – ‘yum -y update’ hit return/enter and watch the update complete in the terminal
• The PHP and PHP-FPM selector GUIs enabled in the pro version are very cool, these enable the setting of a different version of PHP for every site selectable in the user control panel, however – if you have a small number of sites and are happy with the same version for every site then this can be set and updated easily in the GUI. We use PHP-FPM version 7.4 and upgrade as needed, which will be fine for most WordPress installations. However, even without the pro-version multiple versions of PHP can be installed using Yum and a different handler can be deployed in every directory (handler defined in .htaccess file) in the directory structure pro-version or not.
• The Varnish Web Server setup is enabled in the GUI for the pro-version, however, we find that the difference in web-server performance using Apache and NGINX when compared with various Varnish configurations is negligible in the WordPress context. So we do not use this even on our own servers where we have the pro-version installed. Also when using Varnish for the first time you will likely be scratching your head when your site updates do not appear to have gone live. However, an option to empty the cache does become visible when Varnish is enabled. The additional speed comes from the site content being stored in the web server cache which can have unexpected results.
• We do like the security tools – we used RKHunter for a long time. This and other similar tools can be obtained free of charge and installed separately.
• In the context of WordPress Security – the Mod Security GUI enabled in the pro-version is handy and we use it. However, there are a few workable alternatives. For a kick-off Mod Security is open source so can easily be installed and setup separately in the terminal, also its functionality can be duplicated at site level using security plugins.

For us those are the key differences between pro and non-pro. So the obvious question is – why do we use the pro-version and should you use the pro-version?

At $11.99 / year not only is it extremely good value for the convenience of having the above pulled together into a simple GUI – it knocks the competition out of the park on price. CPanel is one of the most popular Web Hosting control panels and unsurprisingly CWP has a very simple migration tool to move sites from CPanel.