Is it feasible to self host websites for small businesses? I’m trying to do some research on the amount of infrastructure and stuff you have to know from a security standpoint… I’m fine with building and hosting stuff locally for me but I’m tempted to move to hosting some of my business sites as well.
Does anyone have experience and can give me some advice one way or the other?
It depends on what it is really + convenience. There are lots of morons out here running basic info sites on full beefy datacenter VMs instead of a proper cloud webhost service.
The most you’d be getting out of cloud is reliability. Self host assumes you don’t have any bottlenecks (easy enough to pass), but also 99% uptime which is impossible unless you are running with site redundancy (also possible, but I doubt how many people own multiple properties with their own distribute or private cloud solution).
if 95% uptime is acceptable, and you don’t live in an area with outage issues from weather, I’d say go for it. Otherwise, you can find some pretty cheap cloud solutions for basic websites. Even a cheapo VPS would probably work just fine.
Self hosting websites? Easy
Self hosting something for a business? Run for the hills. It will not end well and you would be much better off with something more business standard.
As someone who’s set up and managed critical business applications I would say that it’s perfectly fine to host your own provided you have decent hardware that’s capable of doing what you need and as a dedicated business line to provide connection.
If you try to run mission critical business applications on a home internet connection you’re going to have a really bad fucking time. But hosting business critical applications on appropriate hardware and a 1Gb/s business connection with an SLA is going to meet 95-98%% of all business applications.
If something like that sounds expensive or too difficult to do then it’s too expensive or too difficult for you to host yourself. Just go with a provider and sidestep self-host.
Is it feasible to self host websites
yes
for small businesses
NOPE
Well, you say your business sites, so I assume you’re okay with downtime. I would absolutely not self-host sites for someone else’s business, because if something happens to the hosting (ISP outage, power outage, bad update, hardware failure, accidental deletion, misconfiguration, ISP block, flood/fire/storm, theft, I can go on) then it’s my ass on the line. Simple hosting is cheap, spend the few bucks for a lot more peace of mind.
Exactly. It’s not just downtime to worry about, either. It’s disks filling up. It’s hardware failure. It’s DNS outages. It’s random DDoS attacks. It’s automated scans of the internet targeting WordPress. It’s OS, php and database upgrades. It’s setting up graphing, monitoring, alerting and being on-call 24/7 to deal with the issues that come up.
If these businesses are at all serious, pay for professional hosting and spend your time running the business.
Yeah, pay somebody else to be responsible for the server uptime and the bandwidth. Somebody who specializes in providing that.
I think the answer depends a lot on the use case of each business’s website and what the business owner/employees expect from it.
Is the website a storefront? You’ll be spending a lot of time maintaining integration with payment networks and ensuring that the transaction process is secure and can’t be exploited to create fake invoices or spammed with fake orders. Also probably maintaining a database of customer orders with names, emails, physical addresses, credit card info, and payment and order fulfillment records… so now you have to worry about handling and storing PII, maybe PCI DSS compliance, and you’ll end up performing some accounting tasks as well due to controlling the payment processing. HIPAA compliance too if it’s something medical like a small doctor’s office, therapist, dialysis clinic, outpatient care - basically anything that might be billable to health insurance.
Does the business have a private email server? You’ll be spending a lot of time maintaining spam filters and block lists and ensuring that their email server has a good reputation with the major email service providers.
Do the employees need user logins so that they can add or edit content on the website or perform other business tasks? Now you’re not just a web host, you’re also a sysadmin for a small enterprise which means you’ll be handling common end-user support tasks like password resets. Have fun with that.
Do they regularly upload new content? (e.g. product photos and descriptions, customer testimonies, demo videos) Now you’re a database admin too.
Does the website allow the business’s customers to upload information? (comments/reviews/pictures/etc, e.g. is it Web 2.0 in some way) god help you.
You’re going to expose this to the public internet. It will be crawled, and its content scraped by various bots. At some point, someone will try to install a cryptominer on it. Someone will try to use it as a C2 server. Someone will notice that you’re running multiple sites/services from one infrastructure stack and attempt to punch their way out of the webhost VM and into the main server just to poke around and see what else you’ve got there. Someone will install mirai and try to make it part of a DDOS service provider’s network.
If you’re very comfortable with containerization, networking, and security practices, plus you are a pretty decent full stack web dev, sure.
It’s pretty trivial to set up a separate business internet line from your local ISP. Depending on the volume of traffic, a basic load manager and reverse proxy, combined with strong firewalls and container safety would be sufficient for most SMB needs.
You don’t need much power to host a basic website. Setting up a local box with a low-impact distro, Docker, and some solid control-plane MGMT software should be plenty to host several dozen SMB websites.
There are a lot of technical and even legal considerations though. Do these small businesses need a web app on their site? Do they need a storefront? What about member-only content locked securely behind an authentication layer? Does your local ISP have rate limitations? Does your city/state/country have restrictions on offering business services like that? What is your liability if your setup gets hacked and your client’s data is stolen/exposed?
Ultimately, you have to answer the question: Why shouldn’t those businesses just go with an easy pre-made hosting solution like Squarespace, Wix, etc? Not saying there aren’t good answers to that, but from a business perspective, the businesses will want to know that.
As with anything in business, ask yourself, what are you able to offer that they can’t get easily somewhere else? I used to work for a tiny MSP that offered in-house data backups. Our clients paid a good chunk of money to have us backup their data to our own servers. I didn’t say anything at the time, but our clients could have gotten much more secure and faster backup services for cheaper using something like Backblaze or Synology’s S2 cloud backups.
Don’t find yourself unable to clearly and concisely explain to your clients what you can give them that they cannot easily get somewhere else. If it’s purely the principle of the thing, that’s totally valid, but make sure that’s what you’re selling to them, and also what they are looking for.
If you’re in Canada, Rogers (nee Shaw) and Telus small business plans both offer ‘static’ IPs (Shaw’s residential plans aren’t officially static, but they rarely change on a residential modem unless you are always switching out hardware). Telus business fibre 1GB plan offers up to 5 static IP addresses.
Then you must purchase one or more domain names and assign them to your IP address… depending on your business’s needs even small consumer hardware can run a web server just fine.
Have a backup strategy though! And be sure you actually test the restore procedure on a periodic basis!
Linux backups can range from home-grown ‘rsync’ scripts and hot-plug external drives as backup, to more fancy ‘Time Machine’ like backup things (I honestly forget what’s out there for Linux right now, I have my own rsync scripts to back up to external drives).
My home server is my own, but if money is on the line you want proper backup and failover even. Most Linux distributions are easy-peasy to set up with Apache or nginx web servers but if you’ve never set those up you’ll need to study lots of tutorials and manual pages.
If you don’t want to tend to security and backups yourself though, it might be best to find a hosting service.
If its just a simple static page. Just use cloudflare pages. It scales to zero and would probably be completely free for your use case.
Vercel is even easier to setup but they don’t allow businesses on the free tier so it would be $20 a month for pro plan.