Watch your website

How to ensure your site keeps working

I have spent hours this week trying to sort out a problem with a website that I manage for a client.

It seemed trivial. Just replace these about-to-expire SSL encryption certificates with new ones. The first problem: I only had a week to sort it out because earlier reminder emails had got 'lost in the system.' The second problem: it turned out to be very difficult to do. Better minds than mine were burning the midnight oil at our hosting company all week trying to get it working.

Admittedly, the site is an important one with a big audience and it runs on half a dozen servers in an underground bunker somewhere in England. Nothing is ever straightforward with a site like this. But I think the stress could have been avoided with more time. It reminds me of a sign I saw in Houston once. "Lack of preparation on your part does not constitute an emergency on my part."

Much closer to home, the domain name and hosting agreement for another site I run for my sister-in-law's oral history project are about to expire. It only costs a tiny, tiny fraction of the big site's hosting costs but it still needs to be sorted out. Everyone with a website faces the same problems. The difference is one of scale, not of kind.

Website worries

All this got me thinking about how necessary websites are to nearly every business these days. And how vulnerable they are to small oversights and problems. If you forget to renew your car's tax disc, they don't come along and take away your driving licence and crush your car. However, if you don't renew your domain name properly, you can lose your online presence overnight.

It's possible to put in an automated bid to buy a website name if it lapses. You can be a day late paying your renewal fee and some robot has bagged your name. This is perfectly legal. Luckily most, but not all, hosting companies auto-renew for you.

Another risk is that someone registers a domain name like yours but not exactly. I ran a flying website for a while called HappyLandings.net (I have since moved it to ModernPilot.com). It didn't bother me that someone else had registered HappyLandings.com - note the last three letters - because they were a company that made padding tiles for playgrounds. No confusion there. But for a couple of years a well known London theatre had a .co.uk address and the exact same name but ending .com took visitors to a hardcore pornography site. This kind of impersonation or traffic theft is widespread.

Service outage

Another website risk is that the hosting company has a service outage. They might promise 99.99% uptime but even that means the site will be unavailable for eight hours a year. Many hosts don't give any kind of SLA at all. If the punters can't see the site, they can't buy from it.

Monitoring availability and bandwidth is important but so is making sure the site hasn't been hijacked. Hijacking can happen in subtle ways. People can use the site to host pirated movies or porn and happily share the files with people without you ever knowing; at least until the bandwidth bill thumps onto your doorstep. Less common, but equally troublesome, is vandalism and threats of extortion against your site.

Protect yourself

So, what can you do to protect yourself? The main defence is very low tech: a calendar. Clearly flagging up when certificates, domains and contracts must be renewed will avoid a lot of problems. Similarly, keeping the hosting company informed when your technical contact changes will make sure you keep getting important reminders.

Picking reputable hosting companies with service level agreements and plenty of bandwidth also helps. Avoid companies that put a ceiling on the amount of traffic your site can deliver without a surcharge. Register the most obvious misspellings of your domain name and also as many different top-level domains as possible for your site (these are the bits at the end like .co.uk and .com). This will prevent a lot of site hijacking.

Consider splitting domain name management from hosting so that you are not beholden to any one provider. For extra assurance (and at extra cost!) companies like Envisional will monitor the net for sites pretending to be you. Finally, there are monitoring services, such as SiteMorse, which will continually monitor the availability and performance of your site.

What next?