Notes from the platform.
Hosting write-ups, infrastructure notes, and the occasional postmortem. No newsletter filler.
Guides
SPF, DKIM, DMARC without breaking your email
Email authentication is one of those things every hosting customer needs, almost nobody explains well, and a lot of tutorials get subtly wrong. This is the version we wish we had when we started: what each record does, the specific ways people break them, and the order we recommend rolling them out.
Engineering
Why we picked LiteSpeed over Apache+Varnish for our WordPress customers
Every hosting provider eventually has the stack-choice conversation. We landed on LiteSpeed Enterprise with LSCache for WordPress workloads, despite loving Apache plus Varnish for other things. Here is the honest version of that comparison, including the cases where Apache plus Varnish still wins.
Security
Hardening wp-config.php: the checklist we run on every site
wp-config.php is the one file every WordPress site has and almost nobody audits after install. This is the checklist we apply on every site we provision, with each setting explained so you can decide whether it fits your site rather than copy-pasting and hoping.
Engineering
How we handle customer backups (and why we don't trust "free daily backups" alone)
Every hosting provider advertises "free daily backups". That phrase is doing a lot of work. Here is exactly what our backup setup covers, what it does not cover, how often we actually test restores, and what we think customers should do on top.
Engineering
Why we chose a CDN partner instead of building our own edge
A one-person operation has no business running its own edge proxy across the planet. Here is why we route through a partnered CDN, and what we actually checked before picking one.
Guides
The complete guide to CDN cache tuning for WordPress
Most WordPress sites behind a CDN run at roughly a 30% hit ratio because the defaults are too cautious. This is the tuning we walk customers through: cache headers, cache-key normalization, bypass rules, and stale-while-revalidate.
Engineering
What latency you can actually expect, and how to measure it yourself
No reseller invents the speed of light. Here is how to measure real latency to your origin region and to the partnered CDN edge, what numbers are reasonable, and why.
Security
PCI-DSS for SaaS: what we learned
We finished our PCI-DSS Level 1 assessment last quarter. It took 14 months, three QSA conversations, and a network segmentation rewrite that shrunk our CDE to 12% of infrastructure. This is what we would tell ourselves on day one.
Engineering
Running JavaScript at the edge: what it is, when it helps, what it costs
Edge compute lets you run small bits of JavaScript at a CDN PoP instead of at your origin. It is genuinely useful for some jobs and a bad fit for others. Here is a plain rundown so you can tell the difference.
Contact
Topic suggestions or corrections: [email protected].