Slot 08 New server setup and security Service
A new server, set up properly and locked down
From bare install to tuned, firewalled and secured, on cPanel, DirectAdmin, Plesk or a plain Linux box. The panel changes where things live, not what has to be true.
Slot 38 Build sequence 9 layers
Nine layers, in this order
Order matters. Putting up a firewall before you can reliably get back in is how people lock themselves out of a production server at midnight.
Base system and identity
Updates applied, hostname set correctly, licence confirmed, nameservers pointed where they belong. Everything after this assumes it.
Remote access
Key-based SSH, root password login off, port moved off the default. The new session gets tested in a second terminal before the first one closes.
Firewall
CSF configured with the ports your panel actually needs and nothing else, with alerts going somewhere a person reads.
Web application firewall
ModSecurity with a maintained ruleset, tuned against your real traffic. False positives get tuned out. The module does not get switched off.
Web server
Apache, Nginx as a reverse proxy, or LiteSpeed, chosen for the workload and then actually tuned. Worker limits, keepalive, compression, caching.
PHP
Versions chosen per site, end-of-life versions retired, dangerous functions disabled, limits set to what the applications need.
Database
Buffer pool sized against the real dataset and the real memory, slow query log on, and a look at what is actually slow.
Backups
Scheduled, offsite, and proven by restoring one. Retention set to something you could survive a two-week-old compromise with.
Monitoring and mail
Alerts for disk and inode exhaustion and mail queue floods. SPF and DKIM set up, and outbound sending limited so one compromised script cannot burn the IP.
Slot 30 Coverage Any panel
Whichever panel it runs
cPanel and WHM, DirectAdmin, Plesk, or a plain Linux server with no panel on it at all. The nine layers above are the same list in every case. What moves is where the setting lives: CSF is configured the same way on all of them, but PHP versions are handled one way by cPanel, another by DirectAdmin, and another again by Plesk, and each of the three leaves something on defaults that should not be.
The judgement is the part you are hiring. Whether your buffer pool should be 2GB or 24GB, and whether the firewall rule that just blocked your checkout is a false positive, are not questions any checklist answers. Some of the mechanical steps are automated in my open-source tooling.
- Panels
- cPanel / WHM, DirectAdmin, Plesk, none
- Systems
- AlmaLinux 8/9, CloudLinux 8/9, Debian, Ubuntu
- Web servers
- Apache, Nginx, LiteSpeed
- Firewall
- CSF, ModSecurity
Slot 20 Also covered
Things that get skipped, then bite
- Update policy chosen deliberately, not left on whatever shipped
- Unattended security updates, with a reboot policy you agreed to
- Inode monitoring, because disk-full alerts do not catch inode exhaustion
- Mail queue alerting before a compromised form floods it
- SSL coverage checked, and renewals confirmed working
- Log rotation that actually rotates, on a server that will fill up otherwise
- Timezone and clock sync, so timestamps in logs mean something
- A written record of every change, so the next person is not guessing
Slot 08 Price list Starting figure
What a build starts at
One figure, because it is one job. An empty box is the quick end of it. A server already carrying live sites takes longer, because the changes are staged and reversible.
| Server setup and hardening All nine layers above, on one server, handed over with a written record of every change. | from $99 per server |
|---|
Final quote depends on the size of the server and what is already running on it. The form takes 60 seconds and I reply with a fixed number.
Slot 04 Questions FAQ
Questions I get asked
Does this only apply to cPanel servers?
No. The panel is the last layer, and the nine below it are the same whichever one you run. I build and harden cPanel and WHM, DirectAdmin and Plesk servers, and plain Linux boxes with no panel at all. What changes between them is where the configuration lives, not what needs to be true at the end of it.
Which systems do you work with?
AlmaLinux and CloudLinux 8 and 9 for panel builds, Debian and Ubuntu for plain servers, with Apache, Nginx as a reverse proxy, or LiteSpeed depending on what the server is carrying. If you already have a preference I will build to it. If you do not, I will explain the trade-off instead of picking silently.
Will this break sites that are already running?
Securing a server that already has sites on it is done differently from building an empty one. Changes go in an order that can be reversed, the web application firewall watches before it blocks, and PHP version changes are agreed with you rather than applied wholesale. If a change is risky you hear about it first.
Do you set up backups?
Yes, and I restore one to prove it works. A backup job that has never been restored is a hope, not a backup. Destinations are offsite, because a copy living on the same machine as the original is not a backup either.
How long does it take?
A new server with nothing on it is usually a few hours from bare install to handed over, including the checks. Securing a busy production server takes longer because the changes are staged, and the timeline depends on how much can happen inside your quiet hours.
Slot 03 Other services
Other things I do
- Website and server moves Your sites, databases and email, moved without downtime.
- Ongoing server care Your ops person, without the hire.
- Website design and build A fast site with no hosting bill, or WordPress kept properly maintained.
- WHMCS billing and signup design A signup and billing area your customers can actually get through.
Slot 02 Contact Reply within 1 business day
Get the server built properly
New box, inherited box, or one that has been running on defaults for three years. Tell me what it runs and what it needs to survive.