Tell me about the potential pitfalls of hosting websites for smalltime clients?

December 6, 2011 12:55 PM

I'm a graphic designer who does a bit of freelance web stuff, but I’m by no means a web developer. I’ve recently started building teensy (a few pages, a blog, a basic paypal shopping cart plugin) Wordpress sites with customized themes for some tech averse self-employed/freelancer friends. I'm considering offering to host these on my web space for a small fee. What could go wrong? A lot of things, I'm sure... I just don't know what. Have you hosted multiple sites for other people on your web space? If so, what do you wish you'd known going in?

I know my way around PHP myAdmin, etc and I’m comfortable with setting up and basic troubleshooting of Wordpress installs (in an amateur-unfriendly environment at nearlyfreespeech.net). I can't write an .htaccess line off the top of my head, but I know how to google up what I need.

Some friends/clients of mine don’t have the skills to move beyond Wordpress.com, but want more functionality and have a bit of money for a redesign. But they don’t want to pay $10/month forever, when they need only a teensy bit of bandwidth. So I thought I could package X years of me babysitting their site into my initial design/setup fee. From their perspective this would make the whole issue of setting up a new website a LOT simpler and less daunting. They give me money, site goes up. They don't have to ever know what DNS is.

The plan is to have all of the sites on one nearlyfreespeech.net account, their domain names secretly redirecting to subdomains, each with a separate database inside my SQL process. However I’m also considering Dreamhost… for the one-click Wordpress updates, mostly, because updating the Wordpress core on nearlyfreespeech is a pain and requires lots of permissions-fiddling.

How can I make sure the sites are secure and my clients don't drive me crazy? Should I move to Dreamhost? Nearlyfreespeech is cheap, but offers minimal-to-zero customer service... what precautions against catastrophe would you recommend in this situation? Should I have the sites backed up somewhere else? My plan so far is just: clients would have posting but not admin privileges on their own site, no FTP access for them except through the wordpress upload interface. Is there something I'm missing?

posted by 100kb to Computers & Internet (10 answers total)

I'd just make sure you're backing up the sites. I do this for a handful of my clients, and haven't run into any issues yet (*knocks on wood*). I use Dreamhost, which I believe does backups, but I also backup the database to my site regularly, and the actual files get backed up a little less regularly (because I have most of them on my system already).

The thing is, I don't *really* make a ton of money off of it, so I'd rather they just handle it - but uptime has also been good, so they're not breathing down my neck. I'm sure if the site went down for a couple of days it'd be a) out of my control, and b) something they might start complaining about. Unless you think you can make a lot of money out of the deal, I think you're better off just letting them handle it on their own.

Oh, and nearly all my clients are small enough that I use google apps for your domain for their emails. I'd recommend you do the same - it seems a bit more stable than Dreamhost hosted mail, and they'd probably be more inclined to turn to Google if things go awry, then to you.
posted by backwards guitar at 1:13 PM on December 6, 2011

One problem with this is that you are stuck babysitting these sites even if you move on and do something else. What happens if you land a dream job in one year and your clients have paid for 5 years? You need to ensure you have enough money to either move them to a new host or that part of the agreement is that you can stop at anytime.

(from experience)
posted by dripdripdrop at 1:38 PM on December 6, 2011 [1 favorite]

dripdripdrop: "What happens if you land a dream job in one year and your clients have paid for 5 years?"

This, absolutely.

There's also the liability issue- I imagine we're not talking about big-buck business here, but if your provider has problems, your clients are not calling them, they're calling you.

Also make clear what your policy is about changes ("Just this one little text change!") and software upgrades ("Your WordPress update broke my post!").
posted by mkultra at 2:19 PM on December 6, 2011

This is pretty much how I've worked with small clients in the past. They don't know (and don't want to be bothered with) domain renewal costs, hosting fees, Typekit subscriptions, etc. So I bundle it, charging a monthly fee to cover my expenses + 1 hour of maintenance / change requests per month. That fee is paid a year in advance. It helps maintain a relationship with the client, adds to a small revenue stream, and allows the client to change their minds. Just be sure to write a contract, even with (perhaps especially with) friends.
posted by Bora Horza Gobuchul at 2:39 PM on December 6, 2011 [1 favorite]

Another thing that can go wrong is the sites getting compromised. Security vulnerabilities are routinely discovered in WordPress and its plugins. This means you have to stay on top of keeping everything updated; and, even then, some vulnerabilities may get exploited before there are patches available. (See, for example, the recent timthumb attacks. Sites also get compromised when the website owners (or you, as the web contractor) get their PCs infected with malware or their passwords stolen via phishing attacks.

There are tools and services that can help reduce the risk and/or monitor for compromises, but these add a layer of complexity and potentially cost.
posted by maxim0512 at 4:29 PM on December 6, 2011

Response by poster: I already have a full-time job + freelance, and I'm aware I won't make any money off the hosting side of things. But it makes the whole design package more attractive, especially for technophobe clients. I'm just hoping the hosting side will be low-hassle. I don't foresee anything in my professional life which would cause me to drop it in the next 5 years, but I'm going to work on a succession plan anyway, in case I need to hand it off suddenly.

In terms of backups... just download the databases to an external hd once in a while?

Bora Horza Gobuchul Thanks for that contract! Super useful.

backwards guitar I didn't know about that google email service, I'll definitely look into it.
posted by 100kb at 4:30 PM on December 6, 2011

backwards guitar:

I use Dreamhost,

...and when they go down–as Dreamhost do often, spectacularly, and sometimes just cuz–all of your clients go down with you, all at the same time. Seriously, I encountered it way too much while I used them, and never for a single one of the reasons on that page. Their servers literally spontaneously broke themselves, over and over. And no, I never managed to beat a reason out of their support people.

I personally hate having people piggy-back on any of our accounts, but if you're going to do this, spend the money on a reliable host yourself for the underlying account. Bluntly, however, the options you've mentioned so far(Dreamhost, Nearlyfreespeech) incline me to suggest you not do it at all. Doing tech support sucks. Doing it for a bunch of people, even if individually they're pretty low maintenance, while you're also trying to do other things more central to your work(you said you're not a developer), sucks a lot. If you insist on doing it, then ease into it one or two people at a time(you didn't say how many).

Find your clients a hosting option that caters to tiny needs, if that's the real problem. If you want to offer them some kind of support arrangement on top, that's a separate thing.
posted by Su at 5:01 PM on December 6, 2011

I'm aware Dreamhost goes down - and a lot of sites do, but I've been pretty lucky. I think I've been down for an hour or so at most in the 4 years I've used them. I know others who've had nothing but problems with them too. They're one of the most popular sites on the web, their sites are bound to have gone down for someone.

I use Webfaction as well, and it's great - although the built in mail leaves a lot to desire, so if you're not using Google Apps for your Domain, you might want to consider something else.
posted by backwards guitar at 5:56 PM on December 6, 2011

Response by poster: Thanks for the input everyone! That's about what I thought it would be like.

Re: hosting choice...
It's good hear your reviews of Dreamhost. Everyone is always recommending it so I assumed it was super reliable. I've had 100% uptime at NFS for the 6-7 years that I've been using it. (Even when they moved my site to a new server setup.)

Thanks Su for the tip on asmallorange.com, they look pretty cheap for the scale of site I need. Unfortunately, when looking through their support forums it seems like their touted auto-update solution for wordpress (fantastico) is super buggy, and wordpress has an unfixed bug which, due to ASO's server setup, causes in-wordpress updates to fail. And so everyone is being told to update wordpress manually. One-click updates are a pretty big feature that I want in a host, if I'm going to move off NFS for building client sites. I'll keep an eye on them, though, and maybe move there in the future.
posted by 100kb at 10:28 AM on December 7, 2011

Another thing that can go wrong is the sites getting compromised. Security vulnerabilities are routinely discovered in WordPress and its plugins.

THIS. I've been helping small businesses with their WP sites without incident for over a year now, but recently one client's site was hacked. They are totally freaked out, and it has been stressful for me too, to try to figure out what happened and prevent it from happening in the future. You not only have to stay on top of security issues, you have to accept that it probably WILL happen eventually that somebody's site will be hacked, and what are you going to do then? Charge them to clean up the mess? Or do all that for what they've already agreed to pay? Make sure that's addressed in your contract.
posted by parrot_person at 10:04 PM on July 12, 2012