The issue started early Monday morning and was caused by substantial denial of service type attack by an extremely large volume of mail being sent to a specific mailbox.

To make sure this does not occur we have implemented new emergency response processes with our upstream providers, meaning they will have the authority to act immediately without our contact in similar situations. This will ensure that outages like this do not occur in the future.

In addition to the new processes, we are also hiring and training a new in-house technician to make sure you get the quickest responses and communication in the future.

Many of our attempts to respond to incoming tickets failed due to email addresses being hosted on the server where the problems were occurring. Please ensure that you are using an email address that is not hosted with us when creating tickets during outages – particularly those involving mail problems. It is also important to note that telephone support is only included in our Support enabled packages. For those without Support, we are more than happy to respond to a telephone request via email as long as you leave an accessible email address in your voicemail.

We understand the importance of email and we apologize for any inconveniences this has caused. We believe these changes will not only prevent a similar situation, but will allow us to continue to offer you with the best service in the industry.

For best updates and information you can follow us on twitter.

When you upload content via FTP you use your personally selected username and password combination. The username you selected also becomes the owner of the files you upload. Similarly, when you attempt to delete files uploaded through an application like Wordpress, since they are not owned by your account, you are unable to delete them. The apache user has control over the files.

Although you could get the root user to change the ownership or permissions of the files to allow your account access, this requires creating a support ticket every time you run into the problem. Rather than fixing the problem reactively, we suggest fixing it proactively; ensure that files uploaded through Wordpress are already owned by your personal user account rather than apache.

How do you do this? FastCGI!

Within Plesk under Web Hosting Settings, there is an option to run PHP through FastCGI. By changing this setting from Apache Module to FastCGI, you are changing the user that PHP files are accessed with.

Since all of your PHP files will be executed by your own personal username, all files uploaded through your PHP application will also be owned by your user account. No more apache account in the mix and no more non-deletable files!

One additional benefit is that your files are not owned by the apache user any longer. You might remember that it was beneficial, for security reasons, to have your files not writable by users other than apache, but that only applies when you are forced to upload them under that user account. Since the apache user would be the same for all files uploaded across all websites hosted on the same server, if that account were hacked, then the hacker would have access to all files created by it (if they knew where to look). Now that your files are being uploaded under your personal user account, no other website can affect the security of your own files (assuming permissions are also set appropriately – ie: no ‘777′).

If you have any questions about this process or believe some of information provided here could be clearer, please contact us with your suggestions – we would love to hear from you!

How and why do websites get defaced, hacked, or corrupted?

Most sites are compromised by known vulnerabilities in outdated web-based scripts and applications. Simply put, this means if you run outdated versions of popular software such as message boards, blogging software, or content management systems, your website could be at risk. Other ways a website is commonly compromised is due to insecure or stolen passwords and incorrect file permissions.

Why would anyone want to hack my website? I don’t store any personal or financial information on my site so I shouldn’t worry about this right? Many people feel that because they think no one wants to compromise their website they don’t need to worry about its security. Stop it.

Although they may not want any of the information on your site, most of the time your site will be used to spread viruses, spyware, or deceive your visitors into going to sites with them. Most compromised sites we see have malicious code injected into the files in order to do just this.

Here are a few things you can do today to make sure your website is better protected.

Start locally

Make sure your personal computer is secure. If you use an FTP program to upload content to your website, chances are that you have the username and password saved within it. Depending on how that program stores this data it is possible to have that info stolen if your computer has spyware or a virus.

We recommend installing a virus scanner and regularly scanning for spyware along with being more cautious of where you are surfing online.

Update and patch your third-party applications

Most website security issues can be avoided by being proactive with updates and security fixes issued by the authors of your applications.

Many popular applications now have a one-click update that takes less than 30 seconds to perform. It is recommend that you backup your data before upgrading which can usually be done through your Control Panel.

If you stop using an application make sure you remove it. If you’ve switched from Wordpress to Joomla for your content management, make sure you remove the Wordpress installation as it can be forgotten about and left outdated. Even though you may not be using it, it can still be accessed.

Remember that updates, patches, and new releases are released for a reason. Staying on top of these updates may seem like an inconvenience at the time, but it will save you from a lot of headaches and issues in the long run.

Checking file permissions

Allowing everyone to read, write, and execute files on your website is a huge security issue. In a web-based environment you typically will want a “755″ permission setting, or full access to the file owner, and only read/execute access for everyone else.

Some applications will ask you to set a permission to “777″ or full access to everyone. Make sure you are running the most up-to-date version of this application before installing. Also, you may want to try it with a 755 as some hosting environments will for this.

Secure your login areas

It is best to access the administration area of any application over SSL (https://). This can be done by making sure it is placed in a ssl-based directory.

In addition to this, it is possible to limit the admin directory to only specific IP addresses. This can be done by placing the following information into a .htaccess file:

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName AdminAreaAuth
AuthType Basic
order deny,allow
deny from all
# allow home IP address
allow from 99.x.x.x
# allow work IP address
allow from 142.x.x.x
# allow vacation home IP address
allow from 24.x.x.x

For example, if you wanted to secure the admin area of your WordPress installation, you would place this .htaccess file in your /wp-admin/ directory. It will deny all connections that are not made from one of those predefined IP addresses.

—
Hope this helps. Interested in hearing more on a specific topic? Let us know!

The datacentre and hosting industries have seen a huge green push over the last several years and it is interesting to see a client with the purchasing power of the Canadian Government make an announcement like this.

With space being such an issue in data centers, it is easy to sacrifice energy efficiency with space efficiency. Although much attention has been put on making data center infrastructure and design more energy efficient, it’s nice to see a push to get the servers in those data centers more efficient as well.

Lydia Aouani of Natural Resources Canada said “Soon, any server purchased by our government will be Energy Star (certified).” She also noted that “If all data centers were using state of the art energy efficiency technologies, by 2011 we would go back to our electricity consumption levels of the year 2000,”

1. Open Mozilla Thunderbird

If you do not already have Thunderbird installed, please visit http://www.mozillamessaging.com to download it. Once downloaded and installed, Thunderbird can be found as an icon on the desktop entitled “Mozilla Thunderbird” or from the Start Menu under ‘All Programs/Mozilla Thunderbird/Mozilla Thunderbird.’

2. Add a New Account

When you launch Thunderbird for the first time you will be prompted to create a new account from a variety of types. Please choose Email account and click Next. If you have already launched Thunderbird and are not presented with the Account Wizard, please choose Tools > Account Settings > Add Account.

3. Configure Your Identity

Enter your name and email address in the requested fields.

4. Configure Your Server Settings

Choose IMAP as the account type if you need to access your email from multiple locations or POP as your account type if you are only planning to access your email from the one computer.

The Incoming and Outgoing Server fields should both be set to mail.yourdomain.ca

5. Provide your Username and an Account Name

Enter your full email address under the Incoming User Name field and choose Next. You can make the Account Name whatever you like. Choose Next, then Finish.

Thunderbird will now attempt to retrieve your email. Enter your password when requested, and check the box to remember your password if you wish to have it automatically check for email on a regular basis.

1. Getting Winamp and the SHOUTcast Plug-in

Download and install the latest version of Winamp 5.x. This can be downloaded from winamp.com.

Download and install the SHOUTcast DSP Plug-in for Winamp 5.x. This can be downloaded from shoutcast.com.

2. Finding the SHOUTcast Plugin Configuration

After you’ve installed both Winamp and the DSP plugin, open winamp and click on the top left corner, and select Options and then Preferences.

Scroll down to the bottom and click on “DSP/Effect”. This should populate two plugins in the list to the right. Click on the one that reads “Nullsoft SHOUTcast Source DSP v1.9.0 [dsp_sc.dll]“, and then click “configure active plugin”.

3. Connecting Winamp to the Web Savers Server

You should now have the “SHOUTcast Source” window open. Click on the “Output” tab. About half way down you should see fields labeled “Address”, “Port”, and “password”. Change these values to what you’ve received from Web Savers’ staff.

Click “Connect” near the top, and check the box that says “Connect at Startup”. You are now connected and streaming to the SHOUTcast server. If you check the url http://yourip:port it will show the server as online.

4. Specify the Encoding Bitrate

Click on the Encoder Tab, under the Encoder Settings, pick the kbps that you signed up for during the order process, 24, 48, 64, or 128 kbps. If you have not ordered yet and are unsure what these options mean, generaly speaking the higher the bitrate (in kbps) the better the quality of audio. If you are planning on playing music we suggest a bitrate of at least 64kbps, though 128kbps certainly sounds the best.

5. Configuring the Music Source

Click on the Input Tab, and make sure it reads Winamp under Input Device. This will broadcast whatever is playing in winamp onto the SHOUTcast server. If you have a microphone or another sound device hooked up, you can select it from this drop down list and it will switch from the song playing to whatever device you choose. So if your song is coming to an end and you want to start talking, or if you’ve had enough talking and would like to start some music again, you would be switching this between “Winamp” and your microphone input.

6. Test it out!

Since you have just configured Winamp to take anything playing and feed it to your SHOUTcast server, to test it out you simply need to start playing an audio file. To do this you will need to double click on an existing song in your media library. If you have no songs in your Winamp media library, drag and drop an MP3 or other audio file on to the Library. The link to follow to listen to your station is http://yourip:port/listen.pls. If you have registered a domain name and visiting http://www.yourdomain.com shows your Web Site or a Plesk splash page, then you can also use http://www.yourdomain.com:port/listen.pls.

1. Open Outlook Express

Outlook Express can be opened by clicking on the start menu, choosing “All Programs” then choosing Outlook Express. It can often be found right in the Start menu second from the top, as well as beside your Start button in the taskbar or directly on the desktop. If a dialog box pops up asking you to enter a display name please skip to step 3.

2. Add a New Account

Now that Outlook Express is open, you will need to add your mail account to it. To start this process, click on the Tools menu and then choose Accounts. This will open a window labelled “Internet Accounts”, from here click on Add and Mail.

3. Completing The Internet Connection Wizard

You should now have the Internet Connection Wizard open asking to enter a display name. This is the name that will appear in the “From” field when you send emails. Entering your full name will do the trick.

The next screen will ask you for your email address. Enter your full email address in here.

Next, it will ask you for your incoming and outgoing mail servers. Keep the mail server type as POP3 and enter mail.yourdomain.com for the incoming and outgoing mail server.

The last information that needs to be entered is your username and password. The username needs to be your full email address, not just the prefix. ie. adam@websavers.ca not just adam. Your password will show up as black dots so be sure you entered it correctly.

On the last window, just click Finish, but don’t close the internet accounts window. If you already did, see step 2 for details on how to get it back open.

4. Configuring The Outgoing Server

Although you have already provided Outlook Express with the outgoing server address, it will also need to be configured to allow your account access. To do so highlight the account in the internet accounts window and select properties. This will open a new window, on which you will click on the “Servers” tab. You will notice the info that you provided during the wizard is shown here. Looking at the bottom of the pane, check the box that says “My server requires authentication” underneath the Outgoing Mail Server title. Now choose the Advanced tab. At the top of the window you will see “Outgoing mail (SMTP)” with the number 25 beside it. Change the number 25 to 587.

Note: If you later discover that you are not able to send any mail, then your ISP is blocking all outgoing servers except their own. In that case you will need to follow the directions for this step once again, and change the 587 back to 25 and under the Servers tab, change the Outgoing mail server setting to their server address. You will need to call your ISP in order to obtain this address. You will also need to ask them if their server requires authentication or not: if it does, check the box near the bottom of the Servers tab, click Settings and fill in your account information for your ISP. If it does not require authentication, uncheck the box.

5. Leave Messages on Server for Webmail

When Outlook Express downloads a message from the server using POP3 it will then remove the message from the server. If you wish to keep a copy of your messages on the server – so that you can view them in webmail – we will need to configure it specifically to do so. Please remember that the storage of your mail also counts towards the total storage of your web hosting account.

To ensure mail is left on the server for access via webmail, you will see an option to “Leave a copy of messages on server” at the bottom of the currently open “Advanced” tab. Check this box as well as “Remove from Server after [ ] day(s)”. Enter the number of days you wish to have the mail remain on the server for. We recommend up to 30 days. Now click okay and close the internet accounts window.

6. Send and Receive

Your mail account is now added to Outlook Express. To download your messages, click the “Send / Recv” button on the top tool bar. If you encounter any errors please double check your username and password for the incoming and the outgoing server as well as the spelling of the mail servers before contacting support. If you find you are unable to send email, but can receive it fine, please read the second part of step 4 – it outlines how to solve this problem.

1. Open Apple Mail

To start following along, simply launch Apple Mail – the postage stamp icon in your dock or Applications folder.

If this is the first account you will be adding to Apple Mail, then you will be presented with the new Account wizard automatically. If you already have an account configured, please choose File > Add Account.

2. Add a New Account

Fill out the fields as you like, the screenshot is provided as a guide only. If you do not yet have this email account created in Plesk, please login using the Client Login button on our website and add the mail account to the server.

3. Allow our Server’s SSL Certificate

If this window pops up, choose “Show Certificate”

Now check the box beside “Always trust [server_name] when connecting to [your_domain_name]“. The [server_name] is the name of the server your website is hosted on. With this prompt, Mail is telling you that it will be making a secure connection to the server. If you are hosted on one of our shared hosting plans, then the server name will never match your domain name – causing this verification to be required by you. Please ensure that the server name is something.websavers.ca, such as basil.webasvers.ca or oregano.websavers.ca. If it does not end with websavers.ca then there may be a problem – please cancel the dialog and contact our support.

If you receive a prompt like this during any part of the configuration process, please do exactly the same thing.

4. Configure your Incoming Mail Server

This allows you to receive email. You can choose a POP or IMAP server type. When connecting via IMAP, you will be able to access your email through both webmail and Apple Mail at the same time with no discrepancies between the two. Often IMAP is the account type of choice for this reason. However, if your emails are of high security, we suggest using a POP account type. With this account type, Mail will download your emails then remove them from the server, ensuring the content of the emails remains entirely in your own hands and not on the server.

You may enter whatever description you like. The Incoming Mail Server will always be mail.[your_domain] as you see in the screenshot. Make sure you use your full email address as the username – Apple Mail will default to just the first part ‘johnny’ rather than ‘johnny@treeplanting.com’. Provide your password and choose Continue.

5. Configure your Outgoing Mail Server

This will allow you to send email. Enter in whatever description you like. The outgoing mail server will always be mail.[your_domain] such as mail.treeplanting.com in the example screenshot. Please ensure that you check the box beside “Use Authentication” and provide the same username (the full email address) and password as in the previous step. Click Continue.

6. Finish the Creation of the Account

Check to see if you entered any of the details in wrong. If everything looks correct, choose Create. Your email is now configured for Apple Mail. Please send yourself an email – preferably from another email account – in order to test the receipt of new mail. Then reply to that email to ensure you can send email as well.

For example, if you have a Gmail account, login to Gmail and send an email to your new address. Open Apple Mail, look for the new email from your Gmail account and reply to it. Verify in your Gmail account that you received the reply.

Shared Hosting

If you are not paying for traffic to your website or paying for search engine marketing initiatives, a shared hosting plan will likely fit your needs. The exception here is if your website and email are critical to your business. We understand that most websites and email are critical, but ask yourself this: Will I lose money if my website or email happens to go down? If you answered yes, you may want to look into a less shared environment by requesting it or looking at a virtual private server option.

Once you know that shared hosting is your best option, you can narrow down your choice depending on how much traffic and how many domains you will need.

Virtual Private Servers

If you are a designer or developer or a company that builds or markets websites, having a virtual, dedicated environment will be extremely beneficial. Not only will you be able to customize the hosting environment to your needs, you can feel better knowing that no other sites will have an impact on the performance of your customers’ websites.

A VPS is also great if you require scalability. If you are planning to expand your website to match the rate of growth of your business, then your hosting needs to scale with it, making a VPS your best solution. More memory, or CPU resources can be quickly added without even having to reboot your server.

Dedicated Server

VPS solutions are slowly shadowing out the dedicated server for most hosting needs. However, if you require a lot of resources – such as for a hosted application for your business – this may be your best option. However, If you do not know Windows or Linux system administration this option can become quite expensive.