Category: Blog

  • Why does WordPress dominate the web?

    Why does WordPress dominate the web?

    When a product stands out from the crowd to the point where it blows away the competition, like WordPress, it's often due to a marketing strike force, and sometimes by luck. But WordPress is far from having stolen its place, and here's why.

    Open-source

    The open-source nature of WordPress has worked in its favor. The project has won over the community, and because the code is open to all, one of the largest developer communities has formed, contributing to its continuous improvement. This not only enables regular updates and feature enhancements, but also creates a rich ecosystem of free and paid themes and plugins. As a result, users can customize their sites ad infinitum, meeting almost any specific need within their budget. So you can build exceptional sites without buying a single paid module, and have confidence in the WordPress code, which is reviewed by a large community.

    Easy to use

    WordPress offers an intuitive interface that enables even beginners to create and manage websites without in-depth technical knowledge. While secure maintenance and advanced use require professional intervention, basic WordPress management remains very accessible to all. This opens the door to a wide range of users, from individual bloggers to small businesses and large corporations.

    An extraordinary community

    The worldwide WordPress community is a major asset. It offers an endless source of information and support to users through forums, groups, educational blogs, YouTube channels and meetups. This dynamic community fosters the exchange of knowledge and experience, making learning and problem-solving more accessible to all.

    Robust and versatile

    WordPress' robustness and versatility make it suitable for a wide variety of web projects. From personal blogs to complex e-commerce sites, WordPress can handle a variety of site types, making it attractive to a broad spectrum of users.


    WordPress' dominance of the web market is no accident. It's the result of a combination of ease of use, openness, flexibility, scalability and exceptional community support. WordPress also sets itself apart by letting you own your website, which can then be hosted by any web host.

    Together, these elements have created a platform that not only meets the current needs of web users, but is constantly evolving to anticipate and integrate future trends in the digital world.

    Looking for secure hosting with expert WordPress support? This is the this way !

  • New year, new era: Welcome to Portail LRob! 🎉

    New year, new era: Welcome to Portail LRob! 🎉

    The new year brings with it its share of renewal, and I'm delighted to announce an innovation that will revolutionize your experience with us: the launch of the LRob portal. This platform is your new point of contact for simplified, efficient management of all your subscription and support needs.

    Ordering made easy

    Subscribing to my annual services, such as thehosting and the webmasteringhas never been easier. With the LRob portalNow you can order directly online, in just a few clicks. Credit card payment adds an extra layer of convenience. No more manual quotes or transfers to activate or renew your services.

    Spread your payments Monthly

    For greater financial flexibility, the LRob portal now offers the option of monthly payments for our services. This approach facilitates your budget management by spreading the cost of subscriptions over the year. Ideal for companies of all sizes, this option ensures better financial planning while guaranteeing continued access to LRob quality services. It should be noted that annual payment remains the most advantageous option in terms of total cost. So you can choose between the convenience of monthly payment and the savings of annual commitment.

    Transparent, automated billing

    We know that managing invoices can be a headache. That's why the LRob portal store takes care of invoicing automatically. Once you've placed an order, or at each automatic renewal, you'll instantly receive your invoice, guaranteeing seamless accounting. You can also find all your invoices in your customer area.

    Reinvented Customer Support

    Visit LRob Portal support section marks a turning point in LRob's approach to customer relations. As the number of customers and support requests increases, it's vital to avoid requests getting lost in a sea of emails. Our dedicated ticket system makes the support request process clear and structured, while ensuring better follow-up. You can track the progress of your request in real time, enabling fast and efficient resolution.

    What's more, this innovation paves the way for the future integration of a dedicated support team, reflecting our commitment to continuously improving service quality and customer satisfaction.

    Visit LRob portal is not just a platform; it's a promise of efficiency and innovation. In this new year, I'm proud to offer you an enhanced user experience and look forward to accompanying you in your success.

  • Emails: 6 preventive tips to never receive spam

    Emails: 6 preventive tips to never receive spam

    Who wants to spend their days sorting through hundreds of spam messages in their mailbox? Who wants to risk receiving viruses, phishing or intimidation?
    Don't you? Then here are 6 ways to protect yourself from this waste of time. It's been 5 years since I implemented all these tips and I don't receive any spam.

    1) Never post your address publicly on the Internet.

    It can be tempting to display your email address on your website or networks to facilitate contact.

    But pirate robots are on the lookout for publicly displayed email addresses. They collect them and resell them on the black market to spammers and other malicious parties.

    For your information, a list of 100,000 addresses sells for just $15. Use the solution in point 2) instead.

    2) Use protected contact forms.

    Since you won't be displaying your e-mail address on your site, you'll set up a contact form that will send messages to your e-mail address. But a robot is perfectly capable of filling in a contact form, sending you spam here too.

    All contact forms must therefore be protected with an anti-bots system (Captcha).
    Some robots manage to bypass them (and sometimes humans will send ads via your form), but you should receive few enough to focus on useful e-mails.

    3) Never trust your e-mail address: Use e-mail aliases.

    There's no such thing as 100% security, and over a sufficiently long period of time, any site on which you're registered with your email address will theoretically be hacked. Whether it's a government site, an institutional site or a major corporation, almost all of them have had their data leaked, even the biggest. Also, your contacts can be hacked and their address books recovered.
    So it's not a question of "if" but "when" your e-mail address falls into the wrong hands.

    You can check if your email address has been leaked in a data breach here : https://haveibeenpwned.com/

    To avoid giving out your real e-mail address, the only way to save yourself is to use aliases. Choose a service provider who (like me) allows you to create unlimited e-mail aliases. And not aliases derived from your real address, which would make it easier to find it, but independent aliases. So you'll create an alias for each service provider on which you'll set up an account. An account on laposte.fr: give them the email "laposte@mondomaine.tld". Mails sent to this address will fall directly into your inbox. So if one day you notice spam in this box, you'll automatically know which service provider has leaked your address. All you have to do is create a new alias for this provider, change the e-mail address on your account, and delete the old alias. And remember, put an alias on your business card too, and only reply with your "real" address if you trust it. If the worst happens, you can always rename your mailbox and use the old one as an alias (see point 6).

    4) Check the redirections to your mailbox.

    In time, you may have created mailbox redirects to your own. While this may be practical for a transitional period, it's not a viable long-term solution. Not least because any spam received by the original mailbox will then be forwarded to its name, making it a spammer...

    So don't keep a redirect forever, but consider it as a transitional solution.

    5) Choose a trusted email service provider.

    Some incorrectly sent spam should never see the color of an inbox. They should be filtered out by the email provider before they even reach the spam filter, just because they are sent in an insufficiently authenticated way. I'm not going to name names, but some providers, especially free and French ones, don't check email authenticity properly and let aberrations through.

    MX, rDNS, HELO, SPF, DKIM, DMARC: all need to be checked. More details in the HaiSoft documentation I wrote a few years ago.
    This is, of course, in line with my hosting offers.

    6) Don't hesitate 1000 years to change your address.

    When you receive dozens of spam messages a day, your address is probably already circulating on spammers' networks.
    Perhaps your address has been leaked into a data breach or posted publicly.

    There's no turning back, and anti-spam filters won't work miracles, or they'll do so at the cost of expensive, time-consuming procedures, or numerous false positives (legitimate e-mails going to spam).

    It's probably time to change your e-mail address. But you probably have many associated accounts and want to keep it.
    If your service provider supports aliases (as I do!), you can alias your old address to the new one and continue to receive your e-mails for as long as it takes; and you can even automate moving them to another folder so as not to pollute your view on a daily basis. Once the transition is complete, apply all the rules in this article and delete the alias in the old box. You're now spam-free!


    Are you looking for standard, open-source, secure and flexible email hosting, with unlimited aliases and spam filter control?
    My web hosting packages include unlimited e-mail addresses and aliases! Click here for details: https://www.lrob.fr/services/hebergement-web
    /

  • Your WordPress site is vulnerable

    Your WordPress site is vulnerable

    Many wonder how WordPress can be vulnerable to attack despite its popularity and following. Others are completely unaware of the risk. Analysis.

    What is a vulnerability?

    WordPress is programmed using the PHP language.
    PHP code makes it possible to create "dynamic" sites. In other words, content is generated on each page by a PHP program. A dynamic site also enables interaction with visitors. In technical terms, it enables requests to be received and processed.

    This strength is also a weakness in that it can leave room for unwanted interactions, enabling a website to be hacked.
    This is known as a "security flaw" or "vulnerability".

    PHP vulnerabilities

    Vulnerabilities in PHP code can have various causes.
    Here are a few common examples.

    1. Unvalidated input: When PHP code accepts user data, such as a form or query, without proper validation, it can be vulnerable to malicious code injection attacks.
    2. Excessive permissions: Assigning excessive permissions to files and users can enable unauthorized manipulation attacks.
    3. Poor error handling: revealing sensitive information in error messages can give attackers clues to further exploit the system.

    In addition, there may be vulnerabilities in PHP. The PHP executor itself sometimes contains security holes if not kept up to date. (see image)

    Other vulnerabilities not directly linked to PHP, such as XSS vulnerabilities, are also common. These allow malicious code to be executed.

    Let's see how this works in practice for WordPress.

    Source: Supported PHP versions

    WordPress website vulnerabilities

    Security vulnerabilities in WordPress

    WordPress is a robust content management system, but it includes nearly a million lines of PHP code (924,096 lines currently).
    WordPress is also 59,772 plugins and 11,378 themes available on wordpress.org. Millions more lines of code available for installation on your site.
    This wealth of code creates fertile ground for security flaws. The more you multiply the code, the more you multiply the risk. So, every day, new vulnerabilities are discovered. They can be found in the core of WordPress, but also in installed themes and plugins.

    Detecting, correcting and revealing vulnerabilities

    If a party detects a flaw (an individual developer, a "white hat", a specialized security organization), it notifies the developers of the script containing the flaw.

    If the developers are reactive, they correct the flaw and publish the patch.

    Then, typically 30 to 90 days after its discovery, the security flaw is publicly disclosed. On the one hand, to give credit for the discovery to the whistle-blower, and on the other, to warn script users of the risk involved in failing to update.

    Current flaw not corrected

    WordPress currently features a uncorrected flaw since version 6.1.1 (i.e. several months ago). This allows you to use a website to execute requests to other targets. It can be mitigated by blocking access to xmlrpc.php and disabling WordPress pingbacks (which was done on all the sites I manage even before this flaw was detected).

    When is WordPress vulnerable and what can you do about it?

    Vulnerabilities revealed

    When a vulnerability is revealed, all installations with the vulnerable script are inherently affected. If this is the case, hackers are likely to exploit the flaw.

    There are two types of vulnerabilities:

    • Your site contains a script (WordPress, plugin, theme) with a known vulnerability that has not been corrected by the developers. Development of this script may have been abandoned. In this case, you should disable the script or replace it with a non-vulnerable script that is better monitored by its developers.
    • Your site is out of date. You haven't corrected the security flaw. You need to update your site as regularly as possible, and make sure you don't have any obsolete scripts (which could potentially put you in the same situation down the line).

    Zero-day vulnerabilities

    Sometimes, hackers will find a vulnerability before it is revealed and then corrected. They will exploit it directly. This is known as a zero-day vulnerability.

    The more popular a script is, the more likely it is that hackers will look for zero-day vulnerabilities in it. It's rare, but it happens.
    Here's another reason to design simple sites: the more popular plugins you multiply, the more vulnerable your WordPress site becomes. Not just to zero-day vulnerabilities, but to vulnerabilities in general.

    To protect against 0-day vulnerabilities, the server hosting your site needs to be secure. This can be achieved by blocking suspicious requests from hackers using an application firewall. Then block attacking IPs with fail2ban, for example. This is not generally the case with shared hosting packages. With the exception ofHaiSoft with whom I've pushed these security measures, which has greatly reduced the number of hacks. But this can lead to false positives: Requests blocked when they are legitimate, especially with WordPress builders (Elementor, Divi, WP-Bakery and others). The technical support required is then higher, which is why most service providers don't implement this type of security. Security is always more complex than no security.

    Despite all the security measures in place, it's important to bear in mind that some hacker requests can slip through the net. There is no such thing as zero risk, and anyone who claims otherwise is either ignorant or a liar.

    So, since perfect security doesn't exist, assume that your site could be hacked tomorrow. If this happens, what do you do? You'd better have an up-to-date, easily restorable backup that's not stored on your site.

    Conclusion

    Hacking doesn't just happen to other people. On a regular basis, owners of WordPress sites come to me with a problem. hacked website to repair.

    Every computer system is potentially vulnerable, including your WordPress site. The challenge is to minimize the risks of hacking by applying all preventive measures. This starts with an up-to-date, secure server capable of blocking attacks. It also means regularly monitoring your WordPress site, updating it as often as possible, constantly checking for known security vulnerabilities, and taking swift action in the event of a problem. In all cases, an automated, external, independent backup of your site must be carried out on a daily basis. This is precisely the set of services you'll find in my Webmastering WordPress.

    If your site is important to your business, don't wait to be hacked. Be proactive and have your site checked by a WordPress security audit or go directly to my Webmastering.

  • How can I check if my WordPress site has been hacked? Warning signs to be aware of

    How can I check if my WordPress site has been hacked? Warning signs to be aware of

    It's sometimes hard to tell the difference between a malfunction and a hack. But there are signs that your site may have been hacked. Today, let's take a look at the 8 most common signs to spot a hack on your WordPress site.

    ❌ Warning: if in doubt, it's best not to connect to the site administration. Indeed, if your site is hacked, this may allow the hacker to recover your password. What's more, the hacker may trigger certain actions automatically when you act on the hacked site, which would make the situation worse.

    ✅ If you think your site has been hacked, you need to suspend your hosting until your site's files and database have been dealt with directly.
    Repairing a WordPress site requires respecting a scrupulous protocol like the one I offer in my repairing and securing hacked WordPress sites. If you have any doubts, contact me and we'll be happy to advise you. free assessment and immediate safety measures.

    1. Unauthorized advertising and redirections

    Unwanted ads or redirects to third-party sites appear on your site.

    Cause and explanation

    The hacker was able to penetrate the site's files and/or database to insert these ads and redirects. His aim is to steal your traffic to generate revenue.

    2. Unable to log in as administrator

    Your administrator password no longer works or seems to change unexpectedly after each reset.

    Cause and explanation

    The hacker has introduced a backdoor (code hidden in your site) enabling him to change all your passwords at will.

    3. You receive notifications of rejected e-mails

    You receive notifications of bounced e-mails (also known as "mailer-daemons") that you have not sent yourself.

    Cause and explanation

    The hacker is using your site to send emails, or may have compromised your email password. In some cases, they are simply using a poorly configured and insecure contact form as a platform to send emails to the recipients of their choice, which also needs to be addressed to avoid your blacklisting.

    4. Google Safe Browsing or antivirus security alert

    When you visit your site, your browser displays a "Dangerous or malicious site" alert, either via Google Safe Browsing or via your antivirus software. The blocked URL displayed belongs to your site or to a third-party site.

    Cause and explanation

    Your site contains URLs from phishingmalware, or redirects to malicious sites. Google maintains a database of these malicious sites, which all web browsers use to protect visitors.

    5. Unwanted content and foreign languages

    You see additional or modified articles or pages on your site. Often in a foreign language. And often with suspicious links to other sites.

    Cause and explanation

    The hacker controls your site. Either by adding an administrator account, or by using a backdoor to inject code into the database. This allows him to insert any content he wishes.

    Not to be confused with "spam" comments. This concern must be addressed, but does not necessarily mean that your site has been compromised.

    6. Unknown users

    You see one or more unknown administrator users in your WordPress user list. Sometimes you notice that your existing admin account details have changed.
    NB: As you don't want to log in to the site administration, you can also see this in the database table wp_users (via phpMyAdmin for example).

    Cause and explanation

    The hacker controls your site. Either via an administrator account added or compromised, or (and this is the most common case) via a backdoor enabling him to inject code into the database. In particular, this enables him to control the site's users.

    This is not to be confused with unwanted users registering on your site. This concern must be addressed, but does not necessarily mean that your site has been compromised.

    7. Phishing pages

    You may notice that some URLs or files (often .html) resemble pages from well-known sites, either through a statistics tool or when exploring your site's files.

    Cause and explanation

    This is called phishing. The hacker has taken control of your site and can write files of his choice into it, or write to the database. Phishing allows the hacker to lure visitors to your site whom he has previously sent bogus e-mails, in order to use it as a gateway to his victims' personal information.

    8. Intruder files

    To do this, you need to browse your site files via FTP or your hosting panel. You may even notice an intruder file or folder in your WordPress files. Sometimes these are ".zip" files, and sometimes they're in the underlying folders. If in doubt, compare with the archive on wordpress.org.

    Cause and explanation

    The hacker has been able to send unwanted files to your site and now has complete control. He can read existing files and add new ones. He will usually have taken care to hide "backdoor" files throughout the files in an attempt to retain access to the site even if you clean up the content.

    Further information

    Ideally, you should host your site on a secure server, as I propose in my hosting and webmastering packages. In this way, hackers are automatically blocked, drastically reducing any risk of piracy. Also, malicious files are regularly scanned at server level, which is the most reliable way of proceeding.

    If there are no special security measures in place on the server hosting your site, you can start by using the WordFence which, while cumbersome and slowing down your site, will at least scan your site for malware and protect you from some basic attacks.

    If you spot any of these signs of piracy, don't hesitate to contact me. contact us for immediate assistance.

    Constant vigilance is essential to keep your WordPress site secure. I offer this through my webmastering services.

    In the next few articles, we'll be covering other topics related to the security of your WordPress site. Stay tuned.

  • WordPress site attacks: Why and how do hackers operate?

    WordPress site attacks: Why and how do hackers operate?

    Let's put ourselves in the shoes of hackers attacking WordPress sites.
    Let's understand how they think and operate, to better protect ourselves.

    The pirates' goal

    Hackers are generally motivated by money. Although their attacks are often stupid and nasty, you shouldn't underestimate them, because some of them are clever.

    To generate revenue, pirates will do anything. They distract visitors pirated sites via sponsored links or redirections, or add inopportune advertising of which they reap the rewards. They also sometimes add links to other infected sites in an attempt to get them listed on Google.

    Often without limits, they even host phishing on your site. In other words, copies of institutional sites. This enables them to refer victims to whom they have previously sent fake e-mails pointing to these links, and thus to retrieve their personal login details for these real accounts. In some cases, these may be bank or health accounts.

    In the targeted hackingmotivation is ideological or political.

    More marginally, we can also observe hacking competitionsometimes taking place at events such as "hackathonSometimes, on the other hand, the site is completely defaced. However, I haven't observed this type of hack for a few years, so it seems that this practice is being lost for the time being.

    Why attack WordPress sites?

    WordPress is widely used, with 43% websites worldwide. This makes it a target of choice for hackers. Attacking WordPress allows them to maximize their results in their attacks. It's exactly the same principle as with Windows, which is the most popular operating system and therefore the most attacked.

    Also, WordPress is very rich in terms of code and functionality, as well as documentation. So much so that numerous vulnerabilities are regularly made public. It is important to note that vulnerabilities also and above all concern numerous plugins and themes from WordPress.

    Hackers' modus operandi

    It is relatively easy to identify bulk WordPress sites on the Internet. Pirates therefore create WordPress site listings.

    They will then cross-reference these lists with the known security vulnerabilities from WordPress.

    They then have to write or find pirate communities "exploitsi.e. queries or code to be used to exploit these vulnerabilities.

    Once they have found their "exploits", they program robots which automatically attempt to use them on all these sites. These bots are often set up on previously infected servers and personal computers. Together, these bots are known as "botnet.

    To attack more effectively, some more skilled hackers will first list the plugins and themes installed on each site and their versions. By knowing the version of the scripts, anyone who may be aware of the security holes in each version. In fact, this is one of the actions carried out during a WordPress security audit. Hackers use this method to find and exploit vulnerabilities in each site much more effectively.

    Some pirates are even more gifted plan their attacks in advance, sometimes targeting numerous sites of a particular host, in an attempt to saturate user support and keep their hack going as long as possible.

    This is how we see waves of piracy. Note that some waves of hacking also occur because a new flaw has been discovered by hackers before it has been corrected by developers. This is known as a "zero-day vulnerability.

    Targeted attacks

    Your site doesn't have to be specifically targeted to be hacked. Because, as we've seen, hackers attack thousands of WordPress sites a day in an automated fashion. This means that even very small sites with just a few dozen visitors a day, or the sites of small associations or local authorities, can be hacked.

    Nevertheless if your site has a security flaw of any kind, a targeted attack, operated and directed directly by a hacker, will very quickly result in the complete hacking of your site.

    Targeted attacks are relatively rare (less than 3% of hack cases in my experience). The targets of choice in this case are mainly political, media or ideological.. In other words, targeted attacks tend to be aimed at institutional sites or sites with ideologically charged content. If this is your case, don't wait until it's too late and treat yourself to a WordPress security audit.


    Further information

    Check if my site is vulnerable

    You can test the vulnerability of your website via my WordPress security audit.

    Please note that this service is included in my Webmastering Critical. WordPress scripts are updated on a daily basis, I receive an e-mail in the event of a vulnerability, and I monitor obsolete scripts. I also manage to detect the activity of hacker bots on my hosts and automatically block hundreds of them every day. Manual attacks are also blocked; for example, during an audit of a site I host, a major security group asked me to unblock them so they could continue their tests, as all their IPs had been automatically blocked by my security systems.

  • WordPress "Builders": The hidden face

    WordPress "Builders": The hidden face

    Page builders for WordPress have been all the rage for years. These are visual editors designed to facilitate site layout.

    Elementor, Divi, WPBakery: Web agencies, webmasters, everyone's using their own builder. WordPress revolution, or monumental mistake, what does the "WordPress expert" have to say?

    The promise of WordPress builders

    Builders are popular because they promise to create rich, complex pages without touching a single line of code, thanks to visual editors. And they generally deliver on this promise.

    But then, Jamy, what evidence is there to question the wisdom of using builders in this perfect world of ours?

    WordPress "Builders" imprison you

    Builders are generally available on an annual subscription basis. Having paid for your builder, you have no intention of backing out and will do everything in your power to make it work.

    But one day, fate will strike: you'll have a really blocking problem with your builder and you'll want to go back to native (without a builder). Or choose another builder.

    And then the drama begins.

    No standards, no interoperability between different builders. And above all, no display if the plugin is deactivated.

    Without its builder, your site is out of order and you'll have to completely rebuild it.

    So, have you really saved time and money by using a builder to shape your site?

    Builders go against the WordPress grain

    Builders modify the native operation of the WordPress CMS.

    How builders work

    A builder will generate hundreds of tags which must be interpreted and dynamically converted into HTML code (the final display language sent to visitors) by the server before being sent to the visitor.

    Some builders will also generate scripts (js) and style sheets (css) on the fly, depending on the page.

    Native WordPress operation

    Previously, to change the appearance of WordPress from a given theme, you either had to have chosen a highly customizable theme, or get your hands into the site's code. In both cases, page content remained native, so a change of theme didn't break the whole site.

    From now on, WordPress pushes Gutenbergits block system. It allows you to edit all the content of your site natively, without any modification to WordPress: pages, articles, but also the global display thanks to "full site editing". Like a builder in fact...? Yes, except that the code generated is HTML and therefore has no cost in terms of performance or loading time.

    The impact on performance... And ecology.

    Extreme slowness

    In my experience as a web-hosting outsourcer, I've been approached by numerous WordPress customers complaining about the slowness of their sites. The servers weren't saturated, but their sites had one thing in common: they used WordPress builders.

    During tests with/without builder, I observed a slowdown of between 10 and 40 with their builder activated. In other words, a site that takes 0.3s to load natively takes more than 3s, or even more than 10s in the most extreme cases.

    But the slowdown also affects visitors. The many heavy scripts (js) and style sheets (css) generated by builders take time to download, and then have to be interpreted. In the process, they take even longer.

    Time is energy

    Load times are calculation resources and therefore energy consumed by the server and your access device (smartphone, PC). The more CPUs are occupied, the more energy is wasted.

    While the situation is improving with builders' optimization patches, or caching plugins (which avoid certain server consumption), performance is still generally not up to scratch compared to a native site.

    Impact on site success

    As we all know, visitor retention on a site depends on its speed. And there's good reason to believe that search engines favor the best-optimized sites.

    Undeniable ecological impact

    WordPress powers over 43% websites worldwide. Many of these sites include builders, generating an overconsumption of server resources on the order of x10 (or even x40). Builders therefore have a considerable carbon footprint that it would be interesting to measure objectively. I wouldn't be surprised if this increased Internet energy consumption by 10% or more.

    Reliability and safety

    A large proportion of the failures observed on sites during updates are due to the builder. You'd better have a good backup. All this is additional maintenance, lost for the webmaster and/or the customer.

    What's more, as builders are popular, security flaws are regularly discovered. So if you update, you risk breaking the site, and if you don't update, you risk a hack. What's your choice?

    Builders galore

    Some people have a systematic builder reflex. Even on an extremely simple site. But is it really necessary?

    In many cases, using a builder is like killing a fly with a flamethrower.

    The #1 rule of optimization: use only what you need. A little minimalism never hurt anyone.

    Do we need to think for 2,000 years to shift an image by one or two pixels? It only pleases web designers. Users and site owners couldn't care less.
    In the real world, it's not the content that counts for a site's success.

    What you need is a site that's easy to maintain, reliable, secure and quick for visitors to view, and above all, that contains the useful information your visitors are looking for, for good SEO (on Google and other search engines), and with the lowest possible carbon footprint.

    Alternatives

    Many native themes, often free of charge, are capable of offering a clear and pleasant visual experience, and already allow an excellent level of customization.

    What's more, with Gutenberg, WordPress now offers the " Full Site Editing "With compatible themes, you can arrange each part of the site as you wish.

    In the near future, this should mark the beginning of the end for builders.

    Personally, I've always refused to go against WordPress' native way of working, and I adopted Gutenberg as soon as it was released, despite the bugs and limitations.

  • New infrastructure: lrob.net and other server changes

    New infrastructure: lrob.net and other server changes

    Some of you already know: in October, I'll be leaving HaiSoft for new adventures with a web agency.
    I'll still be Sysadmin and a WordPress specialist, but now in the position of hosting manager.

    A few months ago, I launched my own freelance webmaster business.
    I've decided to accompany it officially with hosting services, to enable fluid management of all services.

    And since I'm committed to offering the best possible service, this meant a number of server changes with a infrastructure overhaulmore powerful and advanced than ever.

    Over the last fortnight or so, I've been working to overhaul the system with the utmost care and without any noticeable downtime, even working at night for operations that could cause minor outages (notably the DNS overhaul).

    New infrastructure domain: lrob.net

    To facilitate management, a new domain name is used for the technical operation of the :
    lrob.net

    New Plesk URL

    For those whose Plesk login URL was https://ds.lrob.fr
    From now on, use :

    Your login/password remains unchanged.
    I'll redirect old names to the new one for 30 days. Don't forget to update your bookmarks before this deadline.
    If you forget your login or password, please follow the forgotten password procedure or come back to me for a manual reset.

    New NS (name servers)

    NS authorizations for your domain names have also changed.

    I was able to handle the changes for 100% of currently hosted domains.
    For your information, the following DNS servers must now be used when adding a domain (resellers):

    • ns1.lrob.net
    • ns2.lrob.net
    • ns3.lrob.net

    These NS are hosted on servers in three different geographical locations for optmized redundancy: Lausanne (Switzerland), Nice and Nuremberg (Germany).
    They are now 100% IPv6-compatible in addition to IPv4.
    They are also DNSSEC-secured (ECDSAP256SHA256, the standard also chosen by CloudFlare) to protect against NS spoofing/poisoning (man in the middle) attacks.

    Result: Absolutely perfect. Even better than the web giants (Google, OVH, Microsoft, Facebook, etc.):

    New hosting server and technical info

    The new server is a major upgrade, and is now a dedicated server (previously virtual server) with unlimited Plesk license (previously 30 domains), making it possible to offer a "reseller" service that gives resellers the freedom to manage the addition/deletion of their domains independently.
    This server is located in Falkenstein (Germany) at Hetzner. Bandwidth (gigabit) and ping to France are excellent.
    Compared to the previous server, which was already decent, the new one is about 2x more powerful in terms of CPU, has 8x more RAM, 2x more storage, and the NVME SSDs are about 3x faster than the previous SATA SSDs.
    The gain in performance is significant.

    IPv6 is now fully supported. TLS 1.3 (maximum security) and HTTP/2 (maximum speed) are now natively supported (directly by Apache, without Nginx reverse proxy).
    The server and the entire infrastructure are now monitored via Centreon.

    Currently, a push backup is in place on a daily basis. A second "Pull" backup is currently being set up. Despite these precautions on the part of yours truly, don't forget to make backups of your data too, because it's almost always when it's too late that users ask. And let me remind you that in hosting, it's always the end customer who is responsible for his data.

    This should summarize the important information. Please do not hesitate to contact me if you have any queries.

  • What on earth is Sysadmin's job at a web hosting company?

    What on earth is Sysadmin's job at a web hosting company?

    In early 2017, I joined the web hosting company HaiSoftfull of self-taught sysadmin and web knowledge.
    Problem: It's extremely difficult to get anyone outside the industry to understand what this business is all about.
    From questions like "What's a web host?" to "What do you actually do?", there's plenty to clarify.
    So let's clarify.

    Received ideas

    No, I'm not:

    • Computer scientist (that's almost as vague as "doctor", in what, philosophy, particle physics, general medicine?).
    • A troglodyte
    • Pirate (you can use a computer legally too, you know...)
    • A turtle that eats pizza and drinks Coke with every meal (as with everything, in moderation).

    To understand what I'm doing, you first have to understand what I'm proposing. HaiSoftmy employer.

    Presentation of business sectors

    What is a web host?

    You are currently visiting my website lrob.fr. This name, "lrob.fr", is a domain name, just like google.com, materiel.net, linkedin.com, and so on.

    Anyone who can reserve a domain name with a registrar for a renewable period of 1 year.

    Although it is not compulsory, the aim is generally to create an associated website and possibly associated e-mail addresses, for example the site https://www.lrob.fr (note that "www" is a convention, it is not mandatory), or the e-mail address exemple@lrob.fr (don't look it up, this address really doesn't exist).

    If, tomorrow, you want to open your own website, or even your own web agency, you'll need to call on the services of a specialist. web host as HaiSoft.

    L'web host has its own servers located in a datacenterservers that are configured to serve websites and send/receive e-mails.

    Generally, a web host will also be registrarwhich means you can reserve your domain names. To which you can add your web hosting to host your site's content. Finally, you'll add a mail hosting if you wish to have your own @yourdomainname.tld e-mail addresses.

    For hosting, we exclusively use Linux and the control panel for easy and efficient management of accommodations is Plesk.

    Server, datacenter, do you like it?

    A server (computing), is a computer on which a system has been installed to provide services (e.g. websites or email services).
    In the context of a datacenter server, the machine will generally be in "rackable" format and placed in "server bays", to allow a high density of machines, as shown in this photo:

    Dell R440 1U rack server

    A datacenter is a large, securely-accessed, climate-controlled facility with back-up power and a reliable, generally redundant, high-quality Internet connection.

    Some examples of racks and racks containing rackable servers:

    What does the support part involve?

    While managing a website is often straightforward for experienced users, it remains a vast domain, with many interacting services, numerous parameters, many security features, and many technical elements that can generate misunderstandings on the part of users, and therefore a need for support.

    A web host, like any self-respecting service provider, has a duty to provide user support so that its customers can enjoy their services whatever the circumstances.

    At HaiSoft, we are accessible by ticket from the customer area (a secure internal message system) or by telephone. For simple requests or assistance, this is done by telephone. For anything requiring more research, or involving major modifications or the transmission of confidential information, we use the ticket system.

    Requests can be simple or complex, and here are a few examples:

    • I can't connect to my customer area? -> Resend login details.
    • My site is inaccessible -> Diagnosis/correction
    • I'm trying to switch my site to HTTPS, I have a certificate error -> Send documentation
    • I've had a bug on my site since the update -> Diagnosis/advice, possibly restore backup
    • I can't connect my mailbox to my iPhone -> Send documentation, possibly guidance by phone or ticket
    • I have a bug on my site when I add an article -> Diagnosis/advice/correction
    • My site is being attacked by robots -> Diagnosis/advice/security implementation
    • I accidentally deleted data -> Restore backup
    • I've entered the wrong password several times, my site is inaccessible -> Unblock in the security system

    The list could be very long, but I don't want to get too technical or specific here.

    Lastly, the support technician may be called upon to draw up customer documentation such as the wiki HaiSoft.

    What is a sysadmin?

    The sysadmin or "system administrator" is in charge of server management and IT infrastructure. At a web hosting company, the division of tasks may vary, but it can involve a wide range of activities, from network arrival to diagnosing the use of resources on the customer's server.

    To do this, the sysadmin will not only travel to the datacenter to install/repair/upgrade the infrastructure, but will also use its administration tools, which are generally :

    • Administration panels at his disposal.
    • Monitoring, to check for any malfunctions in real time.
    • SSH consoles for command-line connection to the server, which is often the only or best way to manage server configurations.

    What is outsourcing?

    As its name suggests, facilities management is simply the management of an IT system.

    HaiSoft has its own infrastructure, used in particular for shared web hosting (entry-level offers, for small independent sites), and is therefore responsible for its outsourcing.

    But customers can also have their own server. (virtual or dedicated)if they need more resources. For example, a web agency with a large number of sites, or a large e-commerce site, will prefer to use its own server.

    With some server hosting companies, customers manage their servers independently. At HaiSoft, on the other hand, all our servers are managed - and that's what makes us so special. As a result, servers are delivered ready to use, pre-configured for web hosting, and server evolution is monitored and maintained by us.

    In this context, this means that we, as outsourcer, manage the hardware and software that run the customer's web services (website, emails).

    Our "typical" customer, interested in these managed services, is generally: either an individual or a self-employed person managing his own website, or a webmaster, or a developer, or a web agency, or a web-development agency, and so on.
    You need to be able to adapt to the technical level of each customer to meet their requirements.

    As an outsourcer, we provide the following services:

    • Server hardware installation and maintenance (replacement in the event of failure)
    • Server software installation and pre-configuration to meet specific customer requirements
    • Server monitoring (to ensure that the server is running at all times)
    • Software and hardware maintenance (repair in the event of end-customer problems or malfunctions)
    • Server updates (security, functionalities)
    • But also, and above all, responding to customer requests and providing customer advice (how to run an application, how to size your server, best practices, setting up configurations specific to your application, etc.).

    In concrete terms, here are the types of requests we handle as an outsourcer:

    • I'm launching an advertising campaign and I'm expecting 100,000 visits a day next month. How can I be sure that the server will hold up?
    • I'm installing a new application, and it requires the latest version of the MySQL database server. Can you schedule the update?
    • I'm connecting to an old service that doesn't support the latest security standards. Can you adapt the configuration to make it compatible?
    • I need a bigger server. Can you arrange for all my services to be migrated to a new server?
    • I'd like to take advantage of the latest features. Can you update the Plesk control panel and the system?
    • What are the implications of enabling automatic updates?
    • I've broken my database. Can you restore last Friday's DB backup?
    • I'm looking for the highest level of security on the server. What do you propose to implement?
    • I'm receiving attacks on WordPress' xmlrpc.php file. Could you block access to this file and ban attacking IPs?

    Articulation

    How do web, support, facilities management and sysadmin fit together?

    The sysadmin is the IT technician who manages the server farm and implements the outsourcing tasks described above.

    Being a sysadmin is also a much more efficient way of providing user support, and is a prerequisite for outsourcing.

    And knowledge of the web and the various applications customers can install is of course a huge advantage in helping them debug their sites.

    This is where the hats get a little mixed up for the sysadmin manager and the support technician, which often increases misunderstanding. With a better understanding of these different roles, things should be clearer from now on.

    In practical terms, what does a typical day look like?

    A typical day is structured as follows:

    • Greet colleagues and ask about any specific concerns or important news
    • Check monitoring and take immediate action on any problems that arise
    • A good cup of coffee
    • Respond to customer tickets throughout the day
    • Answering calls throughout the day
    • Update servers
    • If necessary, carry out planned interventions (hardware/software)
    • Improve/enhance customer documentation when it fails to resolve their concerns
    • Write a few articles for blog when you have time and interesting content to publish
    • In the event of a malfunction, identify the causes, implications and solutions, and implement measures to prevent recurrences.
    • Consult the team on difficult cases
    • Inform the team of special cases
    • Meet with the team in the presence of the technical director to plan major developments
    • Keep abreast of the latest updates in the sector, particularly those concerning the tools used
    • R&D: Improve internal processes and tools, find solutions that improve safety and performance, meet new needs, or replace existing solutions.

    Thank you for reading this article. Now you can't say -without lying- that you don't know what a sysadmin support technician at a web hosting company does 😉

    UPDATE 2023: I'm now a freelancer! I offer dedicated WordPress hosting, ultra high-performance and ultra-secure with full support. Feel free to browse my site and contact me to find out more!

  • Feedback on my training at SAE Institute Paris

    Feedback on my training at SAE Institute Paris

    The SAE Institute, School of Audio Engineering is a multimedia school present in many capitals around the world and known primarily for its sound engineer training. Having completed my Audio Engineer Diploma at SAE Paris, I'd like to share with you a few thoughts on my experience, which may be of particular interest to those who wish to choose this school.

    Disclaimer

    Warning, what follows is only my opinion, my personal experience and the SAE may evolve between now and then, keep in mind that I got my diploma in 2013 for a training in 2012-2013.

    Update: Since 2017, I've been using another string of my bow as my main profession: IT. I'm a WordPress project manager, security, hosting and maintenance specialist. We can create your site and launch your project. If you already have a WordPress website, I can host it and/or the maintain. You'll benefit from ultra-secure hosting specially designed for WordPress. You can also find my Web Portfolio here. All you need to do is contact me.

    Why SAE?

    Well, it's simple, I looked around and found Louis Lumière, BTS, EMC, SAE, and others that didn't really grab my attention. Mainly because I wanted to stay close to Orléans.

    The sound technician BTS courses tended to focus on broadcasting and sound recording for video, and the equipment available was pretty mediocre. What's more, my experience of the traditional French school system was never a delight, which is all the more reason not to go back.

    Louis Lumière seemed to be the best option, but I couldn't get in, precisely for the above-mentioned reason (very average record).

    And the EMC, I hesitated for a long time, the school and atmosphere seemed very nice, but the equipment available was not as rich as the SAE, at least in terms of recording/mixing equipment. On the whole, the SAE seemed more professional than the EMC.

    You'll understand why later on, but I'd recommend SAE to anyone interested in recording and post-production (music/video mixing), because that's mainly what you'll learn. But let's be clear: with this school, you have the keys in hand to studio, live and sound recording, and even other related fields. Broadcasting isn't really part of the equation, at least not when I took the course. Even if there is a sort of initiation, it remains purely theoretical.

    A school accessible to whom?

    For those who can afford it, or who, like me, have a student loan... Because the school isn't cheap. I'm not sure I can give you the price, as it's hard to find at first glance, but you can get it by requesting the school's information documents (sent free of charge by post).

    You still need to have a baccalaureate (preferably ES/S or STI) and be 18 years old. It seems to me that in some cases, the bac pro can be taken into account, and that your case will still be studied if you don't have the bac but can attest to the required skills.

    Let's talk about the skills required. They're summed up pretty well by the entrance test. It's fairly quick, and consists of a brief test of your level of French, English, mathematics, physics and logic. So it's been a long time since I've taken it, maybe there was a little bit of general knowledge, but it's nothing too rocket science, to be sure, given my rather scattered general culture, focused more on a broad technical culture. If you're an average 18-35 year old with a bachelor's degree, you probably won't have any trouble answering the questions. And in the end, that's pretty much the level required, because the training starts from scratch, so it doesn't matter what your original level is, you just need to be able to understand, adapt and memorize, and if the subject really interests you, technically speaking, you should be fine. Of course, having some knowledge in advance will help you feel at ease. As for me, I've been an audio and computer enthusiast for years, so there's a good third of my training where I've just been brushing up on what I already knew.

    You have to remember, though, that this is a technical training course, so you need to be at least a little geeky, curious, rigorous and not allergic to a little useful mathematics.

    About the free MacBook pro...

    The school "offers" a Macbook pro on entry. I'm using quotation marks here, because of course the cost is passed on to you in the price of the course. Having initially had an aversion to Apple, its uninteresting products and its nauseating policies, I think this is still a good thing, as you'll probably be confronted with Macs during your professional life. At least you learn how it works. But this Mac is only really useful if you buy ProTools (student price: 250€) to work on it. So you'll need to plan for additional costs. Also, by adding 500€, you get a machine that's 2x more powerful (15 inches instead of 13 and quadcore instead of dual core), which is interesting if you plan to do some heavy mixing on it. For my part, that's what I did, I also put 16GB of RAM and an SSD in it, it can be done without any special knowledge, but you need to take a set of star screwdrivers to do it. Hopefully you'll have some Macs that can be disassembled. ProTools is also PC-compatible, so you can install it on your MacBook and your PC at home, and use your iLok key (license) on both. The plugins are even quite compatible overall, provided you use the same ones. Still, I'd have to spend €1,000.

     

    1 or 2 years?

    SAE offers accelerated training in 1 year instead of two. As I'm not from Paris, and given the high cost of rent, I opted for the accelerated course to save a year's rent in Paris, and more than make up for the slight extra cost. Time is money, they say. The Audio Engineer Diploma is recognized by the French state as a BTS (bac +2) "Technicien preneur de son". It won't get you a job, but it can help you work in public institutions.

    Who are the teachers?

    We call them "speakers" here, because they are first and foremost professionals in the field. They're often on first-name terms, as there's no reason to talk to each other with a broom in your hindquarters. They each have their own speciality, and are always available to answer your questions, and sometimes even to experiment with new ideas. Whether it's during a break, before, after or even during the course to share with the class, they're always available whenever possible.

    Obviously, you'll feel more at home with some than others, but there'll never be any unpleasant surprises, above all because they're always competent, at least in the field in which they teach.

    And what do we learn in this school?

    That's always the problem when choosing a school... knowing what's in the course. Well, today I'm taking the stress out of it!

    First of all, most of your training will consist of applying what you've learned in class. Secondly, everything is very progressive. You'll see the concepts little by little, and learn gradually, but on the accelerated course, you'll get the hang of it fast, especially if you don't have any prior knowledge, and on the more complex consoles, you'll really have to hang on...

    In bulk: You'll learn audio editing, sound design, ProTools, MIDI, microphonics, audio theory (processing and effects, signal, acoustics, stereophony...) and a bit of electronics, you'll learn to use analog and digital consoles and effects, you'll make sound to image, you'll record in the school's studios with musicians you'll have to find, and you'll do a bit of networking applied to audio and computing, you'll be introduced to broadcasting and live performance, you'll make jingles, and you'll even learn to mix, but be careful, we'll give you indications, and then it's up to your ear to do the rest. Above all, you'll learn how to use reason to desecrate all the idiophilic nonsense lying around - my favorite part.

    There will also be a number of guest speakers, and I was particularly fortunate to meet with Bob Katz. I also had a few outings, an in-depth visit to a live room to get a better idea of how things work, and a mixing session in the studio to get inspired by the techniques of the most experienced, with a little tour of the mastering studio as a bonus.

    You'll have a large block of lessons for each console present at the SAE. These are quite rich and representative of what you'll find in the pro world, from full analog to full digital, with hybrids in between.

    You'll also have a Workshop, i.e. a lesson with the teacher who shows you in practice what you can do, especially for each console.

    It's worth noting that most of the mixing will be done in ProTools, a powerful tool little known to the general public but used in a large number of studios, which I have clearly adopted. You'll learn all its specific features, and be able to extrapolate to other DAWs. No Abelton on the other hand, too bad, but a little Logic, especially for MIDI exercises.

    In the end, the big positive point for me is that the link between theory and practice is very well made, and that you're not bombarded with useless theory, everything you learn is useful, and you don't need to be a math nut to do it.

    How does a year go?

    Already, there are 3 intakes per year, which is quite practical, and it allows specialized teachers to rotate between promos. There are two types of classes: full time (one-year course) and part time (2-year course). Even in full time, the number of class hours is moderate, but as I said, you spend more time applying the lessons than sitting in a chair attending them. In this way, you integrate things quite well. Full-time classes seem to be a little smaller - between 15 and 20 students at the beginning of the year.

    The year is punctuated by practical exercises to be handed in, as well as exams that are fairly evenly distributed to ensure that everything is perfectly assimilated.

    A good reference point for me during the year is the workstations and consoles we work on. This remains the focal point of the course. All the work can be done in the school, which is open every day until midnight or 1 a.m. (not sure). In any case, I've closed more than once, without looking at the time. There are ProTools stations where you work with headphones, which are freely accessible, small consoles on which you start, also with headphones, and mixing/recording studios, where you have to reserve the room, and you'd better show up, otherwise you'll be heavily penalized.

    We're starting the year with some editing, for my part on Spark, a very manual and unpleasant piece of software, which I consider to be the hazing of SAE. If you can hold that, you can hold anything else. I heard that maybe they were going to use another program for this task... Basically, it consisted of 5 models to reproduce. You're given a cut-out piece, and you have to re-cut it identically... And sometimes, it's just a snare drum hit to cut, and you have to find the right one. The slightest mistake and it's 0 out of 5.

    Then we start to pick up some theoretical baggage and learn Protools, so we do a bit of editing in ProTools, we have jingles to make with a few technical jokes in them, stories (recorded by the speakers) to edit and dress up...

    And then we started mixing. First on a small 8-track mackie, with only volume/pan/EQ, recording on minidisc to get used to having an external recorder. Then we add dynamic effects (compression), then temporal effects (reverbs and other phasers).

    Then you move on to the 8 BUS, a much larger console (32 tracks, I think), do a mix, then your first recordings... As I said, you have to find the musicians yourself. There's a book of contacts available, but if not, just go to a rehearsal space, and you'll easily find musicians who want to be recorded for free. Sometimes they'll even pay you if the result is worth it. Well, the 8 BUS isn't a top-quality studio, but it's a good start.

    From then on, things started to get really serious, and we started training for the other consoles, in particular the SSL, which I loved because it combined a DAW controller part (audio software) with a cool analog part, ditto, mixing, then recording/mixing. Always in that order. And then we go digital, Tascam/Yamaha, where it's purely mixing and picture sound (sound design, dubbing, mixing).

    And then we come to the Icon, the big digital console, the ultimate remote control for ProTools, and on the other side the Neve, the big analog console, super grain. Not to mention the more advanced listening rooms and live rooms. In fact, it was on this Neve that I registered Siks Haedo.

    Finally, we end the year with an exam, a dissertation, a final project and a practical exam. As for the dissertation, it's a good idea to start early if you want to do well. The idea is to delve into the subject of your choice. For my part, I chose the complex subject of impedance matching, and I literally had to outdo myself to achieve it.

    Successful training

    Sadly, some drop out, some fail, and some switch from full time to part time to keep up. In my class, we started at 18, finished at 14 (including one spent part-time), and only 4 of us graduated. There's a catch-up, but you can't count on it, apparently. I imagine that in part time, the drop-out rate is higher, and the success rate better, and my class can't reflect the totality by its simple sample, but one thing's for sure: you've got to hang in there!

    Because while all the keys to success are provided, it's still hard to get a diploma.

    To get there, you need to achieve a final score of 80/100, or 16/20. Let's face it: the only way to do that is to aim for 100%. Try to know everything about everything, to have no gaps, to give it your all, and for that, there's nothing like being passionate about the subject. Without passion, I find it very difficult to keep up. Especially since at SAE, you're an adult, and there's no one to yell at you if you don't do your homework. If that's what you want, you'll have to move on.

    Of course, you make mistakes in the projects you complete, and you're there to learn, but you have to learn quickly and well, do your best throughout the training, be rigorous in the exercises, which can sometimes be a bit tricky, and take all the time you need to get the job done. That's not to say that you have to stop having a life; on the contrary, to get through it, I really needed to party, play games and make my own music (plus I was applying my lessons). For me in any case, getting away from it all to get back to work was the appropriate method, and even in full time, I managed to have a bit of free time, and a completely random rhythm. Sometimes I'd stay at school until midnight to work, I'd have class the next morning, but I needed to take my mind off things, I'd go to bed at 4-5am, go to class, sleep in the afternoon, come back in the evening to work... In short, there's obviously no rule for success, other than not missing a single crumb of class, not allowing yourself the right to make mistakes and always doing your best.

    Conclusion

    All in all, I'd highly recommend this school for the quality of its training, and I think it's hard to do better in such a short space of time. After that, you'd have to be able to skip stages depending on your level, but it never hurts to brush up on the basics. Keep in mind, though, that it's up to you to find a job afterwards. The various speakers are quick to remind you over and over again: it's not an easy field. So, if you're really motivated and passionate, and have the means, don't hesitate.

    I hope this post has been useful to some, I'm open to questions, in comments or via the contact form for more info ;)

en_US