Every British Web Design website is hosted by British Web Design on UK servers, as two copies: a private staging copy where changes are tried and the live site the public sees. Hosting, https certificates, backups and software updates are part of the monthly price. This article describes how British Web Design sites are hosted and protected.
Servers
British Web Design's servers are in London and Manchester. British Web Design sets them up and runs them itself, over SSH, with its own tools for deployments, certificates, background processes and backups. Each British Web Design site is a Laravel application with:
- its own MySQL database, and a database user that can reach only that database
- its own private code repository on GitHub, read with a key that works for that repository alone, so one site can never reach another site's code
- its own storage bucket on Amazon S3 for pictures, videos and files, with a storage user whose permissions cover that bucket only
- its own email sending through Postmark, from an authenticated sending domain, so enquiry emails land in the inbox rather than the spam folder
British Web Design sites are not WordPress, so there are no plugins to install or keep up to date.
Staging and live
Every British Web Design site is hosted twice. The live site is what the public sees. The staging copy is the same site at a testing address under on-britishwebs.com, where every change lands first. The two are separate sites on the same server, with separate databases, deployed from separate branches of the same code. A change reaches the live site only when the owner approves it.
The staging copy is open to anyone with the link, but every page tells search engines not to list it, and its card payments are always test payments. Where a site's staging copy is set to follow the live site, staging is refreshed from a backup of the live database before each change, so the change is previewed on the real content.
https and Cloudflare
Every domain on a live British Web Design site gets a Let's Encrypt certificate, issued once the domain points at the server and renewed automatically. Staging addresses sit behind Cloudflare, which provides their certificates. Domains bought through British Web Design have their DNS on Cloudflare, edited from the dashboard.
Backups
The database of every live British Web Design site is backed up into a separate storage bucket that holds nothing but backups. Each server uploads its backup through an address signed for that one file, so no server holds a key to the bucket. Public access to it is blocked, it is encrypted, and it refuses plain http. By default a backup is taken daily and the last 14 are kept. A fresh backup is also taken before every release to the live site, and the deployment makes its own copy on the server just before any database change runs. Staging copies are not backed up. If a site's hosting is ever deleted, its backups are kept.
Uploads, forms and signing in
- Photographs sent through the British Web Design dashboard are checked by their contents, not their names, so a disguised file is refused. SVG files, which can carry scripts, are not accepted as photographs.
- Files sold as downloads stay private, handed only to customers who have paid, through links that expire.
- Contact and enquiry forms use a hidden honeypot field and Google reCAPTCHA v3 against spam.
- Signing in to a site's admin panel from the dashboard uses a single-use link that expires after 60 seconds and only works over https.
Updates and error tracking
British Web Design updates the software its sites run on, including Laravel and British Web Design's own packages for booking, payments and the platform, on the staging copy and the live site. These platform updates do not need the owner's approval, and a backup is taken before each one reaches a live site.
Every British Web Design site reports its errors to British Web Design, including page errors, failed background jobs and PHP warnings, with the details needed to fix them. Passwords, tokens, cookies and card numbers are removed before a report leaves the site, and new errors are emailed to the British Web Design team. Page speed is tested regularly too: see Search engines, analytics and page speed.
Questions
Where are British Web Design websites hosted?
British Web Design hosts its websites on its own servers in the UK, in London and Manchester, which it runs itself. Hosting is included in the €11.99/month per website.
Are British Web Design websites backed up?
Yes. The database of every live British Web Design site is backed up to separate private storage, daily by default, and again before every release. Staging copies are not backed up.
Do British Web Design websites have SSL?
Yes. Every domain on a British Web Design site gets an https certificate that is issued and renewed automatically, at no extra cost.
Is a British Web Design website built on WordPress?
No. Every British Web Design site is a Laravel (PHP) application with its own admin panel, so there are no WordPress plugins or themes to keep up to date.