<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 11/02/11 21:40, Patrick Collora wrote: <blockquote cite="mid:4EB1F126.4050601@msu.edu" type="cite"> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> Hey Everyone, Do any of you have any recommendations regarding reasonably priced Linux/Apache web hosting without too may restrictions? I was previously using <a moz-do-not-send="true" href="http://www.a2hosting.com/">A2 Hosting</a>. They were a good host until recently when they began limiting our CPU usage and number of connections. Routinely our site would simply be inaccessible during peak hours, especially if a search engine was indexing the site. We never exceeded the 50GB transfer limit of the account. Now I'm using <a moz-do-not-send="true" href="http://www.liquidweb.com/">LiquidWeb</a>. Performance is excellent, but immediately we started having trouble with 403 errors and IP addresses being blacklisted. I discovered that the culprit is <a moz-do-not-send="true" href="http://www.modsecurity.org/">ModSecurity</a>. ModSecurity looks for patterns in form input and blocks the HTTP request if it appears malicious. For example, one site member had text like "system (blah blah blah...)" in a photo description. It was blocked because it looked like an attempt to call system(). I found I can't even type the text "/bin/bash" into a form input on their server because it looks like a command. If a user makes several attempts to submit a blocked request, they permanently blacklist the IP unless someone requests to have it removed. They were unwilling to provide me with a report of the IP addresses blocked, so I have no way of knowing how severe the problem is. Anyway, it looks like we may be leaving LiquidWeb soon. I was surprised because I've seen them get good reviews from people, even some on their list, but to have them start blocking legitimate users and requests because some text vaguely matches an attack signature is simply unacceptable. My website is <a moz-do-not-send="true" href="http://www.lighting-gallery.net">http://www.lighting-gallery.net</a> Thanks. <pre class="moz-signature" cols="72">-- Patrick Collora</pre> </blockquote> Because the string "system (blah" existed ModSecurity blocked it? I don't know which to call it--pathetic, or monstrous. Anyway, take a look at Pair.com. They have pair-lite.com, for $100 a year for hobby sites. You can then get bigger plans if your bandwidth/file space needs grow. --STeve Andre' </body> </html>