A Festive Feast of Features in 2023

 In just a few minutes, you can have a stunning website up and running faster than you can say “Ho, ho, ho!” – well, almost. And for our partners and resellers, rejoice! You can boost your product offerings by including the Sitejet Builder for Plesk in your lineup, making it a win-win for both users and businesses.

We’ve been on a mission to make it even merrier. More templates have joined the party, and we spiced things up with an SEO Analysis feature and ensured it’s pre-enabled for those who keep their Plesk fresh and updated (if not, install it here). Talk about the gift that keeps on giving!

Plesk's 2023 Gift Basket: Unwrapping a Year of Tech Marvels!

In January, we kicked off the year with the release of the SOGo Webmail Extension and the introduction of the WP Toolkit Deluxe – the kind of tech goodies that warm the hearts of Plesk users worldwide. 

February saw us accelerating WordPress on CloudLinux, bringing centralized DB and Network File System management to the table – gifts that keep the digital fireplace of your server running smoothly.

March added a sprinkle of magic with Cloudflare integration, SOGo Webmail moving out of beta, Sophos Anti-virus protection, and a sleek Dark Mode – because who doesn’t love a bit of tech glamour? 

In April, we fortified your digital fortress with the Plesk Firewall, SSL It! And Let’s Encrypt are available for the Plesk Premium Email, and May brought the guardian angel for WordPress websites – WP Guardian, along with major updates to Sophos Antivirus. June introduced the Suspicious Email Detector. 

July was ablaze with the launch of the Sitejet Builder and the CentOS Elevate feature, making server transitions smoother than ever. DANE support for SSL It! and MySQL tuning for Plesk were like ornaments on the Plesk tree – fulfilling long-standing Christmas wishes.

August came bearing the gift of inclusion, with Plesk WP Edition now featuring the WP Toolkit Deluxe and flexible Backup Scheduling – a top-rated improvement that customers had been dreaming of. 

September brought the Plesk magic to ARM servers and granted the most-requested feature for two years – the Performance Booster Release. It provides a 32% increase in performance for WordPress sites and a 16% boost for other websites hosted on Plesk.

October saw Sitejet Builder pre-enabled for all and the introduction of Wappspector. November was the month of enhancements. Sitejet Builder got an SEO Analysis, we made improvements to WP Toolkit, and added the ability to measure and compare Time To First Byte (TTFB) in the Performance Booster.

And as we approach the end of the year, December brings the grand finale – Plesk Holideals, our digital Santa’s bag of exclusive deals and offers.

These improvements aren’t just updates; they fulfill our users’ Christmas wishes that have been on top of their lists – and we’re happy to comply. From enhanced security to streamlined server management, Plesk’s 2023 journey has been about making your hosting dreams come true. Let’s hear what Sergey Lystsev’s (CTO of Plesk) 2023 favorites are: 

"Our product team finds it most inspirational when Plesk makes top-tier technology expertise accessible to everyone. Among all the improvements in 2023, the Website Performance Booster and Sitejet Builder stand out as the most empowering innovations. The Website Performance Booster enhances website speed, increasing a site’s visibility in Google searches. It wraps a massive pack of the industry’s best practices into just one click. Furthermore, the Sitejet Builder, a powerful yet beginner-friendly website editor, allows users to effortlessly create stunning websites, regardless of their design experience. These breakthroughs exemplify Plesk’s commitment to making advanced technology accessible and user-friendly."

Sergey Lystsev, CTO of Plesk

Let Us Know What’s On Your Wish List for 2024

Here at Plesk, we’re not just asking for your wish list for under the tree; we want to know your hosting dreams for 2024! We believe in the magic of user feedback and want to ensure your Plesk experience is as delightful as a cup of cocoa by the fireplace. That’s why we’ve been on a quest to grant your hosting wishes and sleigh through your server dreams; 2023 has already seen top contestants come to life!

Help us make your wishes come true. Join our UX Research Program and get involved in the evolution of Plesk, gain exclusive access to new products, and pioneer great Plesk products with your valued feedback.

Join our program

Or take part in our yearly survey, and let us know what features, improvements, and magic you’d like to see in the Plesk universe. Because here at Plesk, your wishes aren’t just on our radar; they’re our top priority.

Take Survey

All Aboard the Plesk Sleigh

As we wrap up the magical journey of 2023, Plesk has been on a sleigh ride across the globe, spreading joy and innovation like Santa with a sack full of tech treats! While the spotlight gleams on the Free Sitejet Builder, let’s take a twirl through the festive events that have made this year truly enchanting.

Picture Plesk touching down at the vibrant WordCamp Asia in Bangkok and swooshing through the landscapes of CloudFest in Germany. June saw us donning techy hats at WordCamp Europe in Athens. By August, we were jingling all the way at WordCamp US, and all year long, we were rocking the tech bells at WebPros NEXT Events around the globe – it’s been a sleigh full of adventure! These gatherings weren’t just about showcasing Plesk but spreading the holiday spirit of connection, camaraderie, and innovation.on 

Unraveling the AI Magic in Hosting with Jan Loeffler

Twice this year, Jan Loeffler, the tech maestro from WebPros (cPanel, Plesk, WHMCS), took us on a thrilling ride through the ever-evolving landscape of hosting in his insightful talk on The Influence of AI in Hosting. 

Jan dove into the transformative power of AI, revealing how it’s not just a buzzword but a game-changer for your hosting endeavors. Picture this: AI reshaping the hosting industry, orchestrating streamlined operations for peak efficiency, fortifying security to shield your precious assets, and fine-tuning performance for stellar results.

And who knows, maybe, just maybe, the WebPros CTO will indeed host another opportunity for you to join. So stay tuned and make sure to follow us on social media!

As we close the book on 2023, our virtual glasses are raised to the excitement lingering in the air: What surprises will 2024 bring for the Plesk family? More features, integrations, or a tech treasure trove? Whatever it is, Plesk is ready for another year of innovation and joy. Here’s to a tech-tastic 2024! Cheers!

via GIPHY

Sleighing It: A Festive Feast of Features in 2023

 Alright, Pleskians, it’s a wrap – time to wind down, looking back on 2023 with a steaming cup of eggnog and musing about what 2024 has in store for us. Join us as we revisit all the big and small tweaks we made to Plesk, traveled around the world to meet as many of you as we possibly could, and more.

The Gift that Keeps on Giving: Sitejet Builder for Plesk

Since its grand entrance in July, Sitejet Builder has been the star on top of the Plesk tree. This fully integrated website builder is like the Swiss Army knife of website creation included in your Plesk license, offering a modern and intuitive solution for both web novices and seasoned administrators alike. We’re talking 140+ templates, an AI-based Text Generator, and a user-friendly experience as smooth as sipping hot cocoa by the fire.

NSIONS HELP CENTER MORE FREE TRIAL

 

What is MariaDB?

MariaDB, emerging in 2009, stands as a significant fork of the widely-used open-source database system, MySQL. The inception of MariaDB was primarily influenced by the acquisition of MySQL AB by Oracle Corporation, leading to concerns within the MySQL community regarding the future of the project’s open-source commitment.

Developed by Monty Widenius, one of the original creators of MySQL, MariaDB was designed to be a drop-in replacement for MySQL, ensuring compatibility and ease of transition for existing MySQL users. The primary motivation behind MariaDB was to maintain and enhance an open-source database system, driven by the community’s needs and contributions.

Central to MariaDB’s philosophy is its commitment to remain open-source and maintain compatibility with MySQL. This approach has facilitated a seamless migration path for users, making it a preferred choice for many who were already familiar with MySQL. MariaDB has introduced several new features and storage engines, like Aria and TokuDB, which have contributed to its reputation for improved performance and functionality over MySQL.

Over the years, MariaDB has seen widespread adoption and community support, reflecting a broader trend towards open-source solutions in database management. Its development underscores the significance of community-driven projects in shaping the landscape of technology, particularly in the realm of open-source software.

What is MongoDB?

MongoDB, launched in 2009 by the company 10gen (now MongoDB Inc.), marked a significant shift in the landscape of database management systems. It emerged as a frontrunner in the NoSQL movement, which sought alternatives to traditional relational database systems (RDBMS) that were dominant at the time.

The core concept of MongoDB is centered around its document-oriented nature, a departure from the row-and-column format of RDBMS. This model allows MongoDB to store data in flexible, JSON-like documents, enabling the representation of hierarchical relationships, arrays, and other complex structures more naturally and efficiently than typical SQL databases.

MongoDB’s schema-less design is a fundamental characteristic that differentiates it from traditional databases. This feature facilitates the accommodation of varied and evolving data models, making it particularly suitable for use cases with large volumes of rapidly changing data, such as in big data and real-time applications.

Since its inception, MongoDB has focused on scalability and performance. Its architecture allows for the easy distribution of data across multiple servers, enhancing the database’s reliability and speed. This scalability, coupled with its agility in handling diverse data types, has contributed to MongoDB’s popularity in a wide range of industries.

Throughout its evolution, MongoDB has balanced innovation with user-friendly features, such as its powerful query language, which offers extensive querying and aggregation capabilities. Its history reflects a broader trend in database technology towards systems that are not only performant and scalable but also adaptable to the diverse and dynamic needs of modern applications.

MariaDB vs MongoDB – Core Differences

Here are the key differences between MariaDB and MongoDB:

MariaDB exhibits compatibility with Azure and features high availability. It offers a robust cloud storage solution, accompanied by security measures. Additionally, MariaDB is user-friendly in various systems and provides a cloud service that simplifies usage for developers. Conversely, MongoDB is compatible with major cloud platforms such as AWS, GCP, and Azure, owing to its ease of integration with different cloud services. It is readily accessible in various systems, though it does not have a proprietary cloud service, a feature that distinguishes MariaDB.

MongoDB is widely recognized for its popularity, while MariaDB is often noted for its performance, security, and availability. MariaDB also has the capability to integrate with other databases and utilizes a column-based structure. On the other hand, MongoDB is designed to operate as a cloud service with a robust infrastructure, which contributes to its efficient performance in various applications, often requiring fewer resources. Additionally, MongoDB is specifically tailored for environments where the data storage is exclusively document-oriented.

Both databases provide compatibility with a wide range of programming languages. However, MariaDB does not include support for Matlab and certain shell languages. On the other hand, MongoDB is known for its extensive support encompassing all major programming languages within its system.

MariaDB includes support for storing, accessing, and retrieving data in XML format. In contrast, MongoDB does not offer this specific feature, focusing instead on document-oriented access and storage capabilities.

MariaDB utilizes a variety of APIs, such as ODBC, JDBC, and ADO.NET, along with a native API for its security system. These APIs are instrumental in managing data operations and ensuring data availability upon user request. In contrast, MongoDB does not employ traditional APIs but instead uses a protocol tailored for JSON data format. This approach in MongoDB, which is less complex compared to the API system in MariaDB, facilitates efficient data management within its framework.

MariaDB is fundamentally structured as a relational database model, whereas MongoDB is primarily a document store. MongoDB operates both as a document search engine and can perform some functions akin to a standard relational database. It is considered a leading document store in comparison with other databases in the market. In addition to its primary relational model, MariaDB also supports secondary storage types such as document stores and graph DBMS, and includes a search engine capability for graph data stored within the database.

MariaDB employs SQL queries, facilitating database interaction through SQL commands, which are familiar to many users. In the case of MongoDB, while it also utilizes SQL queries, these are primarily available in a read-only format. Users do not directly interact with these queries. Instead, they are used in business intelligence applications through the MongoDB Connector. This functionality aids in integrating the databases with other systems and enables data sharing.

A Simple Comparison Between MongoDB and MariaDB

In this comparison table, we take a deeper dive into both databases to help you decide whether MariaDB or MongoDB is right for your requirements.

MariaDB	MongoDB
In MariaDB, script execution maintains consistency, ensuring immediate data integrity in cases where queries fail.	Scripts are designed to ensure both immediate and eventual consistency, facilitating smooth script operation and execution.
Various partitioning methods are available, including sharding and horizontal partitioning. Sharding can be performed with the storage engine or clusters. This is useful for avoiding unwanted data in the system and for staying relevant to the data needed.	Thanks to the partitioning methods, the documents always work and identify the documents needed within the database. The method used here is Sharding, and this leaves documents arranged efficiently.
Master to master and master to slave replication methods are available. Any replication members have the power to edit data. The database functions effectively in this system.	The master to slave replication method is available. Data is unable to be updated by any users but the servers within the group.
Inside the system, a cache is managed and the load is checked. If it’s unavailable, data is loaded from the server — so the database’s work is easy.	As the cache is not managed in the system, data is not loaded from it.
The processing of data can take time and the facility of map reduce is unavailable.	Data processing can be performed easily thanks to map reduce, that helps to process significant loads of data simply at once. Map reduce leads to proper results.
As foreign keys are utilized in the system, data is linked from table to table. It’s easier to grab data from any table as a result.	This database does not use foreign keys, which means the tables aren’t easily linked. Data can be gathered from other tables if you call them from the table directly.
The database’s transaction levels are: atomicity, consistency, isolation, durability (a concept known as ACID).	The database uses ACID concepts and snapshot isolation to create a consistent view of available data with data integrity.
MariaDB is easy to use for users with SQL base , due to the number of similar queries and its functional similarity to SQL. Users with SQL standards will have rights provided to them.	MongoDB doesn’t work like SQL, but users have access rights based on system role.

Are These DBMS Supported By Plesk?

MariaDB is supported by Plesk under both Linux and Windows. For Plesk Obsidian under Linux you will need:

• MariaDB 10.4 and 10.5 starting from Plesk Obsidian 18.0.30.
• MariaDB 10.6 starting from Plesk Obsidian 18.0.41.
• MariaDB 10.11 is supported starting from Plesk Obsidian 18.0.52

Plesk Obsidian for Windows requires:

• MariaDB 10.4 and 10.5 starting from Plesk Obsidian 18.0.30 for both Plesk database and customers’ websites.
• MariaDB 10.6 starting from Plesk Obsidian 18.0.41.
• MariaDB 10.11 is supported starting from Plesk Obsidian 18.0.52

In contrast, MongoDB is not supported by Plesk Obsidian at the moment. MongoDB can be installed via Docker, however should be still managed manually – Plesk hasn’t got any set of tools to manage it.

Summary

In conclusion, MariaDB and MongoDB each offer distinct features catering to diverse data management needs. MariaDB, with its SQL query compatibility and variety of APIs, is well-suited for applications requiring traditional relational database structures and complex transactions. MongoDB, known for its document-oriented model and JSON protocol, excels in handling large volumes of unstructured or semi-structured data, making it ideal for big data applications and real-time analytics. The choice between MariaDB and MongoDB ultimately depends on the specific requirements of the application, such as data model complexity, scalability needs, and the programming environment.

Web Server Security – Beginner’s Guide

 Web server security is a broad term covering the processes and solutions that keep web servers secure. Web server security encompasses three elements: host, network, and physical. For example, a comprehensive firewall can protect network connections, while unauthorized users are prevented from accessing a network by specific hardware or software components.

When discussing web server security, we can look at two key areas:

• Securing a web server’s data
• Securing the services that run on a web server

Access controls and operating system security protect a web server’s data, while antivirus software and firewalls safeguard the services that run on said server. The server’s data can be considered the most important of its assets, which is why it’s likely to be targeted in the majority of attacks.

Fortunately, encrypting information stored on the disk allows you to protect data. Intrusion detection tools can identify unauthorized users’ attempts to intrude, too, and help you respond to them in an effective way.

Ultimately, a user’s priority when using the internet is reaching a specific website as soon as possible. But they want to land on, and use, that website safely. That’s why web server security is such a critical topic, especially today, when hackers have access to highly sophisticated software.

The good news is that professionals in the information technology (IT) industry can take various steps to defend web servers from outside attacks. For instance, implementing a firewall is one of the most basic security measures: these run checks on all traffic going into and out of a web server, identifies traffic that may be dangerous or suspicious, then blocks it. But what else can you do?

In this guide, we’ll explore helpful ways to secure your web server, the best open-source tools, and more. But first, let’s start by discussing why web server security is so important.

Understanding Why Web Server Security Matters

One of the most important parts of having a website is ensuring effective security — particularly when operating a web server. When a web server is unprotected, it can easily become the target of an attack, and hackers could steal sensitive data from it in no time.

Web servers are responsible for numerous tasks, including the storage, processing, and delivery of web pages (as well as other forms of online content). Additionally, web servers are essential for hosting and serving a variety of data in diverse formats. For example, video files, executable programs, and audio files.

With that in mind, a web server should be defended against unauthorized users to ensure that all information on it remains safe. That reduces the risk that anyone can access, modify, disclose, or even destroy data on the server.

What are the Most Common Web Server Weaknesses?

Web servers deliver the web content you browse daily, and they’re designed to be as robust, efficient, and secure as possible. However, they still have a number of vulnerabilities that affect their (and their users’) security.

Common weaknesses include command injection, cross-site scripting (XSS), and SQL injection. While some of these are easy to take advantage of, exploiting others requires a little more work and detail. Below, we’ll take a closer look at these security threats and why they’re so dangerous.

DoS Attacks

When someone launches a denial of service (DoS) attack, they are trying to prevent users from accessing the targeted web server or network resource as they usually would.

These focus on a specific web server or resource: the attacker floods the target with high levels of traffic until it becomes unavailable to genuine users. That can be especially damaging for online retail sites, as they would be unable to process transactions.

Perpetrators launch DoS attacks using viruses, bots, or other tools that consume the target’s CPU or network capacity. They can also initiate attacks with computers or networks that have been infected by viruses or other harmful software.

Cross-Site Scripting Attacks

During cross-site scripting (XSS) attacks, perpetrators inject code executed by the user’s web browser. The code responsible is typically seized when the user’s cookies are sent to the web server.

Perpetrators tend to use XSS attacks to undertake actions on behalf of a user, which allows them to access a user’s current session.

SQL Injection Attacks

An SQL injection is a form of attack capable of overrunning a database. The attacker will input malicious code into the information entry fields on a data-driven application or website.

Once the code is injected into the database of a website or application, the attacker can access data that would normally be out of their reach. They can view and tamper with this information, which could allow them to manipulate and expose sensitive data.

How to Keep Your Web Server Secure

In our interconnected world, companies of all sizes must take web server security seriously to stay safe. Cybercriminals have a wide variety of techniques to choose from, so it’s vital that you implement the necessary measures to secure your web server.

Attackers can cause extensive damage to any business, but comprehensive security can make their work much more difficult. Here are three simple steps to keep your web server secure.

Eliminate Redundant Services

Standard operating system setups aren’t secure, often including unused network services, like remote registry or print server services. These services open additional ports, increasing vulnerability to malicious attacks. Deactivate and disable these services to prevent them from auto-starting after a reboot, improving server performance and freeing hardware resources.

Control Remote Access

While less practical today, server administrators should ideally access web servers directly. If remote access is necessary, secure it with tunneling and encryption, use security tokens and single sign-on tools, limit access to certain IPs and accounts, and avoid using public computers or networks for remote server access.

Distinguish Development and Production Environments

Developers often use production servers for quicker application development, leading to public exposure of unfinished versions or content in directories like /test/ or /new/. These early-stage applications, with various vulnerabilities and poor exception handling, are susceptible to exploitation. Development and testing should occur on isolated servers, disconnected from live data and databases.

Isolate Web Application Data

Web applications and scripts should reside on a separate partition or drive from the operating system and other system files. Hackers accessing the web root can exploit vulnerabilities and gain access to the entire disk, including system files, allowing them to execute commands and control the server.

Manage Permissions and Privileges

Properly assigning permissions to files and network services is crucial for security. In case of a network service compromise, limiting privileges can prevent further exploitation. Ensure minimal necessary access for network services and anonymous users for web applications and databases.

Install Security Patches

Fully patched software doesn’t guarantee complete security, but it’s vital to regularly update the operating system and software with the latest patches. Many hacking incidents result from exploiting unpatched servers.

Monitor and Audit Server Logs

Keep web server logs in a separate area and regularly check them, including network services, website access, database server, and operating system logs. Investigate unusual log entries immediately to address potential security issues.

Secure User Accounts

Disable unused default accounts created during operating system installations. Check accounts added by software installations, adjust permissions as necessary, rename built-in administrator accounts, and ensure each administrator has a unique account without sharing credentials.

Remove Unused Modules and Extensions

Disable unnecessary Apache modules and limit IIS to essential application extensions, restricting their HTTP verb usage. This step reduces risks of targeted attacks on these modules.

Utilize Provided Security Tools

Use security tools like URL scan for IIS and mod_security for Apache. While setup can be complex and time-consuming, especially with custom applications, these tools add significant security enhancements.

Top Open Source Security Solutions for Web Servers

You can choose from a wide range of open source security tools to protect your web server. These can help defend you against common threats and provide users with a safer experience.

Here are the best open source security tools for web servers available.

Nmap

Nmap (Network Mapper) is an open-source solution for security audits, discovering networks and hosts, and exploring networks. You can use Nmap to scan networks on a bigger scale, but it’s suitable for single hosts too.

Snort

Snort is built for preventing network intrusion and identifying potential threats. It can run traffic analysis in real-time, using both protocol analysis and pattern matching to pinpoint signs of possible issues in network traffic.

Metasploit

With Metasploit, you can get an insight into security weaknesses that will make it easier to protect your web server.

Metasploit helps in IDS signature development and penetration testing, so you can learn more about vulnerabilities and take action to address them before they are exploited by attackers.

Sqlmap

Sqlmap is an open-source tool for automated security testing: you can automatically identify and exploit SQL injection vulnerabilities that would allow attackers to take a database over. This can be an effective way to fix weaknesses before someone else discovers them.

OpenVAS

With OpenVAS, you can run a comprehensive network scan to detect issues (such as XSS vulnerabilities). OpenVAS is free to use, and companies across the globe use it to maintain a secure infrastructure.

Top Web Server Security Tools for Plesk

The number of servers managed by Plesk is growing every year. If you are already using Plesk or just plan to –  it is worth to remember that part of the most popular Plesk extensions are those focused on server’s security. Here are some of the most powerful ones which help combat server threats.

Sentinel Anti-malware

Sentinel Anti-malware is a scanner that combines the open-source principles from Linux Malware Detect and ClamAV. This extension especially serves power users and service providers who want to ensure they have protection from a variety of malware.

Kernelcare

This premium extension (free trial for 30 days) protects Linux servers against critical vulnerabilities. Mainly by automatically installing security updates to running kernels. This avoids rebooting servers and planning scheduled downtime for your customers. And it also ensures kernels are updated within hours of patch releases for uninterrupted security.

BitNinja

The BitNinja extension prevents 99% of malicious attacks. This can consequently reduce your server alerts and customer complaints by just as much. It actually provides protection against nine different aspects of attacks – including malicious port scans and infections. You can even set it up and start automatically protecting your server in as quick as five minutes.

Atomic Secured Linux

The Atomic Secured Linux extension provides the same level of protection that typically comes with an expert security team. It can prevent, detect, and respond to today’s greatest cybersecurity challenges. In particular, it features host and kernel intrusion prevention systems, brute force protection, and automated malware removal.

(D)DoS Deflate Interface

(D)DoS Deflate Interface is a lightweight shell script that helps deflect DDoS attacks automatically. The script runs in the background, blocking incoming connections from multiple IPs from which connections exceed the configured threshold. And above that – It’s simple to install and operate.

Summary

Operating a website of any kind requires a good web server. The site’s core files are hosted on a computer and delivered to the users who land on your site, so ensuring effective web server security is paramount to reduce risks. Otherwise, attackers could target your site, access sensitive data, and disrupt your operations.

We hope this guide to web server security has helped you understand some of the risks out there and the best ways to stay safe.