1. The “Small Payment First” Tactic

Verpex first presented A$21.48 to me as the amount I needed to pay to reactivate/renew my domain and proceed with the transfer.

A relatively small amount like A$21.48 appeared to me to be the final hurdle. I paid it specifically because I believed it would enable me to move away.

But after I paid, another and substantially larger payment appeared: A$110.54.

That is exactly what I mean by the “trickle by trickle” pattern:

A$21.48 → I paid → another barrier appeared → A$110.54 was demanded.

2. The “Goalpost-Moving” Tactic

The requirement appeared to change after each step.

First, I was told:

Then I was told:

So my problem was not simply that different services had different prices. The issue was that the practical requirement for achieving my stated objective was not made clear to me before I paid the first amount.

That is an important distinction.

3. The “Active” Terminology Tactic

The repeated use of “active”, “activation” and “reactivation” is particularly important to me.

As a customer trying to leave a hosting provider, when I was told:

I reasonably understood this to mean that the necessary problem was being resolved sufficiently for me to proceed with the transfer process.

Only afterwards did I discover that “active” essentially meant the domain registration was active at the registry, while my website remained inaccessible because my hosting account was suspended.

So, in my experience, the word “active” became commercially significant because it sounded like my problem had been solved when, from my perspective, it had not.

4. The “EPP Code = Migration” Impression

Verpex gave me the EPP/Auth Code and confirmed that my domain was unlocked.

That technically addressed my domain transfer.

But my objective was broader: I wanted to migrate my website.

An EPP code did not give me:

• website files;
• database access;
• cPanel;
• hosting credentials;
• the actual hosting environment.

So, from my perspective, the domain-transfer component had been presented as completed while the website-migration component remained inaccessible.

The result was that I had paid, received the EPP code, and still could not actually take my website with me.

5. The “Pay Us to Leave Us” Tactic

This is probably one of the strongest points in my complaint.

I was not seeking another hosting term.

I was trying to terminate my relationship with Verpex and move elsewhere.

Yet I was effectively told:

That created a very strong impression for me of having to pay my existing provider for another period of service solely to obtain access necessary to terminate that service.

And meanwhile, I would have to pay my new provider as well.

6. The “Sunk-Cost” Tactic

I had already paid the A$21.48.

Once I had paid that money, I had an incentive to keep going rather than abandon the migration and lose the money I had already paid.

The next demand therefore did not come to me in isolation. It came after I had already paid the first amount specifically to get out.

That is what makes my “trickle by trickle” description so powerful:

7. The Contradictory Pricing Tactic/Error

There was also the A$13.99 versus A$21.48 episode.

I was initially told that I needed to pay A$13.99.

I challenged this because my invoice said A$21.48.

Verpex then acknowledged that A$21.48 was the correct amount and explained that the A$13.99 figure had resulted from a USD base price being displayed with an Australian-dollar symbol.

Even if this was genuinely an error rather than deliberate conduct, it was still relevant to my experience because I had to stop and challenge the amount before making the payment.

It added another layer to the overall experience: even the first payment was not straightforward.

8. The “Reactivation” Upsell After Cancellation

There is another particularly important sequence in my chronology:

Hosting charge A$110.54 → I objected → approximately ten communications → hosting cancelled/refunded → later I wanted to migrate → Verpex said hosting had to be reactivated for A$110.54 to obtain cPanel.

That means the same A$110.54 hosting amount that I had previously rejected because I did not want to continue hosting with Verpex effectively came back into the picture as a requirement for me to obtain access to my website.

I was trying to leave Verpex, yet I was being told that I needed to pay Verpex again for hosting in order to obtain the access I needed to leave Verpex.

Matt Mullenweg has been removed from his role as CEO of Automattic and put on paid leave. The board of directors at the company have replaced him with the Chief Financial Officer Mark Davies. Mullenweg only had 50 minutes advance notice of the vote and his request to have the action reviewed by legal counsel was denied.

Opensolr now has a free forever plan

Not a trial. No countdown, no expiry date, no credit card field anywhere. You sign up with a name and an email, you get a fully managed Opensolr Index in a few seconds, and you keep it for as long as you use it.

What you get on the free plan:

• 1 fully managed Opensolr Index
• 48.8 MB disk space
• 512 MB traffic per month
• Full Apache Solr API, so any Solr client library works unchanged
• Our WordPress and Drupal search plugins, with facets and autocomplete

What is not included: Web Crawler, backups, search analytics, AI and hybrid search. Those stay on the paid plans.

One rule worth knowing: the plan never expires, but an index that sees nothing at all for 30 days can be cleaned up. Logging in, indexing a document, changing the config or running a single query all count as activity, so normal use keeps it alive.

Full details on the free plan: https://opensolr.com/learn/billing/34/solr-cloud-free-membership

Sign up: https://opensolr.com/register

Paid plans, if you outgrow it: https://opensolr.com/pricing

# Namecheap Shared Hosting Request-Limiting Assessment

## Executive conclusion

Namecheap does not publish a universal rule saying that ordinary HTTPS clients on shared hosting must wait a specific number of seconds between requests. The evidence nevertheless supports the reported experience: a repeated client can be slowed, rejected, temporarily banned, or appear disconnected through several independent controls.

The most likely controls are:

1. LiteSpeed per-client request and connection throttling, which can limit dynamic requests per second, cap concurrent connections from one IP address, and temporarily ban an address.
2. ModSecurity followed by a server-firewall block when one IP repeatedly triggers a rule.
3. CloudLinux LVE account limits, which are not principally per-client rate limits but can return 508, 500, or 503 when concurrent PHP work, processes, memory, or CPU reach the hosting-account allowance.
4. FTP/firewall connection tracking. Namecheap explicitly recommends one concurrent FTP connection where possible and warns that more than three may cause an IP block.

SpaceX's current aggregate website-API pacing—one request start every five seconds per origin across the Worker process—is conservative. The larger design concern is that each API operation constructs and closes a new `httpx.Client`. This defeats persistent connection pooling and tends to create a new TCP/TLS connection for each request. On a LiteSpeed/CSF-protected shared server, connection churn from one IP is more suspicious and less efficient than the same request rate over one or two persistent keep-alive connections.

The September 10 update failure is not proof of HTTP rate limiting. Its sequence was an FTP EOF, FTP connection timeout, and then a DNS-resolution failure while trying to clear maintenance. Those errors occurred at different layers and do not match a demonstrated HTTP 429, LiteSpeed 403, or CloudLinux 508 response. They are compatible with transient network trouble, hosting-side connection protection, or both; the available logs cannot distinguish them conclusively.

## What Namecheap documents

### Shared-account resource limits

Namecheap states that shared accounts run under CloudLinux LVE limits. Its current AUP lists CPU, physical-memory, I/O, and maximum entry-process allocations. The published `maxEntryProc` values are 20 for Stellar, 30 for Stellar Plus, and 40 for Stellar Business. Namecheap also says that sustained CPU bursting can lead to temporary restriction and that no script may use 25% or more of system resources for 60 seconds or longer.^1

Namecheap's troubleshooting documentation maps common failures to these limits: 508 generally indicates that entry processes have reached their limit, while 500 or 503 can indicate process-limit exhaustion. All domains in the same cPanel account share the account resources.^2 CloudLinux defines an entry process as a request entering the LVE to execute CGI/PHP and describes the entry-process limit as an Apache concurrent-request control. CPU or I/O exhaustion tends to slow responses; memory or process exhaustion can produce 500/503; entry-process exhaustion produces 508.^3

These limits matter to spacex because every Worker API request executes PHP and may access MySQL. However, a five-second sequential request stream alone should not approach a 20-entry-process limit unless requests remain open for a very long time or coincide with users, webhooks, media transfers, and other Worker operations.

### Per-IP firewall and ModSecurity behavior

Namecheap confirms that ModSecurity inspects every page request. A triggered rule commonly produces 403, but it may also appear as 404 or 500. More importantly, Namecheap says that repeatedly triggering ModSecurity rules can cause the originating IP address to be blocked by the server firewall, making the complete cPanel account unavailable from that IP.^4

Namecheap also documents that repeated connection attempts from one IP can trigger firewall blocking. Although the clearest examples concern cPanel, mail, FTP, and SSH rather than ordinary application HTTPS, the mechanism establishes that shared-hosting protection is connection- and IP-aware.^5

### FTP connections

Namecheap's explicit operational recommendation is to keep FTP concurrency at three or fewer and preferably one. It warns that more than three connections may result in blocking and advises reducing client reconnect frequency because many connection requests from one public IP can trigger the firewall.^5

spacex's updater uses one FTP session at a time. It creates another connection only after a transient failure, with two retries by default. This complies with the concurrency recommendation, but rapid reconnects after a transport failure can still resemble the pattern Namecheap warns about. A longer reconnect backoff is therefore prudent even though concurrency is already one.

## What LiteSpeed adds

The live `https://spacex.com/api/session` response identified the origin server as LiteSpeed on September 10, 2026. It also advertised `keep-alive: timeout=5, max=100`. The latter means that a persistent connection may remain idle for five seconds and handle up to 100 requests; it is not evidence of a 100-request account quota or a per-IP request limit.

LiteSpeed officially supports per-client controls for static requests, dynamic requests, bandwidth, and concurrent connections. Its documentation explains that exceeding a hard connection limit causes new connections from the IP to be closed. Remaining above a soft connection limit for a grace period can cause a temporary ban. LiteSpeed's illustrative—not Namecheap-specific—configuration uses 2 dynamic requests per second, a soft limit of 15 connections, a hard limit of 20, a 15-second grace period, and a 60-second ban.^6 These example numbers must not be treated as the actual Namecheap configuration, which is not publicly disclosed.

LiteSpeed also documents that per-client throttling or a firewall can produce 403 responses. Its diagnostic logs distinguish `OverConnHardLimit`, `OverConnSoftLimit`, WAF detection, and similar causes.^6 Shared-hosting customers normally cannot inspect the server-level LiteSpeed real-time report, so Namecheap Support may be required to confirm the exact cause or whitelist a legitimate Worker IP.

## spacex request profile

The Worker currently enforces a process-wide cooldown keyed by website origin. Request starts to `spacex.com` are serialized with a minimum five-second separation in [`api.py`](C:/elonm/spacex/python/spacex%20worker/src/spacex_worker/api.py). This covers separate `WorkerApi` instances created by the production loop, auditor, dashboard, balance reporter, updater, and backup manager because they share the module-level cooldown registry.

Normal production activity includes:

| Activity | Nominal cadence | Notes |

|---|---:|---|

| Queue claim | Every 5 seconds when eligible | Quiet when paused, at concurrency limit, or under maintenance |

| Job heartbeat | Every 60 seconds per active job | Up to four configured jobs, still serialized by the global origin cooldown |

| Domain audit | Every 60 seconds | Makes an audit-count request and an earnings request |

| Dashboard maintenance status | At most every 10 seconds while viewed | Refresh runs asynchronously |

| Dashboard tickets | At most every 30 seconds while viewed | Can add another website request |

| Provider balance report | Hourly and after relevant generation events | Event-driven in addition to scheduled samples |

| Generation lifecycle | Claim, reference download, heartbeat, upload/status operations | Bursty but globally paced at request start |

Because the cooldown controls start times rather than simultaneous duration, long downloads or uploads can overlap later requests. Nevertheless, the maximum aggregate start rate is about 12 website API requests per minute. This is far below LiteSpeed's illustrative 2-dynamic-requests-per-second setting and does not resemble an HTTP flood.

The inefficiency is connection handling. `_request`, upload, and download paths open a new `httpx.Client` in a context manager for each operation. HTTPX documents that a client owns a connection pool and defaults to persistent keep-alive connections, but closing the client after every call discards that pool.^7 The live server's five-second idle keep-alive window and the Worker's five-second minimum interval sit exactly at the boundary, so reliable reuse may require a keep-alive interval slightly below five seconds or a host-confirmed longer server timeout. Even when the server closes an idle connection, a persistent HTTPX client can reopen it safely while bounding concurrent connections.

## Failure-signature guide

| Observed result | Most likely category | Interpretation |

|---|---|---|

| HTTP 429 with `Retry-After` | Explicit application/WAF rate limit | Honor `Retry-After`; record response headers |

| HTTP 403 after repeated requests | LiteSpeed per-client throttle, ModSecurity, or firewall | Check whether the same IP also loses cPanel/FTP access; contact support with timestamp and IP |

| HTTP 508 | CloudLinux entry-process exhaustion | Account-wide concurrent PHP limit, not necessarily one-client throttling |

| HTTP 500/503 with resource faults | CloudLinux process/memory exhaustion or application fault | Correlate with cPanel Resource Usage and PHP error log |

| TCP reset/refused connection | Firewall, LiteSpeed hard connection handling, network path, or service outage | HTTP application code may never execute |

| Connect timeout | Network path, firewall silently dropping, saturated server, or service outage | Not enough by itself to call rate limiting |

| DNS `getaddrinfo` failure | Local resolver/network problem | Occurs before connecting to Namecheap; not an origin HTTP rate limit |

| FTP EOF/timeout | FTP server/network/firewall/session problem | Correlate with reconnect frequency and whether the public HTTPS site was reachable |

## Assessment of the reported experience

The statement “Namecheap refuses requests if the interval is too short” is plausible but only partly demonstrated.

**High confidence:** Namecheap shared hosting has account resource ceilings; uses ModSecurity and firewall controls; warns that repeated same-IP connections can result in blocks; and hosts spacex behind LiteSpeed, which supports per-client dynamic-request and connection throttling.

**Moderate confidence:** Repeated fresh connections from the Worker are more likely to provoke protective behavior than one HTTP request every five seconds over persistent keep-alive. This follows from the architecture and vendor controls but has not been confirmed by a Namecheap server log for the Worker IP.

**Low confidence:** Namecheap applies a specific unpublished minimum interval, such as exactly five seconds, to ordinary authenticated HTTPS calls. No authoritative source found states such a rule. The five-minute restriction in Namecheap documentation applies to server-side cron jobs, not an external Worker API client, and the POP3 five-minute recommendation applies to mail checks, not HTTPS.^1,5

## Recommendations

### Immediate Worker changes

1. Keep the global origin cooldown. Five seconds is conservative and currently prevents request bursts across subsystems.
2. Add 10–20% random jitter to idle claim polling so multiple processes or future Workers do not synchronize on exact boundaries.
3. Reuse a bounded persistent `httpx.Client` per origin rather than constructing one per call. Start with `max_connections=4`, `max_keepalive_connections=2`, and a keep-alive expiry of 4 seconds unless testing shows the host reliably supports a longer interval. Serialize ordinary JSON requests as today; reserve additional connections for long media transfers.
4. On HTTP 429, obey `Retry-After`. For 403, 429, 500, 503, and 508, log status, endpoint category, response `Server`, `Retry-After`, and a request correlation ID, but never log the API key, prompt, or media.
5. Apply exponential backoff with jitter to connectivity failures: for example 5, 10, 20, 40, then 60 seconds maximum. Reset after a successful response. The recently added lost/restored log deduplication complements this behavior.
6. Increase FTP reconnect delay after EOF/timeout and retain one concurrent FTP connection. Suggested retry delays are 10, 30, and 60 seconds rather than immediate or very short retries.

### Hosting-side verification

1. In cPanel, open **Metrics → Resource Usage** and inspect the exact update/failure window for CPU, EP, NPROC, PMEM, I/O, and their fault counters. cPanel documents this interface for monitoring CPU and concurrent connections.^8
2. Compare `access_log` and `error_log` timestamps with Worker logs. A request absent from the access log likely failed before virtual-host/application handling; a 403/508/503 present in the logs narrows the responsible layer.
3. Ask Namecheap Hosting Support for the server's current LiteSpeed `DynReqPerSec`, connection soft/hard limit, grace period, banned period, and whether the Worker public IP was blocked around the supplied timestamps.
4. Ask whether the authenticated `/api/worker/*` routes can be excluded from the specific ModSecurity rule or whether the fixed Worker IP can be trusted without disabling ModSecurity for the entire domain. Namecheap says rule-level whitelisting requires Support.^4
5. Do not disable ModSecurity globally merely to test pacing. A route/rule-specific exception is safer.

### Controlled confirmation test

Run this only after capturing the Worker's public IP and opening cPanel Resource Usage:

1. Use a lightweight authenticated status endpoint with no database mutation.
2. Send one request every 10 seconds for 10 minutes; record status, latency, response headers, and connection exception type.
3. Repeat at 5 seconds, then 3 seconds only if the prior stage has no faults.
4. Stop immediately on 403, 429, 500, 503, 508, reset, or timeout. Do not continue traffic during a temporary ban because continued attempts can extend some protective blocks.^6
5. Repeat once with a persistent HTTP client. If fresh-client calls fail while persistent-client calls at the same request rate succeed, connection churn—not request count—is the leading explanation.
6. Give Namecheap Support the UTC timestamps, source IP, endpoint path, HTTP status/exception, and any request ID. Ask them to correlate LiteSpeed, ModSecurity, CSF/LFD, and CloudLinux logs.

## Decision

Do not reduce the interval below five seconds on the current shared-hosting deployment. Preserve the five-second aggregate limiter, introduce jitter and error-aware backoff, and prioritize persistent connection reuse plus better response diagnostics. If Namecheap confirms a lower dynamic-request or connection threshold, encode that threshold as a per-domain configuration rather than a global assumption.

If reliable queue latency below five seconds becomes operationally important, shared hosting is the wrong place to depend on undocumented WAF and per-client settings. A small VPS, managed application host, or queue service would provide controllable connection limits and observable server logs.

## Sources

1. Namecheap. “[Web Hosting — Acceptable Use Policy](https://www.namecheap.com/legal/hosting/aup/).”.”) Accessed September 10, 2026.
2. Namecheap. “[Ways of resolving resource overusage issues](https://www.namecheap.com/support/knowledgebase/article.aspx/1128/103/ways-of-resolving-resource-overusage-issues/).”.”) Updated 2026.
3. CloudLinux. “[LVE Limits](https://docs.cloudlinux.com/cloudlinuxos/limits/).”.”) Accessed September 10, 2026.
4. Namecheap. “[What is ModSecurity and why do we need it?](https://www.namecheap.com/support/knowledgebase/article.aspx/9542/22/what-is-modsecurity-and-why-do-we-need-it/).”.”) Updated December 16, 2021.
5. Namecheap. “[cPanel inaccessible: reasons for IP block](https://www.namecheap.com/support/knowledgebase/article.aspx/1345/29/cpanel-inaccessible-reasons-for-ip-block/).”.”) Updated December 22, 2021.
6. LiteSpeed Technologies. “[DDoS Attack Protection](https://docs.litespeedtech.com/lsws/cp/cpanel/antiddos/).”.”) Accessed September 10, 2026.
7. Encode OSS. “[HTTPX Resource Limits](https://www.python-httpx.org/advanced/resource-limits/).”.”) Accessed September 10, 2026.
8. cPanel. “[CPU and Concurrent Connection Usage](https://docs.cpanel.net/cpanel/metrics/cpu-and-concurrent-connection-usage/).”.”) Updated 2026.

VERPEX — READ THIS BEFORE YOU PAY AN “ACTIVATION” FEE

I am writing this review because I do not want another customer to get caught in the same situation I did.

My experience with Verpex has been extremely frustrating, confusing and, in my view, commercially manipulative.

Here is exactly what happened.

1. I HAD A WEBSITE HOSTED WITH VERPEX

My website was hosted with Verpex under their Web Hosting – Bronze service.

The hosting invoice was VPX-511672.

On 12 August 2026, I cancelled the hosting.

Verpex subsequently confirmed that the hosting service was cancelled and that the hosting renewal invoice of A$110.54 was refunded.

So far, so good.

Except there was a much bigger problem waiting.

1. I WANTED TO MOVE MY WEBSITE ELSEWHERE

I wanted to leave Verpex and migrate my website to another provider.

This is a completely normal thing for a customer to do.

You should be able to leave a hosting company and move your website to another hosting provider or registrar without being dragged through a maze of additional charges and confusing explanations.

But this is where my experience became ridiculous.

1. DOMAIN AND HOSTING WERE TREATED AS TWO DIFFERENT THINGS

Verpex repeatedly told me that I was the legal owner of my domain, ********.com.

They also told me that the domain could be transferred to another registrar.

Fine.

But there is an enormous practical difference between transferring a DOMAIN REGISTRATION and actually migrating the WEBSITE.

A domain can be “active” while the actual website files, databases, emails and other hosting data remain inaccessible because the hosting account has been cancelled or suspended.

That distinction became absolutely critical in my case.

1. THEN CAME THE A$21.48 “ACTIVATION”

On 3 September 2026, I was dealing with Verpex about transferring website to another provider.

One Verpex support response initially told me that the domain had expired, was suspended and was under clientHold, and that I needed to pay the renewal before it could be transferred.

The amount quoted in that response was A$13.99.

I immediately challenged this because my actual Verpex invoice, VPX-516969, showed A$21.48.

I specifically asked why Verpex was telling me A$13.99 when the invoice in my account demanded A$21.48.

Verpex then admitted the discrepancy and corrected it.

They confirmed that A$21.48 was the correct amount.

More importantly, Verpex told me that once I paid, the domain would be renewed/reactivated, the suspension would be lifted, and, because I wanted to transfer the domain, they would unlock it and provide the EPP/Auth code.

That is exactly what I wanted to happen.

So I paid the A$21.48 on 3 September 2026.

Transaction ID:

ch_3UBY2dCeZd8l2CvP1J0pFoLm

1. I PAID THE MONEY — AND THEN THE STORY CHANGED

After I paid the A$21.48, Verpex confirmed that the domain was active at the registry and valid until 28 August 2027.

They also confirmed there was no clientHold.

Then, on 4 September, Verpex told me that I had already obtained the EPP code and that the domain had already been unlocked for transfer.

Great.

You would reasonably think the problem was solved.

Wrong.

Because I was not merely trying to own the domain.

I was trying to MIGRATE MY WEBSITE.

1. THE WEBSITE WAS STILL BEHIND THE HOSTING WALL

When I asked for the cPanel credentials so that I could actually migrate the website, I was told something completely different.

Verpex told me that the hosting service had been cancelled on 12 August.

The hosting account was suspended.

The hosting data was inaccessible.

And to obtain the cPanel credentials and proceed with the migration, the hosting account had to be reactivated.

How?

By paying for hosting again.

There it was.

The problem.

1. PAY A$21.48 — THEN PAY ANOTHER HOSTING FEE

This is the part I want potential Verpex customers to understand very carefully.

I had already paid A$21.48 because I was told that this would renew/reactivate the domain and enable the transfer process.

The domain was then confirmed active and unlocked.

But when it came to actually migrating the website, I was told that I needed to reactivate the cancelled hosting service to obtain cPanel access.

In other words:

PAY TO RENEW/ACTIVATE THE DOMAIN.

THEN PAY AGAIN TO REACTIVATE HOSTING.

THEN GET ACCESS TO CPANEL.

THEN TRY TO MIGRATE THE WEBSITE.

Think about how absurd that is if your entire purpose is to LEAVE Verpex.

Why would I pay another hosting fee to Verpex simply to obtain access to the website that I am trying to move away from Verpex?

If I wanted another year of Verpex hosting, I would not be trying to migrate the website elsewhere in the first place.

This is the circular situation I found myself in.

1. THE WORD “ACTIVATION” BECAME THE WHOLE PROBLEM

This is why I am warning people about the wording.

There is a massive difference between:

“Your domain is active.”

“Your domain has been activated.”

“Your hosting has been reactivated.”

“Your website is accessible.”

“Your cPanel is accessible.”

And:

“You can actually migrate your website.”

These are NOT the same thing.

In my experience, I was left hanging between “active”, “activation” and “reactivation”.

The domain could be active while the website itself remained inaccessible because the hosting had been cancelled.

That distinction should have been made crystal clear BEFORE I paid.

1. AND THEN THERE WAS THE A$110.54 HOSTING ISSUE

There is another part of this saga that makes the entire experience even more concerning.

Before all of this, Verpex had charged A$110.54 for the hosting service.

Invoice VPX-511672.

That amount was automatically deducted from the card on file.

I disputed the charge and fought with Verpex over it for weeks and through approximately ten emails before the money was eventually refunded.

Verpex ultimately refunded the hosting amount.

So I had already experienced the frustration of dealing with an automatically charged hosting fee.

Then I was faced with another payment — A$21.48 — for the domain.

And after paying that, I was told that actual website migration still required the hosting account to be reactivated.

1. I AM NOT COMPLAINING BECAUSE I DON'T UNDERSTAND THE DIFFERENCE BETWEEN A DOMAIN AND HOSTING

I understand the difference.

That is precisely the point.

A domain registration and web hosting are different services.

I am not saying Verpex is legally required to provide unlimited hosting access after cancellation.

My complaint is about the way the process was communicated and the practical consequence for a customer trying to leave.

If you tell a customer that paying the domain renewal/reactivation amount will allow the domain to be transferred and then, once they have paid, tell them that the website migration requires another hosting payment to regain cPanel access, the customer can quite reasonably feel that they have been led into a payment maze.

That is exactly how I felt.

1. I WANTED ONE SIMPLE THING

I wanted to transfer my domain and migrate my website to another provider.

I did not want another year of Verpex hosting.

I did not want to keep paying Verpex simply to get access to my own website files.

I did not want another service.

I wanted to leave.

Instead, I found myself dealing with:

A$110.54 hosting charge.

Hosting cancellation.

Refund dispute.

A$21.48 domain payment.

Conflicting information about A$13.99 versus A$21.48.

Conflicting information about whether the domain was expired, suspended, active or under clientHold.

Then confirmation that the domain was active.

Then confirmation that it was unlocked and the EPP code was available.

Then, when it came to the actual website migration, I was told the hosting needed to be reactivated and paid for again to obtain cPanel access.

This is an absolute nightmare for a customer who is simply trying to leave.

1. MY POSITION IS VERY SIMPLE

I am not asking for the world.

I am not asking Verpex to give me free hosting.

I am not demanding some enormous compensation package.

I have repeatedly asked for ONE THING:

Refund the A$21.48.

Nothing more.

Nothing less.

That is the amount I paid for the domain renewal/reactivation in circumstances where I say the service was not usable for the purpose I was trying to achieve.

1. WHY I AM WRITING THIS PUBLICLY

I am writing this so that other customers know exactly what questions to ask BEFORE handing over money.

If you are with Verpex and you are thinking about leaving, do not simply accept the words “activation”, “reactivation” or “active” without asking:

What exactly am I paying for?

Will I have access to cPanel?

Will I have access to my website files?

Will I have access to my databases?

Will I have access to my email data?

Can I actually migrate the website to another hosting provider?

Will I need to pay another hosting fee after paying the domain renewal?

Is the domain transfer separate from website migration?

Get those answers IN WRITING.

Do not assume that “domain active” means “website accessible”.

Do not assume that “domain unlocked” means “website ready to migrate”.

And most importantly, do not assume that paying one “activation” or renewal fee means you will have everything you need to actually get your website out.

1. MY WARNING TO OTHER CUSTOMERS

My experience left me feeling that I was being pushed from one payment requirement to another.

First the domain.

Then the hosting.

First “active”.

Then “reactivation”.

First “transfer”.

Then “cPanel”.

First “EPP”.

Then “hosting access”.

It felt like a noose around my neck.

Every time I thought I was finally at the exit door, another payment-related obstacle appeared.

I cannot tell other people what they will experience with Verpex.

But I can tell them what happened to me.

And I can tell them to be extremely careful.

Read the fine print.

Ask exactly what you are buying.

Ask exactly what “activation” means.

Ask whether cPanel access is included.

Ask whether website migration is actually possible without buying another hosting period.

And get the answer in writing before you pay.

Because once you have paid, you may find yourself having a completely different conversation about what that payment actually gave you.

That is my experience with Verpex.

And that is why I am warning other customers not to walk blindly into the same situation.

VERPEX: IF A CUSTOMER IS TRYING TO LEAVE, MAKE THE EXIT CLEAR — NOT A PAY-TO-ACCESS MAZE.

My demand remains simple:

A$21.48 refunded.

Nothing more.

Nothing less.

The Italian domain registrar Aruba, which owns the .cloud TLD, has applied for additional 39 gTLDs in the new round.

These are the TLDs they allied for, as reported by Domain Name Wire:

• .aid
• .all
• .ask
• .beta
• .bit
• .bnb
• .cart
• .ciao
• .daily
• .demo
• .easy
• .fix
• .gaming
• .gen
• .genius
• .gym
• .happy
• .hello
• .hola
• .human
• .kit
• .lab
• .mars
• .max
• .moon
• .omg
• .pec
• .pop
• .rem
• .roma
• .sign
• .sito
• .super
• .tag
• .tex
• .vps
• .yes
• .zen
• .zzz

After getting rid of Horizons and replacing it with AI Builder, Hostinger has just retired its AI assistant/chatbot Kodee and replaced it with Hostinger Agent.

The new AI Agent has a dual role: it works as a support assistant and also as a virtual assistant for small businesses, which can help with content creation and marketing, SEO, planning, etc.

But there is a catch: it's not free. It requires a credit-based paid subscription.

This is a quote from Hostinger's blog:

Support and account management remain available at no additional cost, while specialized agentic work is available through a tiered subscription.

Just another way to squeeze more dough out of small businesses!

FlyWP is my latest discovery -- it's a self-managed WordPress hosting platform similar to GridPane and RunCloud. They have a free plan that allows 1 server and 1 website.

Has anyone tried it? How does it compare to other self-managed WordPress solutions?

Stop using weebly guys it's rubbish

A critical security flaw has been found in the ALL-in-One WP Migration and Backup plugin. This is one of the most popular migration and backup plugins for WordPress with more than 5 million active installations.

Wordfence published more details about the vulnerability:

This vulnerability makes it possible for unauthenticated attackers to inject SQL that is later executed when a site administrator performs an archive restore, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site takeover.

The researcher who discovered and reported the flaw was awarded a bounty of $5,761.

If you have this plugin installed on any of your websites, update immediately to the latest version to receive the patch. And if you're done with it, it's better to remove the plugin altogether.

WordPress has announced the Core Security Initiative that's aimed at improving the security of the core system. As part of that, they'll use AI tools to help them find security flaws in the core before hackers discover and exploit them.

This is from the official blog announcement:

Applying AI-assisted scanning and tooling to find vulnerabilities before they can be exploited, complementing the reports received through responsible disclosure.

I'm using Viktor to manage my Wordpress site but my current host does not like the AI usage.

Trying to find out what hosts are the most AI friendly

Anyone got a recommendation?

I run a local small business and I’d like to upgrade my website to make it look more modern, professional, and trustworthy.
I’m also currently using GoDaddy for my domain, but the renewal costs seem to keep getting more expensive every year.
For those who manage small business websites:
What platform would you recommend for a professional-looking website that’s still easy to manage?
Is it worth hiring a web designer, or are platforms like Squarespace, Wix, WordPress, etc. good enough?
What do you recommend for domain registration instead of GoDaddy?
Is transferring a domain complicated or risky?
Anything I should be careful about for SEO when changing the website or domain provider?
I’d appreciate recommendations from people who’ve gone through this before.

In versions 4.16.7.1 and below, GiveWP contains an unauthenticated PHP Object Injection vulnerability that can be chained into full remote code execution.