How I Need Website Hosts 500 Client Sites With Three People on CloudLinux and Imunify360

I Need Website is a three-person SEO and web design agency on Queensland's Sunshine Coast that has hosted clients' sites on its own servers for more than a decade.

When hacked sites started slowing entire servers, Alex Merenkov, the agency's director, moved the fleet to CloudLinux and then to Imunify360.

Today, about 500 client sites run on five cloud servers: per-account isolation keeps one site's trouble from touching the others, and Imunify360 cleans up what arrives. That includes more than 18,000 infected files on one server's first Imunify360 scan and 4.2 million bot challenges in a month.

The entire server maintenance takes Alex under an hour a day, and the protection has become the agency's referral engine.

The cost of hosting it all yourself

I Need Website has been building sites in Sydney, Melbourne and the Sunshine Coast since 2013, and it provides SEO, web design, custom applications and virtual tours to small and medium-sized businesses. Hosting has never been the main product, but the agency has run its clients' sites on its servers from the start, because development and SEO need control of the server.

"Without quality hosting, nothing is possible," Alex says.

But for years, a single hacked site could slow everything else on the server. "Sometimes we had performance issues," Alex says. "For example, a website getting hacked and then starting to use lots of resources, and it affects the whole server."

The agency had serious incidents in those years, and the stakes went beyond uptime. About half the sites it hosts were built by someone else, and some arrive carrying malware.

For an SEO agency, an infection is a ranking problem as much as a security one.

"If you do SEO and your website has malware, the whole website can be blocked. Google just blocks you from search results, and your rankings are lost."

A managed WordPress host was never the answer. In Alex's experience, it means somebody else's restrictions, support queues and update schedule, and the latest PHP version only.

"Sometimes a client comes with a very old website which they don't want to rebuild straight away. They just need to host it."

A cPanel suggestion became the hosting stack

CloudLinux came up as a suggestion in cPanel during a server migration. Its resource limits cap the CPU, memory, and processes of each hosting account, so an account that spikes slows only itself, while the server could carry more sites safely.

Imunify360 followed after a trial.

"Imunify notifies you straight away that there is something wrong, and it blocks it straight away," Alex says. "It actually blocks it from spreading."

One client had tried outsourcing security instead to an offshore development team on a retainer, who were supposed to cover security, but the sites kept getting hacked. "It's not very expensive, but still it was very hard to convince them. They had a team on a retainer for security, but still incidents kept happening."

When that server came onto Imunify360, the first scan neutralized about 14,700 infected files in place, cleaning the malicious code and leaving the files functional and safe.

Imunify360 also removed 3,600 more in a single day, most of them hijacked .htaccess files and PHP dropper scripts sitting in a handful of cPanel accounts. Since then, it has logged a few detections a day.

What changed

The move to CloudLinux and Imunify360 changed the agency's day-to-day in several concrete ways.

Hosting runs on autopilot

Three people look after about 500 client sites on five AWS servers, and Alex's own server work takes under an hour a day, from the command line first and cPanel second; plugin updates are a monthly round.

The products, he says, "allow us to focus on core activities such as web design and SEO while hosting is being taken care of. Sometimes we need to run updates, but mostly our hosting is on autopilot."

For the fleet as a whole: "We haven't had any serious incidents since we switched to CloudLinux and Imunify."

Automated cleanup replaced emergency cleanups

During a malware outbreak event, one server detected more than 900 malicious files across 15 accounts. Imunify360 cleaned them up without anyone at the agency stepping in.

The servers cleaned about 19,600 malware files that year. Nearly all of it came from two events: the initial outbreak and the holdout client's first scan.

Bots and exploits stop before the site

WebShield is the Imunify360 layer in front of the web server that puts suspicious visitors through a JavaScript check.

In one recent month, it served 4.2 million challenge pages, and visitors passed about 11,500 of them, 0.3%.

The rest never got past the check, which is what automated traffic looks like. Penetration tests ordered by clients end the same way.

"I've done a couple, and because we have a web application firewall, it usually passes. Even friendly hackers who try to hack us can't do much."

Plugin updates run on the agency's schedule

Imunify360's WAF for WordPress blocks known exploits against vulnerable plugins, themes, and the core in the meantime. This way, most plugin vulnerabilities get patched on a schedule rather than in an ad hoc emergency.

"Sometimes some plugin becomes vulnerable, and you have to prioritize and suddenly update 300 websites. I would hate that to happen. I know there's a vulnerability, I have to update this plugin, but I can do it at my pace."

More sites per server, any PHP version

Per-account isolation lets the agency host more clients on those five servers. CloudLinux's PHP Selector gives each account the PHP version its site needs, so a legacy site stays up next to a new build.

"With CloudLinux I can configure any version of PHP just for this account individually. I don't have that with another hosting provider."

The limits also set the hosting price: after a free first year with a build, clients pay for the disk space, load, and memory their site needs, which Alex sets per account. And they are his alarm.

"If one specific account is starting to consume lots of CPU and memory, there must be something wrong with it. Then I look at the Imunify statistics, and I can see it's being smashed with viruses."

The protection brings in clients

"I'm getting referrals from other IT companies, because not many IT companies do hosting in-house. They ask us to clean up the virus, clean up the website."

Every hosted client stays on an ongoing arrangement, from hosting and backups up to continuous development and SEO. For the SEO clients, a clean site is what keeps the rankings.

The open question for the near future is attackers with AI:

"Hackers are starting to use AI to find creative ways to breach services."

Two answers are already in Imunify360. AI Bot Management throttles the AI crawlers that overload WordPress sites rather than blocking them, so client sites still show up in AI search. Then, the firewall blocks requests for the credential files that AI coding tools leave on servers.

Alex's advice to another agency owner running its own servers is to pay for confidence.

"Obviously it's a commercial product. But if you want to have confidence in your software, you need to upgrade. Most web servers run some kind of free Linux. This is next level. You have a team that you can ask for help, and there is a team that looks after it."