Here's a great tip on how to run a hosting provider, courtesy of my new provider, Mediatemple. They wanted to tighten up PHP security a bit, specifically the scope of PHP's internal fopen() command, and the change would conceivably affect anything that called fopen(), including several other PHP commands. So they did the following. . .


1. They emailed me with details of the change and the exact date and time that the change would be happening (two weeks hence).

2. They gave me instructions on how to tweak my php.ini file, thus making the change happen earlier so that I look for breaks on my site.

3. They added a knowledge-base article giving me a couple of alternative methods for replacing any insecure commands.

4. They gave me instructions on how to tweak my php.ini file after the change that would re-enable the insecure commands, just in case I wasn't paying attention to items 1-3 or I wasn't able to make the change in time. Although they state that this change will only be available for a limited time, presumably until they're sure that everybody's up and running again.


So I gave it a try. I shut off the insecure commands. And something did break, but it was pretty minor. Specifically, the google-scraper on thecodezone.com's front page news-pod broke. I then went to the knowledge-base to look at alternatives, and with about six lines of new code the news-pod was working again.

And that means that Mediatemple's PHP security change will now go through without anything breaking on my site.

Gotta tell you, there's little more frustrating than coming to work to find your site broken, and when you get to the bottom of it, you discover that your provider made a couple of changes that you could've handled earlier if you'd only known.

So remember those four steps. Please.