← All posts

The Layers of Web Hosting

The goal of web hosting should be to put as many layers as possible between you and the server.

That sounds backwards. More layers usually means more vendors, more complexity and more places for things to break. But every layer is someone, or now something, whose job is to deal with the server so you don’t have to.

I started with nothing between me and the server.

When I first got started with web hosting, I was on a Media Temple Grid account. You paid about 20 bucks a month and could create up to 100 sites. It felt like a steal.

As most people know, if you actually try to fill one of those up, you outgrow it fast.

So I upgraded to a Media Temple dedicated server. That was a big step up in power. It was also a big step up in responsibility. With your own server, you manage everything. Operating system updates. Security patches. Mail. The 3 AM outage. All of it.

It turned out to be a really bad experience. Nothing stood between me and the server. When something broke, I was the one who had to fix it, whether or not I knew how.

Managed hosting added layers I didn’t have to hire.

Managed WordPress hosting changed that. Companies like Kinsta, WP Engine and Rocket.net sit between you and the hardware. They run on top of a cloud provider, and the cloud provider runs the actual server.

That’s two layers between you and the server, and each one has people whose job is to keep it running. Anchor Hosting has been built on that model for years. My customers talk to me, I work with Kinsta and Rocket.net, and their engineers keep the servers healthy.

Three hosting models side by side. Unmanaged: you connect straight to the server and you are on call 24/7. Managed: you, then a managed host whose sysadmins are on call, then a cloud provider, then the server. AI-operated: you as architect and reviewer, then AI support, AI platform and an AI sysadmin on call 24/7/365, then a self-healing server.
The more layers between you and the server, the less of the 3 AM work lands on you. The newest layers don’t have to be people.

The sysadmin layer was always the expensive one.

Look at who carries the pager in each of those models. Somebody has to be awake when a server falls over. That layer needs coverage 24 hours a day, 365 days a year.

To get that coverage, a hosting company needed a certain critical size. Enough engineers spread across enough time zones that someone is always on shift. You couldn’t start a real hosting company with one or two people. You needed a whole bunch of sysadmins on standby before you could even begin.

That’s a big part of why managed hosting exists as a business. Most of us were never going to staff that layer ourselves.

I think that’s all changing now.

The new reality is that one person can add layers between themselves and the server by putting different AI agents on different jobs.

Layering AI agents
SYSADMIN
Handles the server
Steps in when a server has a problem, proactively or reactively. This is the layer that needs coverage around the clock, and an agent doesn’t sleep.
WATCH
Hunts for problems
Proactively looks for vulnerabilities, issues and anything that needs to be patched or fixed, before it turns into an outage.
PLATFORM
Makes the platform better
Comes up with ideas and features for the hosting platform, then hands them off to development.
SUPPORT
Talks to customers
Answers questions and does the digging. People still want to talk to people, so a human stays close to this one.

What does web hosting look like if built from scratch in 2026?

That’s something I keep pondering. If you take web hosting down to the basics and assume AI is available at every layer, what do you actually need?

So I’ve been experimenting with exactly that. I’m building a self-run hosting tier inside CaptainCore, the platform behind Anchor Hosting, on a single bare metal server. A container per site, page caching, backups, sign-in protection. Claude Code does most of the building. I describe what I want, it builds it, tests it and reports back.

Here’s part of a report from one of those sessions.

Claude Code Session
Austin
Add sign-in protection for every site on the server, and turn off PHP shell commands for web requests.
Claude
Sign-in protection. 10 failed WordPress sign-ins in 5 minutes blocks the address for an hour, doubling up to a day for repeat offenders. XML-RPC has its own limit (60 calls in 5 minutes), with Jetpack’s servers exempt. A blocked address sees a “Too many sign-in attempts” page on the sign-in screen and XML-RPC of every site on the server. It can still browse, so a customer who mistyped a password doesn’t see a dead site. I tested it by failing 11 sign-ins from this machine. Sign-in was blocked on that site and on a second site, pages kept loading, and Unblock restored it.

PHP shell commands. exec, shell_exec, system, passthru, proc_open and popen are now off for web requests by default, with a switch under Hosting → PHP for a site that needs them. WP-CLI and WP-Cron keep them, and WordPress mail still sends with them off.
Claude
A regression I caused and fixed. While testing that, mail from web requests failed on two test sites. The cause was my PHP switching work: the original 8.4 image was built before mail support existed, and an earlier session had added the mail program to containers by hand. Rebuilding two sites onto that stale image dropped it.

Fixed: the 8.4 image is rebuilt and all three test sites are on it.
Guarded: an image build now fails if anything a site needs is missing.
Visible: applying settings prints a warning when a container has no mail program, instead of skipping silently.

Building my own hosting platform from scratch is now doable. I don’t think most people should attempt to do that. There are a ton of fine-tuning settings in a report like that one. How many failed sign-ins before a block. Which PHP functions to turn off. What a blocked visitor should see. I feel I it still takes some domain knowledge to direct the AI otherwise auto acceptance will let to a platform with large gaps. Most people wouldn’t want to, and that’s fine. That’s what the layers are for and why Anchor Hosting exists.

Do we still need humans juggling every ball?

Why do we need all of the complexity of web hosting? The goal is to create the most reliable platform possible. Until now, doing that meant human beings juggling all the balls in the air.

Is that required anymore? Do we need a human at every point in the platform to make it more reliable and more secure? I think that’s up for question.

Humans should be the architects. Humans should review. And humans should still be talking to humans, which touches support.

Beyond that, I think we’re at the point where AI can operate the entire hosting stack, more reliably and with more fallbacks.

Self-healing was always the goal.

Every hosting platform worth building has chased the same idea. Make it heal itself. Restart the crashed service. Fail over. Roll back the bad change.

Before, that meant scripts and runbooks. They could only handle the problems someone saw coming.

Now the healing can be intelligent. When something goes wrong, an AI agent can look at what actually happened, make a decision, and bring things back online without any human intervention.

The goal hasn’t changed. The more layers between you and the server, the better.

Austin Ginder
Subscribe