We are spending more on
managing servers than on
the servers themselves.

What we run today

Three servers, named for months

Each is an AWS Lightsail 2XLarge — 8 vCPU, 32 GB memory, 640 GB SSD, 7 TB transfer, at $164 a month. All three run cPanel/WHM and Imunify360, with per-site backups to Backblaze B2. Clients pay $33 a month plus $110 a year for SSL.

Meter fill compares account count against November, the fullest server. Server cost combines the Lightsail instance, its cPanel licence and Imunify360.

Where the money goes

Labour is 54% of the cost of operations

Licensing gets all the attention because the invoices arrive on a schedule. But cPanel is the fourth-largest line in the business. The two labour lines together are nearly five times bigger.

Infrastructure $9,603 (46%) · Labour $11,125 (54%) · Total $20,728

Clients are invoiced annually, with bills going out between November and early January. Revenue is shown as a monthly average for comparison against costs, which are genuinely monthly. Labour lines use the midpoint of the ranges given.

What's actually wrong

Three cost problems, one root cause

Key-person risk

Our bus factor is one. Twice.

Every other problem in this report costs money. This one can stop the business. Splitting work between server management and security feels like redundancy, but each half still rests on one person — so the split shared the workload without sharing the risk. Imunify is the exception, and it shows what the rest should look like.

What actually reduces the exposure

• Two people in every pilot session. Not a handover afterwards — a second person present while the platform is being learned, doing the work rather than watching. Handover documents written after the fact are the ones nobody can follow.
• Templated Cloudflare rules replace tribal knowledge with a file. This is a second, larger reason to do the rule templating first. One versioned rule set pushed by API is readable by anyone; 88 hand-tuned zones are readable by John.
• Automated panel updates shrink the job. Both Enhance and Ploi handle server updates themselves, so the recurring upgrade cycle stops depending on one person remembering the sequence. It reduces the dependency rather than removing it.
• Write the SOPs during training, not after. Provisioning a server, restoring from Backblaze, onboarding a client, pushing a Cloudflare rule, responding to a storm. The person being trained writes the document as they are walked through the task — that way the gaps show up immediately, while the expert is still in the room. Procedures written afterwards by the person who already knew how are the ones nobody else can follow.
• Keep the SOPs in Google Docs and Strattum. Google Docs for drafting and comments during training, Strattum as the durable home the team actually works from. Two locations only helps if one is clearly the source of truth — worth deciding now which that is, and having a rule that a procedure is not finished until it lands there.
• A named outside fallback. Even with cross-training, two people is thin. Worth identifying a contractor or agency who could pick up the platform cold — which is far more realistic on a documented Enhance cluster than on three bespoke cPanel boxes.

Options

Four ways forward, priced

Each option is cumulative, and every row below folds September’s sites onto the remaining servers. Important ordering note: that consolidation is only safe after per-site limits are in place. Doing it first would put the heavy sites next to 35 unprotected neighbours — exactly the risk September exists to avoid.

What each option changes

• Consolidate to two servers. Move September's accounts onto the remaining boxes. October stays well inside cPanel Premier's 100-account tier, so licensing doesn't change, and we delete a $164 instance, a $53.99 licence and a $24.75 Imunify seat. The saving is real, but this is not risk-free on its own — the heavy sites lose the elbow room they currently have. It only works paired with limits.
• CloudLinux. $16 per server per month at the 2–4 server tier. Adds LVE resource ceilings per cPanel account, so a hammered site throttles itself instead of the server. Installs on top of what we already run — the conservative path if we want isolation without changing how the team works.
• Enhance. $0.15 per site per month with no per-server fee — about $13 a month for all 88 sites, replacing a $140 cPanel bill. Every site runs in its own container, so isolation is native rather than layered on. Its importer pulls cPanel accounts over SSH or the WHM API with databases, mail and DNS intact. Backups are included at no extra cost: incremental, deduplicated with hard links so only changed files copy, with frequency, retention, initial delay and minimum backup age all configurable — nightly is straightforward. They target a server in the cluster or any S3-compatible provider, so our Backblaze setup survives the move. Restores are granular: a whole site, a single file, a database or a mailbox, and clients can self-serve them from the UI.
• Deliberately not recommended: splitting into more servers. Holding every server under 30 accounts would drop them all from Premier to Pro licensing, saving $32 a month. But each server we keep costs $164 in compute and roughly $73 a month of Andy's upgrade time. Once labour is priced in, fewer larger servers beat more small ones — the opposite of what the licence tiers alone suggest.

Replacing Imunify

Imunify is $891 a year and, by our own experience, underperforms. A good part of why: its headline features — CMS core-file cleanup, vulnerability patching, the WordPress toolkit angle — are built around WordPress, Joomla and OpenCart. We run Contao. We are paying full price for a product whose best work does not apply to our stack.

Dropping it does not mean dropping protection. Two layers replace it, and between them they cover more than we have now:

• Enhance covers the structural half natively. It ships ModSecurity with pre-configured OWASP rules across Apache, Nginx and LiteSpeed, brute-force protection, optional 2FA for end users, and per-website caps on CPU, I/O, IOPS, processes, swap, inodes and memory. Critically, every site runs in its own container, which stops malware spreading between sites rather than merely detecting it after the fact.
• cPFence covers scanning and cleanup, and is built for Enhance. $0.10 per website per month with a $5 minimum — about $9 a month for our whole cluster, against $74 for Imunify. It runs on every Enhance role including email and database-only servers, adds real-time malware detection with automatic cleaning, DDoS protection and an abusive-IP blocklist. Only main domains count; staging and service domains are free, same as the Enhance licence.

The alternatives worth knowing about: cPGuard supports Enhance and cPanel both, so it is the option if we stay on cPanel; operators migrating from Imunify to it report finding genuine embedded backdoors that Imunify had missed for years, which matches our own sense that it is not catching much. BitNinja costs more and one operator who tested all three rated it highest, with per-website pricing available for Enhance hosts. Any of the three is a defensible pick; cPFence is the cheapest and the most tightly built for the platform.

Candidate review

What Enhance actually gives us

Everything below is what the platform ships as standard, gathered in one place so the team can pick it apart. Treat it as a starting position rather than a decision — if someone has used a panel that does this better, that is worth more than anything in this document.

Recommended sequence

Four moves, and the order matters

Ordered so that isolation is proven before we rely on it, and so that no step deepens our dependence on one person. The consolidation saving is tempting to take first, but it is the one move that depends on everything else working.

1. Now · targets $5,500/yr

   Template the Cloudflare rules

   Eighty-eight zones are currently tuned by hand. Build one standard rule set — rate limits on expensive paths, Contao-aware cache rules, AI crawler blocks — and push it to every zone through the Cloudflare API. Roughly 20 hours against the single largest labour line. It depends on nothing else and pays off whichever panel we end up on — and it converts John’s per-zone knowledge into a versioned file anyone can read, which is the cheapest key-person fix available to us. Write the SOP for pushing and rolling back a rule at the same time.

2. February onward · proves the thesis

   Pilot Enhance on one new server

   Stand up a fresh instance and migrate 10–15 lower-stakes Contao sites. Then deliberately load-test one of them to confirm the containers hold and the neighbours stay up. That test is the whole decision — if per-site limits genuinely contain a storm, every other saving follows. Run this with two people, not one, and write the SOPs as you go. Enhance expects more sysadmin depth than cPanel, so budget $1,000–1,500 of ramp-up — spend it on two people learning together, with the second person drafting each procedure in Google Docs while Andy walks it through. Anything that cannot be written down clearly is a gap worth finding now rather than during an outage.

3. Only after step 2 passes

   Move the heavy sites, then retire September

   Once limits are proven, September's resource-hungry sites can share a box safely and the instance comes out — $2,913 a year in compute, licence and Imunify seat. Doing this before the limits are proven would undo the exact protection September currently provides, so the order here is not negotiable. Note the two new sites landing on September before year end may make it simpler to place them on the pilot server from the start.

4. By October · locks in $9,100/yr

   Migrate the rest and retire cPanel

   Move the remaining sites, drop the cPanel licences, and move the SOP set from Google Docs into Strattum as the finished reference. Wrap up before the November invoices go out so the new platform gets a quiet quarter ahead of billing season. The exit test has two parts: the second person provisions a server and onboards a client working only from the SOPs with Andy out of the room, and we restore one real site from a Backblaze backup end to end. If that works, the migration is done and the key-person problem is genuinely fixed. If it does not, we have found the gap cheaply.

Open questions

What we should check before committing

• Does the replacement scanner actually catch more? We are dropping Imunify because it underperforms, so the pilot should test that claim rather than assume it. Run cPFence against a site with a known injected file and confirm both the detection and the automatic cleanup before trusting it across the fleet. Cheap to do, and it is the one decision here we would be taking partly on other operators’ word.
• Enhance’s S3 backup target is still marked beta. Its own cluster-to-cluster backup service is mature and can run alongside S3, so the sensible pilot posture is both: cluster backups as the working restore path, Backblaze as the off-site copy. Confirm during the pilot that a Backblaze-sourced restore actually completes, rather than assuming it. A backup nobody has restored from is not a backup.
• Which sites are the heavy ones, and how heavy? Before we size anything we should know what the resource-hungry sites actually consume at peak. That number sets the per-site ceilings and tells us whether two servers is genuinely enough once September folds in. It is now the last real unknown in the model.
• The SSL line is our most fragile revenue. $9,130 a year — 22% of the top line — for certificates that both cPanel AutoSSL and Enhance issue free through Let's Encrypt. Nothing to fix today, but it's a bigger number than the entire security labour budget, and it only survives as long as no client prices it independently.
• Annual billing hides the monthly burn. Roughly $42,000 arrives between November and January and has to cover twelve months of costs that leave every month. That is not a problem at current margins, but it means a mid-year cost increase has no revenue response until the next billing cycle — another argument for fixing the labour lines now rather than after they grow.
• AWS is not the cheapest floor. A Hetzner AX42 gives 8 dedicated cores and 64 GB for around €99 — roughly half our per-server compute cost. Hetzner has raised prices four times in 2026, so the gap is narrower than it was, but it's still real. Worth revisiting after the panel change is proven, not alongside it.