Last Friday, a new and extremely serious vulnerability in WordPress was announced. To summarise, WordPress installs from 6.9 onwards (roughly December 2025) can be compromised remotely, allowing attackers to gain full access to the hosting account that it is running on.

We ensured that all Managed WordPress sites were upgraded promptly, as we do with all vulnerability announcements affecting WordPress and its plugins. As it happens, many of our managed sites were not vulnerable due to some custom hardening rules that we apply by default to managed installations.

We also have a large number of customers running unmanaged WordPress installations on our hosting accounts. Maintaining the security of these installations is the customers’ responsibility and we generally try to avoid interfering with customer sites. In this case, the severity of the vulnerability, and the speed with which we saw exploitation attempts, meant that we felt compelled to take action.

Many users don’t take security too seriously, assuming that their site isn’t important enough to be a target. The reality is that all sites are a target, as compromised hosting accounts can be used to send spam email, or host malicious files for other attacks, and cleaning up after an attack is a lot of work for everyone.

The exploit can be prevented by a simple and non-invasive addition to a site’s .htaccess file that blocks requests to certain URLs. Therefore, we took the step of scanning our hosting servers for WordPress installations that hadn’t been updated (most sites will update themselves automatically) and added the necessary rules, along with a comment explaining why it was done.

Of course, if you don’t want to spend your Friday evenings worrying about critical security updates, our Managed WordPress is still welcoming new customers.

We’re silver sponsors for this year’s Electromagentic Field. Held 16th–18th July in Eastnor Castle Deer Park, it’s a magical camping festival full of weird and wonderful things. We went in 2024 and saw a huge variety of amazing things including a very big Tesla Coil.

This year, in addition to our direct sponsorship of the festival, we’re providing various internet resources to help keep things running. We’re an upstream provider for the network and are already seeing traffic flowing. We also provide some offsite backup space.

Some of our staff are going to be at EMFCamp too and have some things to show. We think there’s something space-themed being created by @bencc@morehammer.uk, and GCHQ will be back with their interactive treasure hunt. We asked our staff for more clues about GCHQ.NET, but they all denied all knowledge about it. In fairness, that’s exactly what we’d expect the organisers to say.

One project we’re helping out is the copper telephone network. To interoperate with the world, we’ve donated a Virtual Private Server to run the SIP gateway to allow inbound and outbound calls. We hear rumours that it might be possible to get VDSL over copper phone if for some reason gigabit Ethernet in the middle of a field wasn’t good enough.

Expect posts of cool things we find on the Fediverse at @social.mythic-beasts.com/@beasts over the next few days.

We’re pleased to announce that we now support WebAuthn/FIDO2 security keys as an option for two factor authentication (2FA). Customers have quite reasonably been requesting this feature for some time, but as we’re sure you’ll understand, this type of development work needs to be tackled carefully.

Security keys are physical devices – typically a small USB key – that can securely store digital credentials. When logging into a site, rather than typing a code from an app or sent to your phone via SMS, your browser will talk directly to your key, usually requiring you to tap a button to approve the authentication. Some systems also provide a compatible software token store, such as Apple Keychain (or Windows Hello, but we’ve not tested that).

Aside from being more convenient than typing a code, security keys are far more phishing-resistant than other methods. Convincing forgeries may trick humans into typing 2FA codes into fake sites, but WebAuthn ensures that credentials from a security key are only provided to the site for which they are intended to be used.

To set up security keys on your account, please visit the “Two-factor authentication” page in the control panel.

Use of security keys is entirely optional, and we will continue to support our existing 2FA methods. If you do want to use a hardware security key, you’ll need to purchase one if you’ve not got one already. Most of our staff are using Yubikeys, but any FIDO2 device should work.

We strongly recommend that you have at least two working 2FA methods, and make sure that they’re not tied to the same device; having SMS and TOTP on the same phone won’t help if you lose your phone.

We take account security seriously, and if you lose your access to your 2FA device, we will not reset your access by email alone as this would completely undermine the additional security provided by 2FA. (You can reset your password by email, so this would make email a single factor.)

We also know that many of our customers don’t trust SMS-based 2FA, so if you have chosen not to enable SMS-based 2FA, we won’t reset your 2FA that way either. Getting access to your account after losing all your 2FA methods is slow and tedious. This is a feature, not a bug.

We strongly recommend printing some recovery codes and filing them somewhere safe as a fallback method.

We are committed to providing support delivered by real humans. We know how frustrating it can be to have to fight your way past chatbots and virtual assistants that can’t help you in order to get to a human that can.

In fact, when you contact us, your message will be dealt with not only by a human, but by one of our technical staff who, on other days of the week, will be managing our routers, running our DNS servers, developing our control panel and maintaining all our other infrastructure.

LLMs break processes designed for humans

Modern Large Language Models (LLMs) are very impressive, and we know that many people find them useful in spite of their inherent and well-documented unreliability. One of the downsides of LLMs is their ability to produce large quantities of text that can overwhelm processes that are built to deal with human input. This is being seen in many places, from bug bounty programmes being DoSed by LLM-generated submissions, to schools unable to cope with a huge increase in the volume and size of complaints from parents.

We’ve now started to see this in our support queries. Fortunately, the volume is not yet problematic, but we have had cases where we’ve spent a disproportionate amount of time dealing with LLM-assisted ticket submissions. This includes time spent trying to decipher what the question actually is thanks to LLM-induced obfuscation, and also time spent answering tickets that are just much longer than they would have been had they been written by a human.

Dealing with LLM-generated support queries

Our target is to respond to all support queries within one working day. Providing a 100% human support response on this basis simply doesn’t work if support requests are being generated automatically. Therefore, we have amended this target to exclude queries that we believe have been generated by an LLM; if you submit a support request which we believe has been made harder or more time consuming to answer by the use of an LLM, we may reject it and ask you to resubmit a human-authored request instead.

If you want to use an LLM to help solve your query yourself that’s great. But if that’s unsuccessful, please don’t send us your LLM output as a support query; send us your input – your prompt – instead.

We’ve recently updated the look and feel of our homepage. All the work has been done in-house by our own staff, and we’re hopeful that other organisations might steal some of our unusual ideas:

• No pop-ups; any feature requiring a cookie banner will not be permitted, and you definitely won’t be pestered to join a mailing list.
• The website should clearly state what services we offer and how much they cost.
• The website should be fully accessible.
• No third party dependencies – everything is served from a mythic-beasts.com domain on servers we own and operate.
• Minimal number of HTTP requests and small pages so our front page is faster than the home page of high performance content delivery networks.^*
• No existing feature should stop working as a result of the redesign.
• Works perfectly for an IPv6-only user.

In updating our homepage, we’ve tried to better describe what it is that makes us different and in order to backup our claims of “fair, no-nonsense pricing” we’ve now documented our pricing policy in unnecessary detail.

We are always adding features to our website and control panel, and over the last year we’ve had a particular focus on improving accessibility. We now have an internal instance of Pa11y which automatically checks our pages for accessibility issues. Pa11y caught an accessibility regression in our rollout which we’ve now resolved. If you do encounter accessibility issues on our site, please do report them.

We’re also in the process of updating our website to consistently show prices inclusive of UK VAT, and have now done so on our homepage. For historical reasons, we’re not consistent on this, although we do always state which one it is. VAT treatment is always tricky, as many of our customers are not in the UK and thus may pay a different rate of VAT, or no VAT at all, and we also have many VAT-registered customers who prefer ex-VAT prices. Showing VAT-inclusive prices can make us look more expensive compared to our competitors – always check that you’re comparing like with like.

* We measured our homepage at about 300ms, compared to 2-5s for popular content delivery network homepages we compared with.

We’ve been to Robocon again this year, renewing our sponsorship of the Dam Designs team (formerly Little Devils) and their redesigned autonomous self-driving robot. The team is now a mixture of primary and secondary school students and with several years’ experience behind them, they took on 16 teams in this year’s more difficult arena.

Each robot is allocated a quarter of the arena, and the goal is to get as many points as possible by collecting cubes and dropping them in their own quarter of the arena. Bonus points are available for dropping cubes in the smaller “home area” within the quarter, or stacking cubes on top of other cubes. Four green cubes start in the central neutral zone and part way through the competition, higher scoring red cubes start to drop one by one. For full details see the competition website.

Is it a bug or a feature?

In the quarter final, the team pushed a code update to prefer picking up the higher scoring red cubes. Unfortunately it didn’t quite go to plan, and by mistake they coded their robot to ignore the lower scoring green cubes entirely. This resulted in a heart stopping moment at the start of the competition where the robot drove to have a view of the neutral zone and then stubbornly sat still while all the competitors cleaned out all the low scoring cubes. As soon as the high value red cubes were dropped the robot rushed in to collect them and take them home, neatly winning the round.

Whilst this wasn’t the intended behaviour of the code, it turned out to be a very good strategy for winning the round. A debate within the team followed: patch the code to try and get extra points from a green cube, or eat sweets and re-enter the winning robot for the semi final unchanged? The engineering conclusion was WONTFIX and the robot won the semi-final too.

Robot collecting a red cube and returning to base and stacking on a green cube for double bonus points

Third place

In the final the team got unlucky; the robot spun the wrong way and spent a very long time staring at the wall instead of looking for a cube in the neutral zone. Whilst the robot very slowly turned itself around, the competing robots picked up the green cubes and collected some points. In the final seconds our team’s robot spotted a red cube and rushed towards it but was powered down by the end of the round before it was able to fetch it.

We’ve posted previously about our refreshingly boring approach to domain pricing – we take the price that our supplier charges us, add a little bit more than it costs us to provide the service and sell them on.

We’re pleased to say that we’ve recently crossed the top volume threshold with our biggest domain supplier, meaning that the price that we’re charged for many domains has gone down. So, we’ve run the script, regenerated our price list and have reduced our prices for the vast majority of Generic TLDs (gTLDs) and non-UK Country Code TLDs (ccTLDs). For example, .com domains have dropped in price from £14.50+VAT for one year registration/renewal/transfer to £13.50+VAT.

We’re proud to provide a sustainable, no-nonsense approach to pricing. We don’t mess around with loss-leading first year pricing that needs to be clawed back through inflated renewal pricing or a hard sell on add-on services that you don’t really need.

The new prices apply to renewals and transfers as well as new registrations, and to new and existing customers alike. Our new prices can be viewed at mythic-beasts.com/domains.

We’re delighted to announce that we’ve renewed our silver sponsorship for Electromagnetic Field 2026. We’re also providing EMF with internet transit and backup services in our virtual server cloud.

EMF is a long weekend camping in a field which is filled with approximately everything. Last time we saw huge tesla coils, a paper rocket factory, and active satellite tracking amongst many other things. The various attendees have had two years to build on the learnings of Astrophysics for Supervillains so we are nervously looking forward to the results.

The field comes with everything the modern camper needs: not just power and internet but space to pitch your tent, a 2G GSM phone network and a full copper phone system. You can bring and use your own fax machine or classic Nokia GSM phone.

Lots of our staff members are looking forward to a fun weekend.

Constant pestering to review every online transaction is rapidly overtaking cookie banners as the most annoying feature of the modern internet.

We’re committed to making the internet less annoying. We don’t have a cookie banner on our website – we don’t need one because we don’t track you – and we also won’t hassle you to review us every time you interact with us.

But review sites exist, and we know that many people do look at them, so we’re very grateful to the customers that have left us some truly wonderful reviews on TrustPilot and elsewhere.

Unfortunately, the flipside of not constantly nagging our customers to review us is that the volume of reviews that we receive is relatively low, and a small number of negative reviews can have a big impact on our overall score.

After a five-year run of nothing but 5* reviews on TrustPilot, we recently received a couple of suspiciously similar 1* reviews within the space of a week. The reviews are light on details, and the reviewers have not responded to our request via TrustPilot for more context for the reviews.

Various aspects of the reviews make us believe that these reviews are not from people who have had any genuine experience of Mythic Beasts but have in fact been commissioned by a disgruntled third party. You can see the details, and our response, on our TrustPilot page. You can also see the significant impact that it has on our overall score, which is amplified by the weighting that TrustPilot give to more recent reviews.

We have flagged the reviews and provided TrustPilot with details of why we believe that these reviews cannot be genuine, and why we believe that they are “incentivised”, both of which are against TrustPilot’s Ts&Cs, but despite the reviewers’ refusal to provide any details to validate their reviews, TrustPilot have thus far elected to let the reviews stand and have only provided us with automated or templated responses.

Equinix AM5 is strangely absent from most “what to do on a night out in Amsterdam” guides, but this was the destination for three of our team who went on a company-funded all-nighter back in October.

We acquired our Amsterdam presence in 2017 as part of our acquisition of BHost. We integrated it into our core network and migrated all customers onto our own virtual server platform.

Since then, we’ve refreshed much of our London data centre space with our data centre expansions to Telehouse and City Lifeline including moving to fully-routed networking.

Our Amsterdam site was next in line for an upgrade, but it’s location presented some logistical challenges. Firstly, it’s a bit tricky for us to get to. Secondly, the Amsterdam data centre freeze meant that we couldn’t follow our preferred approach of deploying new kit in an adjacent empty rack, migrating, and then decommissioning the old space. The upgrade had to be done in-place, which is unavoidably more disruptive.

In order to minimise the impact of this, we ended up doing the vast majority of the work in a single, overnight session.

The end result is a very substantial upgrade to our Amsterdam site. As well as the deployment of our new networking platform, the virtual server hosts have been replaced with faster, more power efficient models. Existing customers have been live-migrated onto the new servers which feature all NVMe storage for much faster IO. In the new year, we have further capacity due to be installed and we will fully decommission the previous generation of servers. Whilst using low carbon energy to power servers is good, not using energy is even better.

This upgrade was months in the planning, including co-ordinating shipment of the new servers from a local supplier, and working closely with Equinix staff to perform the PDU swap. An earlier preparatory trip to (amongst other things) identify the best local pizza suppliers was also essential. We’re very grateful to the staff that put in some very long hours to make it go so smoothly.