000webhost

» see 000webhost.com as it lived, on the wayback machine

~ the obit ~

In 2007 I was a computer engineering student in Turkey, which is about as close as you can get to the customer 000webhost was built for: students with a PHP project that had to run somewhere other than localhost, and no budget for it. Free hosting had existed for more than a decade, but the GeoCities generation of it served static pages under a banner. This one gave away PHP with a MySQL database and put no ads on your pages.

The company behind it was Hosting Media, founded in Kaunas, Lithuania in 2004. 000webhost came in 2007 and a paid cPanel brand called Hosting24 a year later, and the logic connecting them was plain enough: some share of the people who outgrow a free account will pay the same company for a bigger one. In 2011 Hosting Media renamed itself Hostinger. The free brand kept its own name, with the price written into it as three zeros.

Hostinger announced the end on 8 July 2024 and closed signups the same day. "After 17 years, 000webhost, a free web hosting brand powered by Hostinger, is shutting down its operations," the notice said, and the reason given was that the market had moved toward feature-rich hosting. Users could download their files or move to a paid Hostinger plan at a discount. On 14 October 2024 every site still on the service was taken offline.

~ the rap sheet ~

~ plain text ~

In October 2015 somebody sent the security researcher Troy Hunt a file of 13,545,468 records from 000webhost: names and email addresses, beside passwords stored exactly as the users had typed them. The breach itself dated from about March. Hunt spent six days trying to tell the company. The abuse form required an account and the Twitter account had three tweets. Support tickets at Hosting24 went to helpdesk staff he did not want to hand the details to.

What finally worked was a Forbes reporter, Thomas Fox-Brewster, asking for comment. 000webhost never acknowledged the breach to either of them. In the last days of October it reset every password and switched off FTP until 10 November. It also deleted comments about the incident from its Facebook page, then posted there that an exploit in an old PHP version had let the attacker in.

Storing passwords in plain text was already indefensible in 2015. A free host is where a lot of people made their first website, and everyone who had reused that password elsewhere had now handed it to whoever bought the file.

~ what free cost ~

A host that asks for no payment details is also the cheapest place to put a phishing page. In 2015 Netcraft reported that 90 percent of the Steam phishing sites it had taken down were on Hostinger's network: 1,400 URLs across 331 sites in a single month. In 2023 the Cybercrime Information Center still had Hostinger among the five biggest phishing hosts by its scoring. By April 2026 it had dropped out of the top 20.

~ ninety-eight days ~

That was the notice period, 8 July to 14 October 2024, for a service that had run for seventeen years. It was enough time to download a backup. For a site parked on a free host in 2009 and forgotten, there was nobody left to read the email. Today 000webhost.com forwards to a Hostinger landing page made for its former users.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »