Outsource or Insource?
Website hosting services are a utility, offered in standardised packages that flex around user-configurable items such as processor numbers, operating system choices, storage and back up options.
Nevertheless, some colleges and universities opt to self-host the majority of their websites, while others actively outsource.
Web hosting decisions are specific to each institution’s particular set of circumstances. However, our research suggests that many universities and colleges do not have institution-wide information to evaluate the appropriate approach or to advise others on the correct course of action.
Complex Digital Ecosystems
A mix of decentralised content creation and management has given many higher education institutions complex digital ecosystems, comprising tens of thousands of web pages and hundreds of microsites and social media presences.
These ecosystems can be thought of as having three layers. An upper content presentation layer, a middle digital content creation and management layer and a lower infrastructure layer of servers, content distribution networks and data stores.
As civil engineering tells us, a structure is only as strong as its foundation, so in this post we report the results of examining the foundation layer for 4,800-odd higher education websites.
And, when publicly available data is combined with deep website and web estate scan results we can obtain critical insights to manage and de-risk complex digital ecosystems.
In this exercise, rather than scan a single institution’s web estate to geo-verify each web server, we scanned the main domain for 4,833 university and college websites in Australia, Canada, Ireland, New Zealand, the United Kingdom and the United States. Our objective was to identify whether a site was self- or externally-hosted and in the case of the latter, which hosting provider was being used.
As the table indicates 44% of US colleges and universities use external web hosting for their main website, whereas about 1 in 5 institutions do so in the other countries we examined.
We note that the UK has a unique arrange whereby a central service provider (JISC) provides connectivity and other digital services to the UK’s higher education sector. However, for this study we focused on commercial hosting suppliers, available to all institutions.
|Hosting Provider||Total No. of Sites||
|Estimated Market Share|
|No. of Institutions||4,833||40||173||169||22||8||4,421|
In reviewing the scan results we noted that a number of externally-hosted websites were located on shared servers. This type of arrangement results in the same server having multiple identities and thus complicates implementing secure HTTPS connections. Institutions using this arrangement should switch to dedicated server hosting and implement low-cost or free certificate services, such as, Let’s Encrypt
It is hard to identify specific strategic advantages to self-hosting, but web hosting services do not exist in isolation and, on many campuses, it may be prudent to bundle hosting packages for ‘internal’ clients or deploy otherwise unused server capacity.
When individual academic units and other entities develop websites using external agencies a range of different hosting arrangements can come into effect.
Our research shows that dozens of different underlying hosting suppliers may be servicing a single institution. Potentially doing so without any oversight of security standards, up-time requirements or wider technical concerns.
And, data privacy may not be being respected. For example, we discovered that 20% of Canadian institutions are hosted on servers that resolve to addresses in the US: this may be fine, but if you don’t check you won’t know.
Moreover, as many hosting vendors white-label their solutions through agencies, an audit may identify opportunities to obtain better value for money or consolidate hosting with a smaller set of suppliers at preferred rates.
While there may be strong economic, technical and security cases for hosting an institution’s main website in-house, the rationale may be much weaker for sub-sites. But only a comprehensive audit will provide the information needed for an evidence-based website hosting policy.