[12:30] Having spent more time on planning I now consider that migrating all the sites hosted by Servology while under time pressure is not a good approach. There are likely to be a lot of special cases and idiosyncrasies with individual sites which will make the process very long and error-prone. I now think a better approach will be to use an external WAF (web application firewall) to protect the servers for the time being, then migrate sites to up-to-date hosting as time allows. The migrations can then be done slowly and carefully, sorting out problems as they arise rather than rushing it and potentially breaking things.
I therefore plan to first block the current web servers from direct web access from the internet, allowing me to bring them back online without exposing the sites to attack from the public internet. I would then add exceptions to the block to allow the external WAF (only) to connect to the servers, and update each site’s DNS to point to the WAF’s public IP addresses. This should bring the sites back online in a reasonable amount of time.
I will update again when there is more progress. Thank you for your patience.
[16:30] It looks like I will be using a hybrid approach. Some sites may be best migrated, others may be best placed behind a WAF. I am now combing through customer lists and compiling a list of sites that are needed (the servers contain a large number of legacy sites which are not being paid for and are probably no longer wanted — it’s been an ongoing project to go through them a few at a time and determine whether they can simply be turned off.) I am making lists of sites along with the customer, who hosts DNS, who controls the domain registration, what software the site runs, and which version of PHP is in use. This should also bring to light any sites which do not in fact use PHP, which I should hopefully be able to turn on again soon.
Once that’s done I plan to bring up the web servers again, blocked from internet access, so that I can continue checking site requirements.