New Litespeed 403 Page

[JulesR]

When addressing an issue with a clients site, I noticed that Litespeed is now generating its own and new custom 403 page by default instead of displaying the previous white 403 error page. Checking the release notes it seems this was added in 4.2.8.

The new page is very large, grey and contains the following text:

403
Forbidden
If you wish to report this error page, please contact the website owner.

If you are the website owner: It is possible you have reached this page because the server has been misconfigured. If you were not expecting to see this page, please contact your hosting provider. If you do not know who your hosting provider is, you may be able to look it up by Googling "whois"and your domain name. This will tell you who your IP is registered to.

Note: Although this site is running LiteSpeed Web Server, it almost certainly has no other connection to LiteSpeed Technologies Inc. Please do not send email about this site or its contents to LiteSpeed Technologies Inc.

About LiteSpeed Web Server:
LiteSpeed Web Server is a high-performance Apache drop-in replacement. Web hosts use LiteSpeed Web Server to improve performance and stability and lower operating costs. If you would like to learn more about how LiteSpeed Web Server helps web hosts provide a better Internet experience, please visit here.

Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.

I have to say, I find the fact you've essentially hijacked the 403 pages on our servers to HEAVILY promote your product very distasteful and intrusive. Previously your product was mentioned in the error footer, and whilst a little annoying it was more than acceptable considering the advantages of Litespeed. What you are doing now, however, is too much - particularly when we are already paying significant licensing fees for your software on a regular basis. Now we have to pay for your software AND give you what essentially mounts to a full page advert on all of our servers?? Come on now, be reasonable.

Please remove this in future builds, or provide an option to completely disable this and revert back to the previous 403 page. Failing that, and a better option, please provide a means or detailed instructions we can follow to modify the default 403 page ourselves. Using ErrorDocument overrides comes with its own share of problems and is not a solution.

 

[Michael]

Howdy Jules,

Thanks for your input. We appreciate it.

There's a setting in the WebAdmin: Configuration > Server > General > Hide Error Page Signature. Set that to "Yes" and it will get rid of all the parts that talk about LiteSpeed. (This setting was requested by users and originates in 4.2.3, I believe.)

Our goals in changing the error page were twofold:

1. We wanted people to stop blindly clicking on the LiteSpeed link on the error page. We get far too much communication from people asking us why their website is down/not working correctly. We wanted to explain better the actions they should take. We also wanted to explain that, yes, LiteSpeed is associated with this site, and here's what LiteSpeed is if you're curious. We figured that was more helpful than just "powered by".

2. We wanted the error page to look, well, sleeker. If you've got feedback on the look and feel, we're happy to take it into account. We like the new error page, but we also sip the Kool Aid. We want to do something that works better for our customers.

Cheers,

m

 

[JulesR]

Michael,

Thanks for your response, despite my complaints I do appreciate you being responsive and vocal about this.

I found the setting you mentioned, however I think your defaults are extremely intrusive and in poor taste. The setting has now gone from controlling a small "Powered by" statement to a 3 paragraph wall of text promoting your product. Big difference, don't you think? Can you please tell me which error codes are affected by this new update so we can plan the necessary overrides?

I didn't realise people clicking the link was an issue for you guys, however wouldn't a simple fix be to disable the link and have text instead? "Powered by Litespeed" with no HREF involved? You could also perhaps have something on your contact page (a bit like you do now with the new error_page) informing users that you cannot help with website problems, and they should contact the hosting provider instead. There's not going to be a complete and definitive solution for this, but I think the more appropriate source to resolve this is your end and not in the software people are paying to use.

I'm sorry if this all sounds like I'm trying to complain for the sake of complaining, but I hope it's given you something to think about. I'm actually arguing for the sake of people who perhaps aren't familiar with administering their Litespeed installs and haven't noticed this going on. Remember how many people were unhappy with the "Powered by Litespeed" banner the software had for a long, long time? You guys did something about that but then go insane and make it 3 paragraphs worse for new users!

In regards to the design of the page, it's not actually that bad. Perhaps someone else could offer more design input (not my speciality I'm afraid). One thing I will say though is that the ability to customise the page from within Litespeed (much like cPanel's page template editor, or the ability to at least change it and provide a path to a new page) would be perfect though. I'm not a fan of having to set overrides in Apache's httpd.conf and distill them within cPanel.

 

[Michael]

Howdy,

You've definitely given us something to think about. We won't be changing this immediately, but we will be on the look out for people's opinions about the new error page. The last thing we want to do is upset our customers!

The new design should be on all error pages, but the bottom part explaining LiteSpeed is only on 403 and 404 pages.

Cheers,

Michael

 

[wanah]

What about allowing us to translate these pages to our customer's language ?

It would be nice if we had templates for these pages…

Thanks !

 

[stormy]

I am flabbergasted to find these new error pages. How come my web server choice is dictating what and how I communicate with my hosting customers?

I'm sorry, but I don't want you to provide texts nor design to the error pages that our company is serving to our users. Which are mostly Spanish, to boot.

If you have a problem with the link to Litespeed, then omit the link. The less information sent out about the underlying technology of a website, the better.

Please let me know how we can revert to the simple, plain error pages of the previous version. Since I can't revert to a previous version of Litespeed due to Heartbleed, my only choice at this point would be to abandon Litespeed and go back to Apache.

 

[stormy]

I know you meant no harm, but I feel the need to elaborate.

1. You should not add graphic design to the error pages.

Customers need to be in control of their site design. Not the webserver. If they want to design their error pages, they are free to do so. If they don't, the webserver needs to serve something as plain as possible.

2. You should not force changes to end users.

I don't want our hosting customers asking me why I redesigned their error pages.

3. Your choice of texts might be well intentioned, but it's not suitable for 100% of Litespeed users.

"If you wish to report this error page, please contact the website owner."
--> Why? You shouldn't decide this, the website owners should decide if they wish to tell customers to contact them.

"If you are the website owner: It is possible you have reached this page because the server has been misconfigured"
--> Now you are telling our customers that we don't know what we are doing and have misconfigured the server? Nice!

"If you were not expecting to see this page, please contact your hosting provider."
--> They were certainly not expecting it, and we certainly don't want them to open a ticket about it. Again, you can't decide these things for us!

"If you do not know who your hosting provider is, you may be able to look it up by Googling "whois"and your domain name"
--> This is borderline absurd. If customers don't know who their hosting provider is, are you expecting them to be able to understand what Whois is, how it works, and to find out the hosting company by reading the DNS server information? And why send them to Google?

"This will tell you who your IP is registered to."
--> No it won't.

AND after all that, then there's all the Litespeed advertising. This is a bad idea, poorly executed.

We won't be changing this immediately, but we will be on the look out for people's opinions about the new error page. The last thing we want to do is upset our customers!

Those two statements contradict each other. I hope you can provide an immediate patch.

Thanks for reading.

 

[Michael]

Howdy,

Perhaps we were too cavalier. Let's talk this out and then we'll figure out where to go from here.

So, first of all, thanks for the feedback!

It feels like you have two main complaints (and these complaints seem to be independent of Jules' complaints):

1. You do not want a stylized error page (and you especially don't want the style to change suddenly).

2. You don't want the error page to tell users what steps they might take to address it, because that's prone to misinterpretation, misuse, or general incompetence.

Is that right?

Michael

 

[stormy]

Hello Michael,

Thanks for the prompt reply! Your summary is absolutely correct.

As for possible fixes that can please everyone:

-An option to use the old (simple) or stylized error pages.
-And a template editor for the error pages, so those who want to use them, can customize them.

 

[Michael]

Thanks! We'll talk it over with the team. I think that a template editor may be farther into the hosting control panel realm than we ever want to get. (Correct me if I'm wrong, but don't you get that from cPanel already?) Having an option of two pages, though, might be doable.

Michael

 

[stormy]

About the template editor: I'm only talking about the texts, not the design. If you are going to add texts to the error pages, those texts are not going to work for everyone, so you could provide a way to override them.

 

[JulesR]

@stormy: Great job of (better) explaining why these pages were also an issue for us, and I'm sure many others! Thank you for that. At the time I couldn't articulate these points as well as you

@Michael "I think that a template editor may be farther into the hosting control panel realm than we ever want to get. (Correct me if I'm wrong, but don't you get that from cPanel already?)" You already provide a control panel via cPanel so I fail to see what would be any different or even much more work for you than adding a section to the same control panel to modify or edit these templates?

The cPanel editor provides very much the same functionality as what I was requesting - it lets us edit its own template pages such as the "Suspended" page (of which no such file is editable on the server, much like your software). It doesn't, however, let us modify error messages or error documents so isn't useful in this case.

Just to chime in further here, whilst I agree with Stormy's assessment on stylized error pages from a client point of view, I think the real key problem with this situation for me is the assumptions and forced upgrade which effectively gave us no choice in the matter. I appreciate and applaud the fact you're being vocal now and want to resolve these issues, but you rolled these changes out to a significant number of people without prior warning. This isn't just some functionality change within your software that only an administrator will notice, this is a change you made to effectively EVERY single website on the planet being hosted using Litespeed software and without their own custom ErrorDocument directives. Changes like this should never, ever be made without prior discussion, notification and agreement with your license holders. At that point you crossed the line from software provider, to actually changing or modifying the content of our clients sites, which is a big no no.

 

[Michael]

This isn't just some functionality change within your software that only an administrator will notice, this is a change you made to effectively EVERY single website on the planet being hosted using Litespeed software and without their own custom ErrorDocument directives. Changes like this should never, ever be made without prior discussion, notification and agreement with your license holders. At that point you crossed the line from software provider, to actually changing or modifying the content of our clients sites, which is a big no no.

I'm getting that. We're just so used to only administrators seeing our changes. We will certainly get more community input before making changes like this in the future.

We're talking over solutions to this and will try to have something for y'all soon. One idea we had (as a temporary solution) would be to change the content over to the old content (just the error and "Powered by..."), but perhaps add a little content to http://litespeedtech.com/error-page .

What would y'all think of that?

m

 

[stormy]

I appreciate that you are taking steps.

All I'm looking for is a plain, white, unstyled page with the error. I'm afraid I don't understand your comment about the page in http://litespeedtech.com/error-page

What I see there is a much styled and branded page, with a lot of text (for me).

 

[Michael]

I appreciate that you are taking steps.

All I'm looking for is a plain, white, unstyled page with the error. I'm afraid I don't understand your comment about the page in http://litespeedtech.com/error-page

What I see there is a much styled and branded page, with a lot of text (for me).

Ah. That page is where the links on the new error page redirect to. That would not be the page that your users would see when they get an error. That would be the page they would see if they clicked "Powered by..."

As always, of course you can remove the "Powered by..." part in the WebAdmin console: Configuration > Server > General > Hide Error Page Signature. If you removed the "Powered by...", your users would never see the page above. They would just get a grey "Error 403" page.

So, what I'm talking about is:

We change the error page to look basically like it looks now (dark grey, big font), but have only the old content ("Error 403. (optional) Powered by LiteSpeed Web Server."). That "Powered by LiteSpeed Web Server" link (should you chose to keep it) will direct you to http://litespeedtech.com/error-page

We are looking into the idea of adding a template editor, and will ask customers what they think. (You've got three proponents of it now. The more popular support you get, the higher it will move on our list of things to do.) What do you think of the things I've outlined above as a first step, though?

m

 

[bettinz]

This is the best idea (template editor). An example? I'm italian, and my hosting site have a style.
So I need to translate the content for my italian user (best if it's multi language, for example based on browser I can translate for it-en-de-es, and default is en.) Plus, I need to change the style. I like minimal pages: it's an error message, it's not a website; we need to inform about the error (but only the error), and the user need to see a page like 90% websites with apache.

 

[stormy]

Ok, I understand now, Michael.

What you propose is better than what we have right now, but I still don't agree that error pages should be styled at all by the webserver. It's also a waste of bandwidth. If the website operator wants to style and customize the error pages, they can do it easily.

I agree with bettinz above: it's an error message, not a website.

Any improvements are welcome, and I really appreciate that you guys are looking into this!

 

[Michael]

Duly noted.

OK. Give us a little time to talk about this internally. (Though anyone else interested in this should feel free to chime in! It helps us know what people want!)

 

[Michael]

Howdy,

The thinking right now (though I have asked on Twitter for more input) is that we'll do the new style and the old (very simple) content (like I described above) in the next version.

In the future, though, we will add an editor so that y'all can edit this default page. This is not coming out for the next version (it's not the top priority right now), but it is on our list of things to do and will be added in the future.

Thanks again for giving your input and we'll definitely be receptive if more people tell us they hate the styling. We'd like to continue to give it a try and hopefully get more opinions.

Cheers,

Michael

 

[stormy]

Hi Michael,

If you are going through all the trouble to give us an option, why not give us the option of the previous style (no style) error messages?

I don't really get what you are trying to accomplish by serving styled error pages. If you think the styled error pages somehow give Litespeed an edge, offer them as an option, even as a default option, but please don't force styled pages to your current customers. Also, bear in mind that most admins haven't seen the error pages firsthand.

Here's another frequent case: a newly created cPanel account will often have no content at all in public_html. If indexes are disabled (which I believe it's Litespeed's default), a new hosting customer is going to be greeted with a huge grey 404 error, instead of a discreet white page.