There's no best server configuration as each Magento installation is different as they will have different extensions, themes, number of products and visitors.    The beauty of the Cloud though is you should be able to easily scale up if and when you require it.    You definitely need to place emphasis on both CPU and RAM. As for Storage, it will be nice to have fast storage like SSD but depending on your budget and space requirement, you may need to compromise on this part.    Besides the server hardware, another important thing that is often overlooked is the software - optimizations and security. Do you have a system administrator or are you good at managing a server? Otherwise you may need to hire a good system administrator to tune the software properly as well as securing and constantly monitoring the server.  ... View more

@Ericclay: You may want to start a new topic about your problem as this topic is more of a Public Service Announcement (PSA).  ... View more

Yes it does! Thanks for pointing it out.    Here's how I understand this:-   1. If you do not have a SSL Certificate, IPN will work as usual.   2. If you have a SSL Certificate with SHA-1, IPN will stop working.   3. If you have a SSL Certificate with SHA-256 (aka SHA-2), IPN will work as usual.       I can understand why PayPal is enforcing this though because having a SSL Certificate with SHA-1 may give users a false sense of security. This is not a "problem" with those without a SSL Certificate because users won't feel secure at all.  ... View more

Is this a new Magento store or has it been running for some time?    To quote what I have stated in another topic:-   1. Are you using any extensions that can slow things down (this is very normal and happens all the time)? Use the Magento profiler to identify any problematic extensions.    2. Are your Magento logs regularly cleaned? Make sure that Log Cleaning is enabled (and the Cron Job is running) as the logs can make your database bloated which will slow things down.    3. Are all application level optimizations already performed? Things like enabling Magento cache, GZip compression, etc.     4. As for the server or hosting level, is the server properly optimized for Magento? Is the MySQL properly tweaked to match your store?  ... View more

@maxime_tanuki: SHA-256 is also known as SHA-2.    @Sergio Alfaro: You may need to contact PayPal to know if they will allow IPN without a SSL Certificate. This shouldn't affect anything that is not IPN related like the email notifications.  ... View more

It looks like the innodb_buffer_pool_size is quite a lot at 21GB and that will eat up a lot of your RAM.    Is there any reason this is set to such a high number?  ... View more

@Zana15: Yes, very good points about the username and password.    For passwords, I highly recommend the use of a password manager like LastPass which can help you generate very complex passwords and use unique passwords for each websites.    While you are at it, Two Factor Authentication is another thing that should be considered when the websites or services you use support it (especially your email as a hacker can reset your passwords to all other services if they have access to your email).  ... View more

@Zana15: Yes, you should check with your hosting provider on what is the ideal file permissions in their server. Hopefully they run something like SuPHP or SuExec so you do not need to use any file permissions beyond 644 for files and 755 for directories.    As for CloudFlare, you can use it whether it is for Magento or WordPress as it is application-agnostic. If you find it useful while you are using WordPress, you can implement it for Magento as well.    Personally I will stay clear of CloudFlare (especially the Free version) because of a few reasons:- They attract a lot of shady websites to hide behind their network which increases the risk of their network being DDoSed and thus resulting in slowdown and timeout to all websites under their network.  Their "CDN" isn't as powerful as a proper CDN. You cannot use your own SSL Certificate (CloudFlare-issued SSL isn't as trustworthy). ... View more

@Eminent Style: Yes, if your SSL Certificate is confirmed to be SHA-256 (also known as SHA-2), you should be all set.  ... View more

IMHO I wouldn't install third-party extensions to improve Magento's security as many third-party extensions have loopholes themself which can increase your security risk.    Here's what I will suggest:-   1. Make sure to use only the minimum required file permissions. If your server doesn't require insecure permissions like 666 or 777 (for example if the server uses SuPHP or SuExec), don't use those insecure permissions at all.    2. Rename the Admin URL to something unique and if possible block access to it from the outside world (only allow your own IP address) with this .htaccess rule:- RewriteCond %{REQUEST_URI} ^/(index.php/)?admin/ [NC] RewriteCond %{REMOTE_ADDR} !^X.X.X.X RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]   3. Implement a web application firewall like Mod Security to add an extra layer of protection to your website which can prevent a lot of attacks including SQL injections.    4. Reduce the amount of third-party extensions as some of them are very poorly coded with loopholes which not only opens up your Magento installation to hacking but may also eat up a lot of resources (CPU and RAM) for no apparent reason if they are inefficiently coded. The same goes for third-party themes where some are never supported or updated after being released.    5. Constantly implement all security patches and update all extensions and themes to the latest available version.    ... View more

There seem to be quite a some confusion as a result of the email by PayPal.   What they basically means is that PayPal IPN will only work with websites with SSL Certificates that are using 2048-bit and also SHA-256.   2048-bit should now be standardized for all SSL Certificates so it shouldn't be a problem.   SHA-256 is something that you need to take note of as your SSL Certificate may still be running the older SHA-1 cryptographic hash algorithm.   You can check if your SSL Certificate is using SHA-1 or SHA-256 at this website:- https://shaaaaaaaaaaaaa.com/   If you are still using SHA-1, you will need to contact your SSL Certificate issuer (not your hosting provider) to reissue the SSL Certificate into SHA-256 and install it in your server to replace the SHA-1 SSL Certificate. ... View more

Most, if not all hosting provider will be able to help you move over your website (some will charge for it while others may do it for free).    If you want to perform the move yourself, it should be pretty simple as well:- Take a backup or compress your files and do a MySQL dump of the database. Place your store in the old server into maintenance mode.  Copy the backup or compressed file and the database dump to the new server.  Extract the backup or compressed file and import the database dump into a new database in the new server. Update the app/etc/local.xml file to reflect the new database name, username and password.  Clear your Magento cache and sessions under var/caches and var/sessions.  Disable maintenance mode in the new server while keeping maintenance mode enabled in the old server.  Point the domain name to the new server.  ... View more

I guess a simple .htaccess redirect should work?  ... View more

Did you go through the three points that I stated previously?    Looking at the GTmetrix report, it only shows that the page itself is taking 5+ seconds to load but it doesn't show why, which is normal as these frontend based performance testing system cannot see beyond the frontend.    I suspect that your issue is a combination of rougue extensions, lack of application level optimizations and a server which is not properly optimized and tweak for Magento.  ... View more

Besides the theme, there are a few other points to take note of:-   1. Are you using any extensions that can slow things down (this is very normal and happens all the time)? Use the Magento profiler to identify any problematic extensions.    2. Are your Magento logs regularly cleaned? Make sure that Log Cleaning is enabled (and the Cron Job is running) as the logs can make your database bloated which will slow things down.    3. Are all application level optimizations already performed? Things like enabling Magento cache, GZip compression, etc.      As for the server or hosting level, is the server properly optimized for Magento? Is the MySQL properly tweaked to match your store?    I also can't help but noticed that you run CloudLinux in your VPS. Why would you do that? CloudLinux is only useful for shared hosting and unless you are hosting others in your VPS, it is not something useful and may even cause slowdown.  ... View more