My story
Hands-on web security from someone who’s been doing it since 1999
I’m Alan Lee, and WebControl is my business. I’ve worked in IT for 27 years. I’ve been hosting websites since 1999 and securing them for just as long, and I’ve worked with Cloudflare since 2020 – everything from the free plan to Enterprise.
Over the years I’ve seen too many organisations let down by their vendors. I started WebControl to be the vendor I wished they’d had: one person who knows your setup, gives you straight answers, and works within your processes rather than around them.
Whether you’re planning a Cloudflare rollout or dealing with a DNS crisis at 2am, you’ll deal with me – calmly, clearly, and without cutting corners.
27 years
in IT
Since 1999
hosting and securing websites
Since 2020
working with Cloudflare, free plan to Enterprise
Sydney
serving Australia and New Zealand
Self-taught since 1995
I’d rather understand a system than be surprised by it
1995
Bulletin board
Ran my own bulletin board system.
1996
First Linux
Installed my first Linux system.
Late 1990s
My own server
Colocated my own server running part of an IRC network – and learned to handle attacks on it.
1999
Web hosting
Started hosting websites, and securing them.
2020
Cloudflare
Started working with Cloudflare day to day, from the free plan to Enterprise. (I first tried it back in 2015.)
Today
WebControl
Helping businesses across Australia and New Zealand, personally.
I still run a home lab, and most of the technology I’ve taken into production ran there first. I have very little tolerance for downtime, so a lot of my thinking goes into what could fail next, and having the answer ready before it’s needed.
I use AI too. Claude helps me work through logs and documentation faster, but every decision and every change is still mine. I’m also testing self-hosted models in the lab, so more of that work can stay entirely in-house.
Experience
Where my experience comes from
For the last decade I’ve designed and run hosting platforms for organisations where downtime and security really matter. Each had its own change control and security requirements, and no two were the same.
10+ years
designing and running hosting platforms
Hundreds
of sites moved onto Cloudflare
Zero
downtime moving a site onto Cloudflare in the middle of a DDoS attack
Minutes
to contain a compromised account during an attack
Hundreds of sites onto Cloudflare
I chose the right setup for each, from dedicated Enterprise accounts to SSL for SaaS, and managed their WAF, DNS, certificates and origin protection.
Onboarding ahead of a DDoS attack
I moved an organisation onto Cloudflare in about three hours, after warning signs of a DDoS attack. The move caused no outage, and when the attack came at around 10pm that night, the sites stayed up.
Contained in minutes
During a targeted attack campaign I spotted and contained a compromised account, then led the uplift: MFA, least-privilege admin, endpoint protection and a web application firewall.
Certificates that renew themselves
I moved a hosting platform off paid certificates to automatic renewal, ahead of the industry shortening certificate lifetimes. Sites behind Cloudflare use its edge certificates, and anything that can’t be automated is watched for expiry.
Early warning of web shells
I built monitoring that watches web application files for changes, so a backdoor planted on a site gets noticed early, not weeks later.
Each client walled off
I designed per-client isolation – separate firewall pairs and private networks – so a problem in one client’s environment can’t reach another.
Working with me
How I work
You deal with me
No ticket queues or faceless support. You have one point of contact – me – and I know your setup.
Emergency-friendly
I take on urgent Cloudflare onboarding and incident response, because security problems rarely wait for a good time.
I work your way
I fit in with how your team already works: your change control, your approvals, your maintenance windows. Every change is planned, agreed and documented, with no shortcuts.
Ethics over upsell
I’ll tell you what you actually need, even when that means less work for me. Honest advice built around your needs – not a sales script.