Website Management (Sites)

Website management enables the complete configuration of websites, including PHP settings, Nginx directives, preview domains, access restrictions, and deployment options.

---

Overview

The site table shows all configured websites with thumbnail preview, status, and configuration details.

Displayed Columns

Column	Description
Preview	Thumbnail image of the website
Domain	Primary domain of the website
Customer	Assigned customer
Linux User	System username
PHP Version	Active PHP version
Status	Active or Disabled
Document Root	Path to the web directory

---

Create Website

1. Click Create Website
2. Fill out the form:

Field	Required	Description
Subscription	Yes	Associated hosting subscription
Domain	Yes	Domain of the new website
PHP Version	Yes	PHP version (loaded dynamically from the server)
Document Root	No	Subdirectory (default: domain root)

1. Click Create

Dynamic PHP Versions

The PHP version dropdown is populated dynamically from the server API. It always reflects the PHP versions actually installed on the target server, so you never have to guess which versions are available.

The system automatically configures:

• Nginx vhost with security policies
• PHP-FPM pool under the Linux user
• SSL certificate via Let's Encrypt (if enabled)
• open_basedir restriction
• Upload directory protection (PHP execution blocked)

---

Edit Website

Click the Edit button (pencil icon) of a website to open its configuration.

Tab: General

Field	Description
Domain	Primary domain of the website (changeable)
PHP Version	Change PHP version
PHP Handler	FPM or CGI
Document Root	Adjust web directory
Status	Enable/disable website

---

Change Domain

The primary domain of a website can be changed directly in the edit modal.

How to

1. Open Websites and click the Edit button of the desired website
2. Change the Domain field to the new domain
3. Click Save

What happens automatically

Step	Description
Nginx vhost	Old vhost is removed, new one created with the new domain
WordPress URLs	If WordPress is installed, siteurl and home are automatically updated via search-replace (all tables)
Panel database	Domain in sites, wordpress_installations and domains tables is updated
PHP-FPM	Pool remains unchanged (same Linux user)
Files	All files remain in the same location — only the domain mapping changes

Validation

• The new domain must have a valid format (e.g. example.com, shop.my-hosting.com)
• The domain must not already be used by another website
• The change takes effect immediately — no restart required

After the domain change

• SSL must be manually activated for the new domain (under Domains → Enable SSL)
• DNS must point to the server before SSL can be requested
• Existing domain aliases and subdomains are preserved

Note

Make sure the DNS A record of the new domain points to the server's IP address before enabling SSL. Otherwise, certificate creation will fail.

Tab: PHP Configuration

PHP settings can be customized per website:

Setting	Description
memory_limit	Maximum memory per PHP process
max_execution_time	Maximum execution time in seconds
max_input_time	Maximum input time
post_max_size	Maximum POST size
upload_max_filesize	Maximum upload file size
max_input_vars	Maximum number of input variables
max_file_uploads	Maximum number of simultaneous uploads
display_errors	Error display (for development only!)
error_reporting	Error reporting level
session.gc_maxlifetime	Session lifetime
opcache.enable	Enable OPcache
open_basedir	Path restriction
disable_functions	Disabled PHP functions

disable_functions

The default security settings disable dangerous functions such as exec, passthru, shell_exec, system, popen, and proc_open. Only change these if you understand the security implications.

Tab: Nginx Directives

Custom Nginx configuration directives can be added in the text field. These are inserted into the server block of the vhost configuration.

Examples:

# Additional headers
add_header X-Frame-Options "SAMEORIGIN";

# Redirect rule
location /old-page {
    return 301 /new-page;
}

Syntax Validation

The system validates the Nginx configuration before saving. Syntax errors will cause the change to be rejected.

Tab: Performance & Security

Web Application Firewall (ModSecurity)

The WAF can be enabled per website. It uses ModSecurity with the OWASP Core Rule Set (CRS):

1. Open the website details
2. Navigate to the Performance & Security tab
3. Scroll to the Web Application Firewall (ModSecurity) section
4. Enable the Enable ModSecurity WAF toggle
5. Click Save

What Is Protected?

The WAF protects against SQL injection, XSS (Cross-Site Scripting), Remote File Inclusion, and many other OWASP Top 10 attacks.

False Positives

Some web applications may have legitimate requests blocked by the WAF (false positives). Disable the WAF if the application stops working correctly after enabling it.

Requirement: The packages libnginx-mod-http-modsecurity and modsecurity-crs must be installed on the server. On new installations this is set up automatically.

Tab: Preview Domain

Each website receives a preview URL through which the website is accessible before the DNS settings of the actual domain are configured.

• Format: <subdomain>.preview.<panel-domain>
• Can be enabled or disabled
• Useful for development and migration

Tab: Access Restrictions

• IP Restriction: Allow access only from specific IP addresses
• Password Protection: Protect directories via HTTP authentication

Tab: Logs

Access to the latest entries of the website logs:

• Access Log — Access logs
• Error Log — Error logs

Logs can be viewed directly in the browser or downloaded.

---

Enable / Disable Website

• Click the Status toggle in the detail view
• Disabled websites show a default error page
• The Nginx configuration is automatically updated

---

Delete Website

1. Click the Delete icon
2. Confirm the deletion

Note About Files

When deleting a website, the Nginx configuration and PHP-FPM pool are removed. The website files in the home directory are optionally preserved.

---

Composer Management

For websites with PHP projects, Composer is available directly in the panel:

1. Open the website details
2. Navigate to the Composer tab
3. Available actions:
4. composer install — Install dependencies
5. composer update — Update dependencies
6. Output is displayed in real time

---

Node.js and Python apps

Besides PHP, a website can run as a Node.js or Python app. The app runs as its own systemd service on an internal port; nginx reverse-proxies requests to it. Availability is granted per package via the Node.js/Python permission.

Creating

When creating the website, choose App type Node.js or Python. The following fields appear:

• Start command — the command that starts the app (e.g. npm start or gunicorn app:app). The assigned port is available as $PORT.
• Port — internal port; leave empty for automatic assignment.
• Environment variables — one KEY=VALUE per line.

Managing (app runtime)

The Manage app action on the website opens the app-runtime dialog:

• Status (active / stopped / failed) with Start / Stop / Restart
• Edit start command, port and environment variables — saving reconfigures and restarts the app
• Install dependencies — npm install (Node.js) or pip install -r requirements.txt in a venv (Python), run as the website user
• Logs — the app service's recent output (journald)
• Runtime version — the Node/Python version is selectable per app (default = system version)

Runtime versions

A runtime version can be chosen per app, both when creating and in the app-runtime dialog. As an admin you can provision additional versions directly:

• Node.js — enter the major version (e.g. 20); enconf downloads the official binary and stores it under /opt/enconf/runtimes/node/<major>/.
• Python — enter the minor version (e.g. 3.12); enconf installs the distribution package python3.<minor>-venv.

The version is then available in the picker. Node apps use the chosen node/npm; Python apps build their venv with the chosen interpreter.

---

Git Deployment

For automated deployment via Git:

1. Open the website details
2. Navigate to the Git tab
3. Configure:
4. Repository URL — HTTPS or SSH
5. Branch — Branch to deploy (e.g. main)
6. Auto-Deploy — Automatic deployment on push (webhook)

7. Deploy Key — SSH key for private repositories

8. Click Deploy Now for manual deployment

Deploy Hooks

After the Git pull, commands can be executed automatically (e.g. composer install, npm run build).

---

Error Pages (Error Documents)

Custom error pages can be configured for standard HTTP error codes:

• 403 — Forbidden
• 404 — Not Found
• 500 — Internal Server Error
• 502 — Bad Gateway
• 503 — Service Unavailable