Subdomains, PHP, SSL and firewall

The websites of a domain

The "Subdomains" tab of a domain lists all websites under it:

• The main domain (example.com) comes first.
• Subdomains (blog.example.com, shop.example.com and so on) are separate websites with their own folders.

Each website has its own PHP version and its own SSL setting. A subdomain doesn't inherit the main domain's settings.

Adding a subdomain

1. Open the "Subdomains" tab and click "Add subdomain".
2. Enter the short name, for example blog. Lowercase Latin letters, digits and hyphens are allowed.
3. Choose a PHP version and an SSL certificate.

The subdomain starts working within a few minutes. If the domain uses our nameservers, its DNS record is created automatically.

How many subdomains you can have depends on your hosting plan.

Extra names (aliases)

A website can also answer to other names, for example www.example.com for the main domain. In the website's settings, under "Additional hostnames (aliases)", add one a row with "+ Add a name" – just the label (www), the website's domain is added by itself. You don't need a separate subdomain for them.

• The name is always in the website's domain and can belong to one website only.
• If the domain is on our DNS servers, the name gets its DNS record automatically (and loses it when you remove it).
• A whole other domain (for example example.bg showing the website of example.com) isn't an alias – it has its own website. In its settings set a redirect to https://example.com (see "Redirecting a website").

PHP version

We offer the versions PHP still supports with security fixes:

• 8.4 - the default for new websites, supported until 31.12.2028;
• 8.5 - the newest, supported until 31.12.2029.

We don't offer older versions - a website on a PHP without security fixes is the most common way in for attackers. Before a version's support ends we will ask you to move to a newer one.

The version is changed in each website's settings and takes effect within a few minutes. Before changing the version of a live website, check that your application (WordPress, Joomla and so on) supports it.

A website can also run without PHP – for a static website (HTML, CSS, JavaScript and files only). Then no PHP runs for it, and its .php files aren't opened (otherwise their source would be shown to visitors). Applications like WordPress need PHP; the AI website is static and works without it.

The website's PHP settings

The default PHP settings are: 512 MB of memory per script, file uploads up to 128 MB. A website can change them itself with a .user.ini file in its folder (through the file manager or SFTP), for example:

memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 120
display_errors = Off

• The file holds for the folder it is in and its subfolders; usually it goes in the website's main folder.
• PHP reads it again within 5 minutes of a change.
• The settings PHP allows a website can be changed (memory_limit, upload_max_filesize, post_max_size, max_execution_time, max_input_vars, display_errors and others). The security limits (open_basedir, the disabled functions, the error log) can't be changed.
• The plan's caps stay: whatever memory_limit is, the account's PHP together can't use more memory than the plan; uploads over about 140 MB are stopped by the firewall.
• display_errors = On – only while you look for an error: it shows paths and details to visitors. Errors are written to /logs/php/error.log anyway.
• Visitors can't open .user.ini.

Firewall (WAF)

Every website has a web application firewall - ModSecurity with the standard OWASP rules (Core Rule Set). It recognizes typical attacks (SQL injection, XSS, attempts to reach system files and others) and stops them before they reach the site. The choice is per website (when editing it):

• On (the default) - a suspicious request gets a "Forbidden" page (403) with a reference. On a new server the firewall first only logs, until data from real traffic has been collected.
• Log only - nothing is stopped, but everything that would be is recorded.
• Off - no firewall.

Every hit is recorded in the site's error log (logs/<site>-error.log) with the reference and the rule's number. For WordPress, Drupal and Nextcloud installed from the panel, the rules' exclusions for them are switched on.

If the firewall stops something your site uses, choose "Log only" and write to us with the reference from the error page - we can switch off that particular rule for your site only.

SSL certificates (HTTPS)

For each website, choose one of these:

• Let's Encrypt. A free certificate that browsers trust. We recommend it for every website. It is issued and renewed automatically.
• No SSL. The website works over plain HTTP only.
• Self-signed. Shown only if we have enabled it for your account on request, for example for a site behind Cloudflare in "Full" mode. Browsers don't trust it.

With a Let's Encrypt certificate, visitors coming over HTTP are redirected to HTTPS automatically.

For Let's Encrypt to issue a certificate, the website's name must already point to our server. With our nameservers that happens automatically. With other nameservers, the A/AAAA record there must point to us. The same applies to every alias of the website.

The "certificate status" column shows:

If a certificate stays in "processing" for more than a few hours, the cause is almost always DNS. Check that all names of the website point to our server.

Own SSL certificate

If you have a certificate from another provider (for example with extended validation of the company), upload it from "Own certificate…" in the websites' list or in the website's settings. Paste:

• the website's certificate followed by the intermediate certificates (the chain), in PEM format (-----BEGIN CERTIFICATE-----);
• the private key, also in PEM, without a password (RSA or ECDSA).

We take the certificate only if the key is its own, the chain leads to an issuer browsers trust, it covers every name of the website (and the aliases) and is valid for at least another day. Once saved it takes effect within a minute, and visitors over HTTP are redirected to HTTPS. The key isn't shown again – on renewal just upload the new certificate at the same place.

An own certificate isn't renewed automatically. We'll write to you 30 and 7 days before it ends. To go back to the free Let's Encrypt, choose it in the website's settings.

Redirecting a website

A website can just redirect visitors to another address – for example an old domain to the new one. In the website's settings fill in "Redirect to" (https://www.example.com) and choose:

• Permanent (301) – for search engines the address has changed for good; temporary (302) – for a while.
• Keep the path – old-site/page?x=1 goes to new-address/page?x=1; without it everything goes to the address itself.

The website's files stay but aren't shown while it redirects. The redirect works over HTTPS too – the website keeps its certificate. Clear the address to make it a normal website again.