Websites and PHP

Built and lab-tested

• Static, PHP and reverse-proxy sites, with addon domains, subdomains, aliases and parked domains. International names are stored as punycode and shown as written.
• One PHP-FPM master per account and PHP version, running as the account's own Linux user inside its own systemd slice. PHP comes from the distribution or the Ondřej Surý repository (pinned key).
• Layered configuration: global, server, plan, reseller, account, site. A layer can lock a setting so lower layers cannot change it, and the panel shows which layer set every value.
• Custom nginx snippets are read by a real tokenizer and checked against an allow-list, with the line number of anything refused. include, load_module, Lua and fastcgi_pass are never accepted from customers.
• Each change renders a new configuration generation, runs nginx -t and php-fpm -t on the exact files, swaps a symlink, health-checks every changed site and flips back on failure. The last 30 generations stay available for one-click rollback.
• Create, update, delete and rollback can run as a dry run that returns the per-file diff.
• Isolation: open_basedir to the home, per-account PHP sockets, disable_symlinks if_not_owner on every server block, root-owned logs, and proxy sites refused for private addresses unless the admin allows it.
• A web application firewall per site (Coraza with the OWASP Core Rule Set): off, detect or block, exceptions made from a blocked request, and a kill switch. It fails open, and in our measurement adds about 12 ms at the 95th percentile.
• Rate-limit presets, security-header presets, a proof-of-work bot challenge and hotlink protection per site.