Skip to content

Websites and SSL

Two pages under Domains show every website on the server and its HTTPS certificate. Use them to see what is hosted, spot certificates that need attention, and fix one for a customer.

Websites

Go to Domains › Websites. The page lists every website on the server: main domains, addon domains and subdomains, for all hosting accounts.

Find a site

  • The chips at the top filter by kind: All, Main domains, Addon domains and Subdomains. Each shows how many there are.
  • Type in Search a domain or account and press Filter. The search also matches a site's extra names (aliases). Press Clear to reset.
  • If the server has more than one hosting account, a menu limits the list to one account. Its first entry is Every hosting account.
  • The list is sorted by account, with a parent domain before its subdomains. It shows 20 sites a page.

Read a row

Each row shows these columns: Website, Kind, Hosting account, SSL, PHP.

  • A suspended mark means the site is suspended. A redirects mark means the whole domain sends visitors to another address. Other names the site answers to appear under it as "also …".
  • SSL is a short status. no certificate, expired and self-signed are the problems. A name that is not covered reads "misses N names". Otherwise it shows the days left. A small note under it gives the full warning.
  • PHP shows the site's own PHP version, or "account's" when the site follows the account's version.
  • Visit opens the site in a new tab. Manage opens the hosting account the site belongs to. The account name is a link to the same place.

What you can do here, and what the customer does

This page is a list. It has no add, remove, suspend or redirect buttons. Press Manage to open the account, and use the account's page to work on its sites.

Customers manage their own sites from their panel: adding addon domains and subdomains, the folder, PHP version, redirects and removing a domain. That is covered in Websites and domains. Suspending a site is a provider action. A customer has no suspend button.

SSL

Go to Domains › SSL. The page has two parts: the panel's own certificate on top, and the list of every website's certificate below.

The panel's own certificate

The first card is This panel's own certificate. It is the certificate for the address you reach the panel on. Its mark reads trusted or self-signed.

  • Trusted means a real certificate. The card names the issuer, the hostname and the days left. It renews itself with everything else on this page.
  • Self-signed means the panel signed its own certificate, which is why your browser warns about the address. A real one can be issued once the hostname points at this server in public DNS and port 80 is reachable. If an earlier attempt failed, the card shows Last attempt with the reason.

To change it:

  1. Type the address in Hostname the panel is reached by (for example panel.example.com) and press Save.
  2. Press Issue a certificate now, or Renew it now when the certificate is already trusted. This tries at once and ignores the usual wait between attempts. If it fails, the panel keeps the certificate it has. A message tells you why no certificate was issued.

Point the hostname at the server first. For DNS, see DNS and Cloudflare.

All certificates

Free certificates renew themselves about a month before they run out. Bought ones do not, and the page lists them 30 days before they expire.

The chips filter the list. All shows every site. Needs attention shows sites with no certificate or a warning. Bought shows uploaded certificates. Expiring in 14 days shows certificates with 14 days or less left. Each chip shows a count. The search box takes a website, a name the certificate covers or misses, the account, or the issuer.

The list puts problems first, then sorts by days left. Columns:

  • Certificate: None, Self-signed, Bought (with its issuer) or Let's Encrypt.
  • Covers: one label per name. A tick means covered and a cross means not covered. @ is the domain itself. www and similar are names under it. * is a wildcard.
  • Expires: days left, or "expired". 14 days or less is highlighted.

A site with no certificate has Get free SSL on its row. Open shows that site's certificate card.

One site's certificate

Open shows the same card the customer sees on their website's SSL tab, acting on that one site. It shows who issued the certificate, which names it covers, when it is valid until, and whether it renews on its own. These actions are on it:

  • Get a free certificate, Reissue… and Renew now for Let's Encrypt. Let's Encrypt allows only a few of these a week, so the buttons ask you to wait after use.
  • Force HTTPS, with Turn on or Turn off, and Main address to choose the name visitors end up on.
  • Replace with a free certificate… replaces a bought certificate.
  • Remove this certificate… puts the site back on the server's self-signed certificate. You type the domain to confirm.
  • Use a certificate you bought: make a CSR, then paste the certificate and the intermediate bundle. A bought certificate does not renew by itself.

The customer guide explains each of these in full: Websites and domains.

Common problems

  • None or Self-signed: visitors see a browser warning. Press Get free SSL. It fails if the domain does not point at this server yet.
  • A name not covered: open the site and press Reissue for all names.
  • Expired: press Renew now, or install a new bought certificate.
  • A free certificate that will not issue is nearly always DNS. Check the domain's records in DNS, and the proxy setting if the domain uses Cloudflare.

The web stack, per site

Every site is served by whichever web stack the server runs. Choose it under Server › Web server. Two settings can then be switched per site, from the site's Overview tab in the hosting account:

  • Page cache stores public pages so they are served faster. It appears only if the server offers it, and it is turned on at the server level first on Server › Web server. Clear cache empties it.
  • ModSecurity is the web firewall, per site. The server-wide rules and mode are under Server › Security › Web firewall.

Both switches are hidden when the server cannot offer them, so a missing switch means the server does not have that feature.

See Securing your server and The Security Center for the firewall, and Plans for the limits a site runs under.