Sites and domains

A site in WardPane is one main domain, an optional list of aliases, a folder with files and a set of settings: the handler that runs it, its certificate and its protection. WardPane serves every site itself on ports 80 and 443, so there is no nginx or Apache to configure.

The main domain and aliases

Every site has exactly one main domain, for example example.com. You set it when you create the site, and the panel uses it to name the site in the interface, in logs and in folder names.

Aliases are other names that open the same site: www.example.com, example.org, example.net and so on. A site can have up to 99 aliases, because a Let’s Encrypt certificate holds at most 100 names and the main domain takes one of them. Add aliases when you create the site (under More options) or later on the General tab, one per line.

Point the DNS of every alias to the server, as you did for the main domain. Once an alias resolves to the server, it is added to the site’s certificate automatically (see SSL certificates).

Aliases with a folder of their own

By default an alias serves the main site. If an alias needs different content (a landing page on example.org, say), give it its own folder: on the General tab, press Create own folder next to the alias. From then on that alias serves files from its own folder and still shares the site’s certificate and settings.

Site names

A site can have a display name, such as “My shop”. Set it in the create dialog or on the General tab. The sites table and the site page show the name, with all domains listed under it and the main domain highlighted. Without a name the panel shows the main domain.

Folders and layout

WardPane 2.0 lays out sites the way ISPmanager does. Each site belongs to an owner, a Linux user created by WardPane. The default owner is www-root.

/var/www/www-root/                    home of the owner www-root
/var/www/www-root/data/www/example.com    the site folder
/var/www/www-root/data/logs/          logs of the owner's sites (example.com-php-error.log, ...)
/var/www/www-root/data/tmp/           temporary files and PHP sessions
/var/www/www-root/data/.pm2/          PM2 of the owner (Node.js sites)

For a site with no handler or with PHP, the site folder itself is the document root: upload index.html or index.php straight into /var/www/www-root/data/www/example.com. For a Node.js site the site folder is the app folder (with package.json), and only its public/ subfolder is served as files (see Node.js).

The General tab lists the exact folders of each site under Folders.

Sites created before 2.0

Sites that existed before you upgraded to 2.0 (including sites from Small Web Panel 1.x) keep their old layout. An upgrade moves nothing:

/var/www/example.com/public    what visitors see
/var/www/example.com/tmp       private: temporary files, PHP sessions
/var/www/example.com/logs      private: logs
/var/www/example.com/data      private: SQLite databases and other private files

Only public/ is ever served. tmp/, logs/ and data/ sit next to it, out of reach from the web. A PHP or Node.js site of this layout runs as its own Linux user, wp_<id>. A later release adds an action that moves such sites to the new layout one by one.

Site settings

The site page has the tabs General, Handler, SSL and Advanced. These settings apply to every site, whatever its handler:

Save changes at the bottom of the page saves all settings at once. If you try to leave the page with unsaved changes, the panel asks first. If your session expires while the page is open, the form comes back with your edits after you sign in again.

In the Sites table, every row has a menu with the actions for that site and a switch that turns the site off and on again. A site that is off is not served until you turn it back on; its files and settings stay as they are.

Your own 404 page

If the document root of a site has a 404.html, it is used as the error page for paths that do not exist. Error pages are sent with Cache-Control: no-store and without an ETag, so browsers and proxies never keep a stale copy.

How static files are served

Whatever the handler, WardPane sends existing files directly.

Each file gets a strong ETag built from its size and modification time, as in nginx and Apache. Browsers can revalidate their cache with a short request, and interrupted downloads resume with If-Range. A visitor who takes no data for 60 seconds is disconnected, so idle connections do not pile up.

A file whose real path is outside the site folder is not served, even through a symlink. Otherwise a symlink could publish .env files or the panel’s keys. WardPane runs this check on the file it has already opened, so nobody can swap the file for a symlink between the check and the response.

PHP sources are never sent as plain files, even on a static site. That covers .php, .phtml, .phar, .inc and similar files, and backup copies like wp-config.php.bak or config.php~.

Unknown domains

A request for a domain that no site has, or a request to the bare IP address on ports 80 and 443, gets a plain 404 page. WardPane never shows one of your sites under a name it does not know.

Creating a site

1. Point the A record (and the AAAA record, if you use IPv6) of the domain and of every alias to the server. See DNS.
2. In the panel, open Sites and press Create site.
3. Enter the domain and, if you like, a site name.
4. Choose the handler: No handler (static files), PHP or Node.js. You can change it later, see Handlers.
5. Under More options add aliases and check the switches (redirect to HTTPS and Auto SSL are on by default).
6. Press Create site in the dialog. The panel creates the folder and starts ordering the certificate.

For a PHP or Node.js site the panel then opens the Handler tab, where you finish the setup.

Uploading files

Upload files over SFTP (FileZilla, WinSCP, scp, rsync) into the site folder shown on the General tab.

• Sign in over SFTP as the site’s owner, or as a user in the www-data group. During installation install.sh adds the user who ran sudo to www-data, so that user can upload without root. Sign out and back in once for the new group to apply.
• Folders under /var/www are setgid with the group www-data, so new files keep the right group.
• Files must be readable (644 for files, 755 for folders is the usual SFTP default).
• If you upload as root, the panel may not be able to read the files, or PHP may not be able to write to them. For PHP sites, press Re-apply & fix permissions on the Handler tab after uploading writable folders as root (see PHP).

Deleting a site

Open the site, go to General and press Delete this site… in the “Delete site” box.

Deleting a site stops serving it and removes its certificate and settings. The files stay on disk unless you tick Also delete the site’s files in the confirmation dialog. With the box ticked, the site folder is removed. If that fails (for example because of permissions), the site is still deleted and the panel reports that the files could not be removed.

Import in replace mode and uninstall.sh never delete site files either (see Export and import).