Handlers
The handler decides what runs a site. WardPane has three: No handler for static files, PHP and Node.js. You pick one when you create a site and can change it at any time on the site’s Handler tab.
The three handlers
With No handler (static hosting), HTML, CSS, scripts, images and other files are sent as they are. No code of yours runs on the server, which makes this the fastest option and the one with the least to attack. Use it for plain websites, landing pages and the build output of React, Vue, Angular, Astro, Hugo and similar tools. If the app does its routing in the browser, turn on SPA mode so that unknown paths get index.html.
The PHP handler runs .php files, so it is the one for WordPress, Laravel, Symfony and other PHP sites. Each PHP site gets its own php-fpm and its own Linux user. Its sandbox sees neither the other sites nor the panel. Details are on the PHP page.
Node.js starts your app (Express, Next.js, Nuxt, Fastify and others) and passes requests to it, while files in public/ can still be served directly. Apps run under PM2, with one PM2 daemon per owner. See Node.js.
Comparison
| No handler | PHP | Node.js | |
|---|---|---|---|
| Typical use | Static sites, SPAs, docs | WordPress, Laravel, classic PHP apps | Express, Next.js, Nuxt, APIs, WebSockets |
| What is served | Files from the document root | Files, plus .php scripts |
Files from public/, everything else goes to the app |
| Runs code on the server | No | Yes, per-site php-fpm | Yes, your app under PM2 |
| Runs as | Served by the panel | The site’s owner (sites from 1.x: wp_<id>) |
The site’s owner |
| Needs a runtime | No | PHP installed on the server | A Node.js major (20 to 26), downloaded on demand |
.htaccess |
Only if it was on before 2.0 | Yes, optional | No, the app handles its own routes |
| Limits | None needed | Memory per request, workers, CPU | Memory, CPU |
| Block outgoing connections | Not applicable | Optional | Optional |
| Protection (Bot Fight, Geo, rate limits…) | Yes | Yes, before PHP sees the request | Yes, before the app sees the request |
Whatever the handler, the protection checks of the site run first. A request that is blocked never reaches PHP or your app.
Choosing a handler
- A site made only of files needs No handler, even when a JavaScript tool built those files. Static hosting needs no runtime and runs none of your code.
- A PHP application, or any site with
.phpfiles, needs PHP. Install PHP on the server first (sudo ./install.sh --php); the Runtimes page shows which versions are there. - Choose Node.js when the site is a Node.js server that listens on a port.
Switching a handler
- Open the site and go to the Handler tab.
- Choose another handler under “What runs the site”.
- Fill in the settings of the new handler, if any, and press Save changes.
Switching keeps the settings of the other handlers. If you move a site from PHP to Node.js and later back to PHP, its PHP settings (version, writable folders, limits) are still there. The same goes for the Node.js settings, including its assigned port and environment variables.
What changes when you switch:
- Switching to PHP starts a php-fpm for the site, and
.phpfiles, which were refused before, now run. - Switching to Node.js assigns a port, downloads the Node.js version if it is missing and starts the app in PM2. The document root moves to
public/inside the site folder. - Switching to No handler stops the site’s PHP or Node.js app. Files are still served, and
.phpsources are never sent as plain text.
.htaccess processing belongs to the PHP handler. A static site that already had it on before 2.0 keeps it (the option stays visible under Advanced); new static sites do not process .htaccess files.
Simple and Expert mode
Simple and Expert modes are planned for 2.3. In 2.0 the Handler tab shows the handler choice and all settings of the chosen handler, filled in with recommended values.