Web server and caching

#Operating modes

You pick the mode in the Operating mode section of Server Admin → Web Server. There are three:

A mode switch runs as a background job. It runs pre-checks, requests every site through the current stack to take a baseline, starts the new stack and requests the same sites again. If the new engine fails to start or the health check fails, the switch is rolled back automatically and the previous mode comes back. Switching back to Apache requires a valid Apache configuration.

On a container (Docker/Railway) installation Apache always serves the sites, and the platform handles TLS and load balancing. The Nginx front end, the Nginx cache, Varnish and OpenLiteSpeed are not available there. Details: Docker and Railway.

#Apache

The server installation sets Apache up with mpm_event and disables the prefork and worker modules. PHP does not run inside Apache processes but in PHP-FPM pools running as the account’s own user; Apache hands requests over with proxy_fcgi, so Apache workers stay light. The MPM module cannot be changed from the panel.

#Global settings

Server Admin → Apache has four tabs: Overview, Global settings, Include files and Logs. The values on the Global settings tab apply to the whole server:

#MPM settings

The same tab edits the mpm_event values: StartServers (2), MinSpareThreads (25), MaxSpareThreads (75), ThreadsPerChild (25), MaxRequestWorkers (150) and MaxConnectionsPerChild (0). The panel refuses inconsistent combinations; for example MaxRequestWorkers must be a multiple of ThreadsPerChild, and MaxSpareThreads must be at least MinSpareThreads + ThreadsPerChild. ServerLimit and ThreadLimit are derived automatically.

A calculator suggests values from the server’s memory. By default it gives Apache 25% of RAM at roughly 2 MB per worker, leaving the rest for PHP-FPM, databases and mail.

#Include files and logs

Administrators can edit three include files: before the main configuration, before the virtual hosts and after the virtual hosts. Every save runs apachectl configtest; if the test fails, the file is restored. The last 20 versions of each file are kept.

The Logs tab controls rotation of per-domain access logs (default: daily, 14 copies, compressed, 100 MB threshold) and panel logs (weekly, 8 copies). Server installations use logrotate; in a container the panel’s built-in rotator applies the same rules. Server Admin → Apache Status shows worker and request state from mod_status.

#Nginx front end

Install Nginx with the Install Nginx button on the Web Server page or from Server Admin → Components. In Nginx + Apache mode, Apache listens only on 127.0.0.1 on the backend port (8080 by default) and gets the real visitor IP through mod_remoteip. Nginx uses the same certificates as Apache.

#Protocols and TLS

These settings apply to every site on the Nginx front end:

• HTTP/2: on by default.
• HTTP/3 (QUIC): off by default; runs over UDP 443, needs TLS 1.3 and an Nginx package built with QUIC support. If the firewall is on, 443/udp is opened.
• TLS versions: TLS 1.2 and TLS 1.3 by default; at least one of them must stay selected.
• Cipher suites: Modern, Recommended (default) and Broad compatibility presets.
• OCSP stapling: off by default.
• Maximum request body: in MB; 0 means unlimited.

When Apache runs standalone, its HTTPS virtual hosts offer HTTP/2 (h2) and HTTP/1.1.

#Static file offload

Per domain, the administrator can let Nginx serve static files (css, js, images, fonts, media, pdf) directly without passing them to Apache; the browser cache lifetime defaults to 7 days. Scripts, html files, archives and database dumps always go to Apache for security reasons, because .htaccess protections do not apply in Nginx. Offload is not applied to suspended accounts, application sites, redirected domains, sites with hotlink protection or a password-protected document root.

#Cache layers

#Nginx cache

Available in Nginx + Apache mode, including in the Community edition. Users turn it on per domain from the Cache page in the user panel (off by default). Pages are cached for 600 seconds and static files for 7 days by default. It supports bypass rules for session cookies, paths and query strings, serving a stale copy while the backend fails, background refresh and an optional separate mobile copy. Responses carry an X-Cache-Status header. The cache can be purged entirely, for a single URL or by prefix.

Server Admin → Nginx Cache (administrators and resellers) turns the cache on or off server-wide and sets the default size per domain (256 MB) and the largest size a user may choose (2048 MB). The Nginx cache is not applied when Varnish is active for the domain or when Directory Privacy protects the whole site.

#Varnish (Pro)

Varnish is a cache layer between Nginx and Apache in Nginx front-end mode, and it only works in the Pro edition. Install and enable it from Server Admin → Varnish; users then enable it per domain on the Varnish Cache page. Defaults: 127.0.0.1:6081, 256 MB of memory, a 120-second TTL and 3600 seconds of grace. If Varnish is unhealthy, the account is suspended or the site has an access rule enforced by Apache, requests go straight to Apache.

#OpenLiteSpeed and LiteSpeed Cache (Pro)

OpenLiteSpeed requires the Pro edition and a valid license. Install it from Server Admin → OpenLiteSpeed, then switch modes on the Web Server page; Apache is parked. Each site gets an OpenLiteSpeed virtual host generated from the data Apache uses: PHP running as the account user, TLS, redirects, the suspension page, application proxies, Directory Privacy and .htaccess access rules. HTTP/3 is optional. LiteSpeed Cache is on server-wide, and users can turn it off per domain on the LiteSpeed Cache page. The WebAdmin console listens only locally and is opened to server administrators through the panel.

#Per-site settings

The user panel offers these per-domain pages (when the package allows them):

Security headers are written to the Apache virtual host and, in Nginx mode, to Nginx as well. Before HSTS is turned on, a pre-check runs: the domain needs a valid certificate and must answer over HTTPS; if the check fails, HSTS is not saved. The page probes the live headers over HTTPS from the server and gives a simple grade. The custom directive editor rejects lines such as Include, Load, log directives, php_* and proxies to external targets; accepted text is syntax-tested by Apache on a temporary copy.

#Server-wide defaults

Server Admin → Apache Content Defaults sets the starting values for all sites: DirectoryIndex order (index.php, index.html, index.htm), compression (selected types, brotli preferred), browser caching (off), CGI (off; the apache-cgi component is also required) and SSI (on, with exec disabled). Server Admin → Security Headers sets default headers for new domains, and Bot Blocking & Site Rules manages server-wide bot rules and whether accounts may use raw directives.

See Pricing for an edition comparison; the Community edition is limited to 3 hosting accounts. For PHP versions and site types see Websites and PHP, and for certificates see SSL certificates.