Websites and PHP
Every bipanel account has a main domain. Users add addon domains, subdomains and aliases, pick a document root and PHP version for each site, and manage redirects, error pages, directory passwords and hotlink protection from the user panel.
On this page
#Domain types
The Domains page in the user panel lists every site on the account. There are four types:
| Type | Purpose | Own files |
|---|---|---|
| Main domain | Set when the account is created; users cannot delete it and must ask the server administrator to change it | Yes (public_html) |
| Addon domain | A separate website with its own files | Yes |
| Subdomain | A separate site under the main or an addon domain (e.g. blog.example.com) | Yes |
| Alias | Shows the same site as the main or an addon domain (a parked domain) | No |
Rules:
- A domain can be registered only once per server, and the server hostname cannot be used for hosting.
- Internationalized domain names are converted automatically.
- Also add the www. prefix is on by default for addon domains and aliases.
- The number of each type is checked against the account's package limits (addon domains, subdomains, aliases); once a limit is reached, new entries are rejected. See Accounts and packages.
- Aliases use their parent domain's settings, so redirects, PHP and error pages are configured on the parent. Only the email on/off switch belongs to the alias itself.
The Community edition runs up to 3 hosting accounts; the number of domains inside an account is set by its package. See Pricing for edition differences.
#Removing a domain
Removing a domain also removes its subdomains and aliases. If Also delete the files in the document root is ticked, the files go too, except public_html and any directory still used by another site. A domain attached to an application cannot be removed until you detach it in Applications.
#Document root
The document root is the directory holding the site's files, relative to the home directory. For addon domains and subdomains it defaults to the domain name (e.g. ~/example.com); you can enter another path such as public_html/site. The directory is created if it does not exist. The path cannot contain .., and .ssh, .bipanel, tmp, logs, backups, mail, .cache and .config cannot be used as a document root. You can change it later in the domain's Settings window.
#Domain settings
Each domain's Settings window contains:
| Setting | Default | What it does |
|---|---|---|
| PHP version | Account default | A separate PHP version for this site |
| www preference | Serve both | Permanent (301) redirect to www or to non-www |
| Force HTTPS | Off | Redirects HTTP to HTTPS with a 301; not applied without a valid certificate |
| Redirect the whole domain | Empty | 301 or 302 redirect to another address instead of the site; the path is kept |
| Directory listing | Off | Lists the contents of directories without an index file |
| ModSecurity | On | Blocks known attack patterns; changing it requires the package's ModSecurity feature |
| Email domain | On | When off, no mail is accepted for this domain |
| Custom error pages | Empty | Paths relative to the document root for 404, 403 and 500 (e.g. /404.html) |
To obtain a certificate, see SSL certificates. When a domain is routed to a Node.js or Python application, the document root and PHP settings are not used; see Applications.
#Redirects
The Redirects page defines path-based rules. The source path must start with / and contain no spaces (e.g. /old-page). The target is either a full URL (https://…) or a path starting with /. The code is 301 (permanent, the default) or 302 (temporary). The match type is exact (only that path) or prefix (everything below it, with the remaining path appended to the target). Each path can have one rule per domain, and redirects for an alias are defined on its parent.
#PHP versions and settings
Sites run on PHP-FPM, in a pool of their own per account. The Software group of the user panel has three pages:
- PHP Versions: sets the account's default version and a version per domain. Only versions installed on the server are offered.
- PHP INI Editor: settings that apply to all of the account's sites. Only the directives below can be edited.
- PHP Extensions: an account-wide or domain-specific extension selection.
| Directive | Default |
|---|---|
memory_limit | 256M |
upload_max_filesize / post_max_size | 64M |
max_execution_time / max_input_time | 120 |
max_input_vars | 3000 |
display_errors | Off |
date.timezone | Europe/Istanbul |
session.gc_maxlifetime | 1440 |
allow_url_fopen / opcache.enable | On |
short_open_tag | Off |
output_buffering | 4096 |
#PHP extensions
Extensions a user turns on are loaded only into that user's own PHP pool. If a domain gets a different extension set, that site runs in a separate PHP pool. Extensions are test-loaded with PHP before saving, a selection that fails to load is not saved, and changes apply without downtime. Extensions enabled server-wide are always loaded and cannot be turned off per pool.
#Administrator side
Under Server Admin:
- PHP: the default version for new accounts, the
disable_functionslist, restarting the FPM service and installing extension packages. - PHP Versions: installing and removing versions, end-of-life warnings, a usage report and bulk migration of sites with HTTP checks.
- PHP Extensions: enabling or disabling extensions server-wide and setting a policy for users (optional, on by default, blocked).
- PECL & PEAR: building PECL extensions and managing PEAR packages, available in the Pro edition only.
Installing versions and extension packages works only on a native server install. In a Docker or Railway container, PHP versions and extension packages ship with the image; to add one, rebuild the image with the PHP_VERSIONS and PHP_EXTENSIONS variables. See Docker and Railway.
#Site protection
#Directory privacy
The Directory Privacy page protects a directory in the home directory with HTTP Basic Auth. Protection takes effect once the directory has at least one username, and it has no effect unless the directory is inside a site's document root. The same page holds leech protection, which watches the access logs for how many different IP addresses use one username within a time window. It is off by default; when enabled, the limit is 4 IPs in 120 minutes (adjustable from 1 to 100 IPs and 10 to 1440 minutes). When the limit is exceeded, depending on the settings the username is disabled, the visitor is redirected to an address and/or the account owner gets an email.
#Hotlink protection
Hotlink Protection stops other sites from embedding your files directly. The default extensions are jpg, jpeg, gif, png, webp, svg, mp4. Requests from your own domain, your aliases and requests with an empty referer pass, as do the allowed addresses you add (starting with http(s)://, up to 50). Everything else gets a 403.
#Preview address
Preview Address shows a site at a temporary address before the domain's DNS points to the server. The server administrator must first set a preview base name on the Preview Addresses page. Previews expire (7 days by default, 30 at most; the administrator can change both within 1 to 365 days), can be password protected and are hidden from search engines. Optionally, absolute URLs in the HTML are rewritten to the preview address. For pointing DNS, see DNS.
#Custom site configuration
Custom Site Configuration (Advanced group) adds Apache directives per domain. In the default restricted mode only allowlisted directives are accepted; Include, module loading, log directives, handler and CGI definitions, php_* lines and paths leaving the home directory are rejected. Up to 300 lines are allowed. Before saving, the text is checked with an Apache configuration test on a temporary copy, and it is not applied if the test fails. The server administrator can grant an account raw mode on the Bot Blocking & Site Rules page; raw mode still runs the Apache test. For server-wide web server settings, see Web server and caching.
#Docker and Railway differences
When the panel runs on Railway, domains you add must also be registered with the Railway service. If RAILWAY_API_TOKEN is set this happens automatically and the settings window shows the CNAME record to create; www counts as a separate custom domain. Without the token, add the domain in the Railway service settings yourself and create the given CNAME target in DNS.
Something missing or wrong on this page? Let us know.