Web Hosting

Overview

Web hosting runs PHP websites on Apache, the way a classic LAMP host does. You create one hosting, and it can serve many websites at once: its own address, the domains you attach, and subdomains of those domains. They share the tier's storage, PHP workers and memory.

Every hosting includes:

• Several websites, domains and subdomains served from folders you control
• SFTP and SSH access on every tier
• A file manager in the control panel for quick edits and uploads
• Unmetered bandwidth

Tiers

The wizard shows the monthly price beside each tier. Bandwidth is not metered on any tier. Every rate, add-ons included, is on Web Hosting Pricing.

Extra storage

If a tier's disk is not enough, add storage on top of it in 10 GB blocks, at USD 1 per block per month. You can add up to 50 GB for now. Larger sizes are on the way.

Extra storage is chosen when the hosting is created.

Backups

Every hosting is backed up once a night, and each night only what changed since the night before is stored. Everything in your hosting's folder is included except tmp/, where PHP keeps sessions and uploads in progress. If your hosting has MySQL databases, each one is copied into the same nightly backup, so a backup's files and databases are from the same moment.

How long backups are kept depends on the retention you choose:

The price counts the hosting's whole disk, the tier's storage plus any extra storage, in started blocks of 10 GB. A Growth hosting has 25 GB, so it counts as three blocks.

Choose a retention when you create the hosting, or change it at any time on the hosting's Backups tab. A longer retention is charged straight away for the rest of the billing period. If you shorten it, backups older than the new retention are deleted the next night.

The Backups tab also lists the recent nightly backups and how much space they use.

Restoring a backup

Every backup still within your retention has a Restore button on the Backups tab. If your hosting has databases, you choose what to restore: its files, any of its databases, or both.

• Files go back exactly as they were that night. Files changed since are overwritten, and files added since are deleted. tmp/ is left as it is.
• A database is emptied and loaded from that night's copy, so everything written to it since is gone. Databases you do not choose are left as they are. A backup offers the databases your hosting has now that it holds a copy of.

A restore cannot be undone, so download anything you want to keep first, or export a database you may need again.

Your hosting stays online while it restores, and the tab shows when it is done. A large hosting can take a few minutes. Only one restore runs at a time, and none can start while that night's backup is running.

If you only need one file or folder back, contact support and we restore it into a new folder beside your site instead.

When you delete a hosting, its backups are kept for its retention period and then removed. Billing for them stops when the hosting is deleted.

How your files are laid out

Your hosting has one home folder. Each address it answers on gets a folder named after it, with the public files in public_html inside:

/var/www/<user>/
├── <your-address>/
│   └── public_html/          # your hosting's own address
├── example.com/
│   ├── public_html/          # example.com, once attached
│   └── shop/                 # shop.example.com, once attached
└── tmp/                      # PHP sessions and uploads

Only a folder that an address points at is served. Anything next to public_html, such as configuration files or backups, stays private until you decide otherwise. A folder is never served because of its name alone.

Your hosting's address

Every hosting is given an address on cosmoner.com, shown on its page in the control panel. It serves the public_html inside the folder named after it.

Domains

A hosting answers on the domains of its project. Add the domain to the project first, on the project's Domains page in the control panel: register it, move it here, or add one you keep elsewhere and verify it. Only a verified domain can be attached, so no other project can claim a name that is yours.

Then choose Attach domain on the hosting's Domains tab and pick the domain. By default it is served from <domain>/public_html, and the folder is created for you. To serve a folder you already have, choose A folder already on the site and browse to it. A folder that another domain already serves is labelled with that domain.

What happens with DNS depends on who runs the domain's DNS:

• Registered or moved to Cosmoner: the DNS records are added for you. The domain goes live as soon as its certificate is issued, usually within a few minutes. If the domain already has a record at that name, the attach stops and says which one, so nothing you set up is overwritten.
• Managed elsewhere: the panel shows the records to add at your DNS provider. The domain goes live once they are in place.

Subdomains

Subdomains are available on domains you attach, not on your hosting's own cosmoner.com address.

A subdomain of your own domain, such as shop.example.com, is attached like any other domain: pick example.com and type shop in front of it. It counts as one domain. When example.com is already attached, it defaults to a folder inside it, beside public_html: example.com/shop.

A folder you already have can be turned into a subdomain from the file manager: open its menu and choose Serve as domain. The attach page opens with that folder chosen and the subdomain its name implies filled in.

Redirects and parked domains

A domain does not have to serve a folder. When you attach it, or later from its Change button, choose one of:

• Website serves a folder, as above.
• Redirect sends every visitor to another address and keeps the path they asked for, so old.example.com/about lands on https://example.com/about. Pick 301 for a permanent move or 302 for a temporary one. The target is a full address without a query string.
• Parked shows a placeholder page. Use it to hold a domain, with its DNS and certificate already in place, until the website is ready.

Switching between them keeps the domain attached, so there are no DNS records to change. Redirects and parked domains count against the tier like any other attached domain.

Uploading files

SFTP

Connect with any SFTP client, such as FileZilla, Cyberduck or WinSCP. The host, port and username are on the hosting's page, and the password can be revealed there. The host and port are the same for every hosting: sftp.cosmoner.com on port 2022. Your username is what picks your hosting.

Five failed logins from one address block that address for an hour.

Plain FTP and FTPS are not offered.

SSH

Every tier also includes a shell on the same host, port and credentials. It has git, and composer and wp-cli for installing PHP packages and managing WordPress from the command line. composer and wp-cli come with the current site image: a hosting created before they were added gets them with its next update, see Updates and rollback.

File manager

The Files tab in the control panel lists, uploads, downloads, renames and deletes files, and opens text files in an editor. Each transfer is limited to 64 MB. Members with the viewer role see the file list but cannot open or download files, since a site's files often hold its passwords.

Console

The Console tab opens the same shell as SSH in your browser, without an SSH client or a password. It runs as your hosting's own user and starts in its home folder. Members with the viewer role don't see it, and the session ends when you leave the tab.

How PHP runs

Each hosting runs in its own isolated container, so other customers cannot reach your files or processes.

• PHP version. PHP 8.4 or 8.3, chosen when you create the hosting and changed at any time from its overview, see PHP versions. All websites on the hosting use the same version.
• PHP workers are how many PHP requests run at the same time. Further requests wait for a free worker. If your sites slow down under traffic, a higher tier adds workers.
• Memory per request is PHP's memory_limit, set by the tier. It cannot be raised from .htaccess.
• Defaults. Uploads and form posts up to 64 MB, a 120 second execution limit, and OPcache enabled.
• .htaccess works for rewrites, redirects, access rules and authentication, so WordPress, Laravel and similar applications run as expected.

PHP versions

A hosting on PHP 8.1 or 8.2 keeps running, and its overview shows when security support ends with an Upgrade button. The account's billing contact is emailed 60, 30 and 7 days before that date, and once after it. A hosting is never moved to another PHP version for you: a new version can break a plugin or a framework, so you choose when.

Changing the PHP version

Pick another version on the hosting's overview. The hosting restarts on the new version, which interrupts it for a few seconds. Test your sites afterwards. If something breaks, Roll back returns the hosting to the version it had, for 7 days.

Updates and rollback

Your hosting runs one exact build of PHP and the server software, and keeps running that build until you change it. A restart never swaps it for a newer one behind your back.

Patched builds of every PHP version are made weekly. When one is available for your hosting's version, its overview shows Security update available with an Update now button. Updating restarts the hosting on the new build, which interrupts it for a few seconds. The overview shows Updating until the hosting is serving on the new build again, and says so if it cannot start on it, so you can roll back.

If an update fixes a critical vulnerability, or one that is known to be exploited, the overview may also show a date after which it is applied automatically, during the night between 02:00 and 05:00 Swedish time. The account's billing contact is emailed when it appears and two days before. Update before then to choose the moment yourself. A hosting is never stopped because of a vulnerability.

Rolling back

For 7 days after an update or a PHP version change, Roll back on the overview returns the hosting to the build and PHP version it ran before. A hosting that had not been on an exact build yet has nothing to return to after an update, so Roll back appears only after a PHP version change. A rollback is one step back and cannot itself be rolled back: update again when you are ready. Rolling back an automatic security update postpones it, and it is applied again after a new deadline.

Members with the viewer role see updates but cannot apply them.

Sending email

PHP's mail() function, and everything built on it such as WordPress password resets and contact forms, sends through Cosmoner Email once you turn email on for the hosting. Until then mail() returns false and the reason is written to the hosting's error log, so a form can tell its visitor the message was not sent.

To turn it on:

1. Add a domain under Email in the control panel and finish its DNS setup, so it is verified for sending. See SMTP setup.
2. On the hosting's overview, choose that domain and the mailbox name to send as, such as [email protected], and press Turn on email.

This creates an SMTP credential for the hosting, listed with the domain's other credentials. Every email the hosting sends is billed on your project's email plan, the same as any other email. All mail leaves as that one address: a sender an application sets is replaced by it.

Press Turn off to stop sending; the credential is deleted. Deleting the credential on the Email page turns the hosting's email off as well. Members with the viewer role see the setting but cannot change it.

Changing tiers

Change tier from the hosting's page. New PHP workers, memory and domain limits apply straight away. If the hosting keeps backups for longer than 7 days, their price follows the tier's storage. The disk size is set when the hosting is created.