KoaPanel
IT Try it free
All manual sections

DocumentationSite rules

Site rules

On the site page, Rules tab, you set what cPanel has under Redirects, Directory Privacy, IP Blocker, Hotlink Protection, Error Pages and MIME Types. nginx applies the rules before anything else, so they also apply to WordPress, to the applications of Install app and to sites with Apache/.htaccess compatibility.

Every change is checked (nginx -t) before it's applied: if something is wrong, the site stays as it was and the panel shows the error. The rules follow the site when you move the account to another server.

Redirects

They send whoever opens a path of the site to another address.

  • From: the path of the site, for example /old-page. Write / for the whole site.
  • To: a full address (https://www.new.com/page) or another path of this site (/new-page).
  • Permanent (301) when the page has moved for good (search engines update the address); temporary (302) for a promotion or maintenance.
  • The pages below this path too: /old/x goes to <address>/x. With / and this option the whole site moves to the new domain keeping the paths (HTTPS certificate renewal keeps working).

The parameters of the address (?id=3) are kept. The panel already switches from HTTP to HTTPS when the certificate is on: no redirect is needed for that.

Password-protected folders

The browser asks for a user name and a password before showing a folder (HTTP "basic" authentication). Write the path (/private, or / for the whole site, for example a site under construction), an optional message and the first user. You can add more users, change a password or remove the protection.

  • Passwords are stored encrypted (SHA-512) in a file outside the site, readable by nginx only: nobody can read them back, not even from the panel.
  • The protection covers everything in the folder, PHP pages included.
  • Always use HTTPS: over HTTP the password travels in clear text.

IP blocker

Blocked addresses get a 403 error on the whole site. You can block an IP (203.0.113.7) or a network (198.51.100.0/24, 2001:db8::/48), up to 500 entries. The block applies to this site only: to shut out an address on the whole server (mail and SSH included) use the firewall.

Next to each address you can write a note (for example "script downloading the articles"): the panel shows it with the day of the block, so you know why the address is there. You can also block an address from the Logs tab, in "Most active addresses".

If the site is behind a CDN, first turn on The site is behind a CDN (below): otherwise the server sees the addresses of the CDN, not those of the visitors.

Limit of requests per address

Stops whoever asks too many pages: for example a script downloading every old article (pages outside the cache, heavy for the server) that changes address each time you block it. The limit does not need to know the addresses: it applies to everyone.

  • Pages a minute per address (20 proposed): a normal reader asks fewer than 10.
  • Margin for the peaks (40 proposed): extra pages allowed at once, for someone opening several tabs.
  • Over the limit the visitor gets error 429; you can show your own page in "Error pages".
  • Images, CSS, JavaScript and fonts never count, nor does the server itself. With the proposed options the users signed in to WordPress and Google and Bing (recognized by the browser name) are not limited either.
  • Addresses always allowed: your office, a monitoring service.

In the Logs tab, under "Most active addresses", you see how many requests were stopped and by whom.

The site is behind a CDN

With a CDN (1PrimeCDN, Cloudflare or another) the requests reach the server from the CDN's nodes: without this setting the IP blocker, the limit of requests, fail2ban and the WordPress sign-in limit would only see the addresses of the CDN, and stop every visitor together. Choose the CDN and the panel reads the visitor's real address from the CDN's header, only for the requests coming from its nodes (otherwise anyone could write it):

  • Cloudflare: header CF-Connecting-IP; the addresses of the nodes are the ones Cloudflare publishes, updated every night;
  • 1PrimeCDN: header X-PrimeCDN-Client-IP; write the addresses of the nodes 1PrimeCDN gives you;
  • Another CDN: write the header (for example X-Real-IP) and the addresses of the nodes.

Turn it on before the site goes through the CDN. The logs and the statistics then show the real addresses too.

It stops other sites from showing your images and videos using your bandwidth. The panel proposes the most common extensions (jpg, png, gif, webp, svg, mp4...); you can add other allowed sites (their subdomains are included) and an address shown instead of the blocked file. With Allow opening the file directly (recommended) files opened by typing the address, from apps and from mail readers, which don't say which page they come from, stay visible.

Error pages

For each error (404 page not found, 403 access denied, 503 service unavailable...) choose a page of the site shown instead of the standard server page, for example /errors/404.html. Errors from 500 up need a .html page: PHP might be the very cause of the error.

They apply to the errors generated by the web server (missing files, denied access, an application that doesn't answer). WordPress and the other applications usually show their own error pages, which stay as they are.

MIME types

They tell the browser how to handle files with a given extension, for example .webmanifest → application/manifest+json. Rarely needed: the server already knows the most common types. The .php extension can't be changed.