Manage domains, aliases and web server options

Each hosting has one primary domain, fixed at creation, and any number of alias domains that answer with the same content. Web server options such as forced HTTPS, maintenance mode and basic auth live on the Settings & limits tab. Every change is checked with nginx -t before it goes live.

Before you start

• Your account has the Edit hosting config permission.
• For a new alias, DNS for the alias points at the server. The Check DNS button on the Domains & SSL tab tells you.
• You know that a new alias is not covered by the existing certificate until you issue a new one.

Steps

Add or remove alias domains

1. Open Hostings, click the site, then open the Domains & SSL tab.
2. In Alias domains enter every alias you want, separated by commas, spaces or new lines. The list you save replaces the old one, so keep the names you still want. An empty field removes all aliases.
3. Click Save aliases.
4. Issue a new certificate so HTTPS covers the new names. Follow Issue an HTTPS certificate. You do not need to delete the current certificate first.

Hyperion rewrites the nginx server_name and reloads nginx. The primary domain cannot be changed; to use another primary domain, create a new hosting. An alias equal to the primary domain is dropped, and duplicates are merged.

Until the new certificate is issued, the site already answers on the new name and browsers refuse its certificate. The page shows a red The certificate does not cover … banner and a ! badge on the Domains & SSL tab until you fix it.

Make the bare domain the main address

A hosting registered as www.example.com shows a Use example.com as the main address card at the top of Settings & limits.

1. Click Switch to example.com and confirm.

The bare name is added as an alias, the certificate is re-issued for both names, WordPress’s Site Address follows, and www.example.com is redirected to the bare name with a 301. If DNS for the bare name does not point at the server yet, or the certificate cannot be issued, nothing is redirected. Folders, FTP logins and mail keys keep their current names.

Choose the canonical hostname, force HTTPS and set HSTS

1. Open Settings & limits, find the Vhost options card.
2. Under HTTPS & HSTS:
   • Force HTTP → HTTPS answers every plain HTTP request with a 301 to HTTPS.
   • Canonical hostname is Serve both as-is (no redirect), a redirect from www.<domain> to <domain>, or the reverse. The www option needs the www.<domain> alias first. On WordPress sites the Site Address is changed to match, Hyperion follows the redirect chain after saving, and it rolls back if the chain loops.
   • HSTS max-age is Off (0), 1 hour, 1 day, 30 days, 6 months, 1 year or 2 years.
3. Click Save vhost options.

Before you set a long HSTS value

Browsers remember HSTS for the full max-age and refuse plain HTTP for the domain during that time. Values above one day are effectively permanent for visitors who already saw the header. To undo it you must serve max-age 0 and wait out the old value. Use 1 hour (testing) first, and make sure the certificate is trusted and renews. This cannot be undone for browsers that already cached the header.

Other web server options

All on the Vhost options card, under Settings & limits:

• Maintenance mode answers every request with HTTP 503. Let’s Encrypt validation, PHP-FPM and the database keep running. A MAINTENANCE badge shows at the top of the site page.
• Hide from search engines adds X-Robots-Tag: noindex, nofollow to every response. Turn it off at launch.
• HTTP basic auth requires a Username and Password for every request. Leave the password blank to keep the current one.
• FastCGI page cache caches PHP responses for anonymous visitors. Cache TTL is in seconds, at most 86400 (300 when unset). Logged-in WordPress and PHP-session visitors bypass the cache. Purge cached pages clears it; plugin and theme changes, restores and deploys clear it by themselves.
• Custom nginx snippet (up to 32 KiB, appended inside the HTTPS server { } block) appears only for accounts with the Write raw nginx config permission.

Change a proxy upstream or redirect target

• Proxy sites: open the Overview tab, find Upstream under About this site, enter the new URL (for example http://127.0.0.1:8080) and click Save. Requests go to the new origin immediately. Accounts without cluster-wide scope cannot point an upstream at this machine or at a private network address.
• Redirect sites: open Settings & limits, then Vhost options, then Redirect target. Set Target URL, Redirect code (301, 302, 307 or 308) and Preserve request path.

Check that it worked

On the Domains & SSL tab, the Domains card shows the alias count and the Certificate card’s Covers row lists every name. After saving vhost options a green message reads “Vhost options saved. The new configuration is live.”

curl -sI http://example.com/

Expected with Force HTTP → HTTPS on: HTTP/1.1 301 Moved Permanently and a Location: https://example.com/ header.

If it fails

• nginx refused the new config: followed by the nginx error. Nothing was applied and the previous vhost is still active. Fix the value, or the snippet, and save again.
• nginx config rejected: … Aliases reverted. The alias list was not applied. Fix the reported problem and save again.
• Invalid alias: … One entry is not a valid domain name. Domains need at least two labels, letters, digits and hyphens only.
• Browser error ERR_CERT_COMMON_NAME_INVALID on an alias: the certificate does not cover it yet. Issue a new certificate.

Related

• Install WordPress on a hosting