Talking points for administrators
This page is for advocates who talk to the people who install, run and secure sites: system administrators, hosting staff, DevOps people. They want to know what it needs, what can go wrong and how they will see it.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Contents
- What administrators want to know
- The points
- Commands and screens to show
- Questions administrators ask
- Do not say
What administrators want to know
- "What does it need, and can it run on what we have?"
- "How do I install, upgrade and back it up?"
- "How do I harden it and see attacks?"
- "What do I do at 3 a.m. when it breaks?"
The points
| Say | Source |
|---|---|
| "One command installs a complete site on SQLite, with no database server." | Installing Exponential in one command |
| "Six databases: SQLite 3, PostgreSQL, MongoDB, MariaDB, Oracle and MySQL, in that official order." | Database support |
| "PHP 8.0 to 8.5 are supported, so the stock PHP of Red Hat Enterprise Linux 9 runs it; PHP 7.4 is usable without support for hosts that cannot leave it yet." | PHP versions |
| "Operating systems in four documented tiers, from tested to theoretical." | Operating system support |
| "Velocity is the recommended engine; FrankenPHP is the production-ready alternative; Apache or nginx with PHP-FPM also serve it." | Velocity, Web servers |
| "A threat-by-threat hardening guide with a checklist." | Security hardening |
| "A new installation generates a random administrator password when none or a well-known one is given." | The default administrator password |
| "Probes and attacks are classified into a security log, with masked addresses." | Request logs |
| "A tamper-evident audit trail, on by default." | The audit trail |
| "A log viewer in the administration, and error references you can look up." | Log viewer, Finding an error by its reference |
| "Setup > Upgrade check compares the files with the release manifest and the database with the release schema." | The upgrade check |
| "Big removals and moves run as background jobs, so they do not time out." | Content jobs |
| "Standard dumps per database, and documented ways to move a site between databases." | Backup and restore, Moving a site |
Commands and screens to show
./console exp:install --dry-run # what an install would do, nothing written
./console exp:velocity status # every engine, its state and URL
./console exp:audit status # the audit trail on the command lineScreens: Setup > System information (the database, PHP and engine), Setup > Log files, Setup > Upgrade check, the Audit tab.
Check the command names on the installation you use; --help on each command lists its options
(Velocity,
The audit trail, From the command line).
Questions administrators ask
| Question | Answer | Source |
|---|---|---|
| "Does it run on shared hosting?" | Apache or LiteSpeed with .htaccess can serve it; without shell access the setup wizard installs it. Velocity usually cannot run there. | Containers, cloud and hosting panels |
| "Which database should we use?" | SQLite 3 is the default; PostgreSQL is the recommended server | Database support |
| "How are security fixes delivered?" | On main, published with the next 6.0.x release | Security fixes |
| "Can we run cron as root?" | The hardening guide covers cron and command-line scripts as root | Security hardening |
| "How do we upgrade safely?" | Back up first, never run an installer over an existing site; update files per database | Upgrading |
| "Can a WAF sit in front?" | Yes, by default since 6.0.15: request-shield of CJW Network, bundled in exp_request_shield, enforcing as installed | A shield in front |
Do not say
- "It is secure." Say what the process is and how they verify it (Talking points: security).
- "It runs on any hosting." Name the tiers and the limits of shared hosting.
- A response time or uptime figure: none is documented (Claims you must not make).
Related pages
- Talking points: hosting, databases and freedom
- Talking points: security
- Advocating for security
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.