ISPConfig
This page is for hosting companies whose servers are managed with ISPConfig and who want to offer Exponential on them. It answers the first question honestly: the Exponential sources do not mention ISPConfig at all. It is not placed in a tier, and nothing here comes from a test. What the page can give you is the list of what an Exponential site needs, translated into the tasks any hosting panel performs, and a plan to test the combination yourself.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Note
Nothing on this page describes ISPConfig's screens, options or files. For how ISPConfig performs each task below, check ISPConfig's documentation.
Contents
- Status in the sources
- Why it may still work
- What the server must provide
- Two things to check first
- A test plan
- Checklist
Status in the sources
| Question | Answer |
|---|---|
| Is ISPConfig named in the documentation or code? | no |
| Which tier? | none: it is not placed |
| Has the project run Exponential on it? | not that the sources record |
The tiers are defined in Operating system support. Panels that are placed: Plesk (tier 1 on the development server), cPanel and DirectAdmin (tier 3) (Control panels: overview).
Why it may still work
The reasoning that places cPanel and DirectAdmin in tier 3 is that Exponential needs nothing from a panel itself: "It is plain PHP files plus a database; it has no compiled code of its own" and "runs on almost any operating system that has PHP 8.0 or later (PHP 7.4 usable without support) and a web server" (Operating system support). Any server whose panel can provide the items below, on a supported operating system, meets the requirements. That is an inference, not a test result: treat ISPConfig as at most tier 3 until you have tested it.
What the server must provide
| Need | Value | Panel task (generic) |
|---|---|---|
| Operating system | a tier 1 or 2 distribution, for example Debian 12 or 13, Ubuntu 22.04 or 24.04, AlmaLinux 9 | the base install below the panel (Tier 2) |
| PHP | 8.0 or later (Velocity included), with dom, libxml, simplexml, xsl, mbstring, iconv, intl, pcre, json, session, zlib, one database extension, gd or ImageMagick | PHP version and modules per site (2.3) |
| PHP for the command line | the same version and extensions as the site's | for Composer, the console and cron (Command line and web PHP) |
php.ini | memory_limit 64M or more, max_execution_time 30 or more, date.timezone, file_uploads on, allow_url_fopen on | per-site PHP settings (2.5) |
| PHP user | PHP runs as the site's own user | per-site PHP-FPM pool (8.7.2) |
| Document root | the installation root (with index.php) | the site's document root |
| Rewrite rules | Apache: .htaccess from .htaccess_root; nginx: the derived server block | the site's web server directives (8.5, 8.6) |
| Database | in the official order: 1. SQLite 3 (no server) · 2. PostgreSQL · 3. MongoDB · 4. MariaDB · 5. Oracle · 6. MySQL; Microsoft SQL Server is known to be possible with additional work at this time | a database and user, UTF-8 (Databases and users) |
| Scheduled jobs | runcronjobs.php with the site's PHP | the site's cron jobs (Cron and shell access) |
| HTTPS | a certificate for every name of the site | the site's certificate settings (TLS certificates in panels) |
Two things to check first
1. Which web server serves the site, and how its rules are set. Under Apache the shipped .htaccess works when
.htaccess files are read (AllowOverride) and mod_rewrite is on. Under nginx there is no .htaccess; the
Exponential rules must go into the server's configuration. The project ships no nginx file: chapter 8 gives a server
block that is "derived, not shipped" and asks you to "test it on your site before you rely on it"
(8.6). Under Apache, php bin/php/console exp:setup:htaccess --apply, run as the site's shell user, copies .htaccess_root into place; under nginx that copy
protects nothing (Setting up .htaccess and config.php from the console).
Warning
"Never serve the installation with a generic configuration such as nginx's 'serve the file if it exists, else
index.php'": "those hand out every file that exists, including settings/*.ini and the SQLite database"
(13.2). A panel's default
PHP site template is exactly such a configuration unless you add the Exponential rules.
2. open_basedir and disable_functions. Panels often restrict both per site. The setup wizard only warns about
open_basedir; the cronjob page needs proc_open, exec and posix_kill for its run, crontab and stop features
(Cronjobs, Before you start); ezupdate looks for Composer below the
installation root first because open_basedir can hide system folders
(ezupdate).
A test plan
| Step | Pass when |
|---|---|
Install on a fresh site (setup wizard, or exp:install with a shell) | every critical test passes; site and /admin answer |
Request /settings/site.ini, /.env, /composer.json, /kernel/classes/ezini.php | 404 or an Exponential page, never the file (13.2) |
| Upload an image, view it | image and variations served |
| Cron line | the run appears on Setup > Cronjobs |
| Change PHP version in the panel | the site still answers; both web and command line PHP changed |
| Backup and restore to a second site | the restored site works |
| Two sites on the server | neither site's PHP can read the other's settings/override |
If everything passes, tell the project, so ISPConfig can be placed in a tier (The four tiers).
Checklist
- To do: Operating system of tier 1 or 2 below the panel.
- To do: PHP 8.x with every required extension, web and command line alike, one user per site.
- To do: Exponential rewrite rules in place (
.htaccessor the derived nginx block); file-exposure test passed. - To do:
open_basediranddisable_functionsdecisions documented. - To do: Database, cron and certificate set up.
- To do: The test plan passed; offer documented as not covered by the project's own tests.
Related pages
- Control panels: overview, Webmin
- nginx with PHP-FPM, Apache with PHP-FPM
- Requirements at a glance
- Setting up .htaccess and config.php from the console
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.