Recent changes
Wednesday November 04 2026
-
Audit trail Updated Markdown page
The Exponential audit trail from a host's side: what is recorded per channel, the cronjob that rotates, verifies and archives, the hash chain and exp:audit verify for monitoring, alert recipients, forwarding to syslog…
-
Compliance and GDPR Updated Markdown page
What Exponential provides that helps a host and its customers meet data protection and e-mail law (GDPR, ePrivacy, CAN-SPAM, CASL, CCPA): privacy defaults in logs and the audit trail, the mail consent and suppression…
-
Content Security Policy Updated Markdown page
The Content Security Policy as a host meets it: the shipped report-only policy on administration siteaccesses, the csp/report collector and csp.log, how to move a customer's siteaccess to enforce, what usually breaks…
-
Demo mode for hosts Updated Markdown page
How a host runs a public Exponential demo with the environment variable EXP_DEMO_MODE=1 - setting it for PHP-FPM, Apache, Exponential Velocity, cron and containers, installing the published demo password, checking it…
-
First sign-in and default passwords Updated Markdown page
What administrator password each way of installing Exponential leaves behind, how a host hands the first sign-in to a customer without a known or shared password, what to remove after provisioning, how to find an old…
-
Hardening for hosts Updated Markdown page
The hardening a host applies to every Exponential site, layer by layer: served files, secrets, debug output, the administration, passwords, sessions, headers and TLS, proxies, file ownership, Velocity, mail, the audit…
-
Multi-tenant isolation Updated Markdown page
How far one customer's Exponential site is kept from another's on shared infrastructure: what Exponential isolates and what it leaves to the operating system, the boundary each setup gives (shared process, one pool or…
-
Per-customer users and pools Updated Markdown page
The concrete setup that gives each customer's Exponential site its own operating-system user, its own PHP-FPM pool or Velocity instance, its own crontab and its own database user, with ownership and modes for code, var/…
-
request-shield and request rules Updated Markdown page
The three request layers a host can use with Exponential: request-shield, a firewall that decides before the kernel starts; the kernel's request classifier, which only classifies into security.log; and the kernel's…
-
Restricting the administration Updated Markdown page
How a host keeps the Exponential administration of each customer site out of reach of everyone else: its own host name, network limits in Apache, nginx or in front of Velocity, request-shield's browser check…
-
Security updates and disclosure Updated Markdown page
Which Exponential versions receive security fixes, how fixes are published, how a host follows releases and rolls updates out to customer sites, how to check that files were not changed, what else needs updates, and how…
-
TLS and HTTPS Updated Markdown page
How a host serves every Exponential site over HTTPS only: who terminates TLS, redirecting plain HTTP, HSTS in the kernel and in Velocity, secure session cookies, proxies and load balancers that terminate TLS…
-
Two-step sign-in Updated Markdown page
Two-step sign-in for the Exponential sites a host runs: what the sevenx_authentication_2fa extension does, how to switch it on per site or siteaccess, how to require it for administrators, the encryption key for…
-
Web servers and engines Updated Markdown page
Overview of the web server section for hosting companies: which servers and engines serve Exponential, how they compare, and a one-line guide to every page of the section.
-
Apache with PHP-FPM Updated Markdown page
How a host serves Exponential with Apache httpd 2.4 and a PHP-FPM pool per site: the shipped rewrite rules, the virtual host, HTTPS, the right FPM master to reload, Plesk, and the checks before go-live.
-
Caddy Updated Markdown page
What the Exponential sources say about Caddy, the two ways to use it (FrankenPHP, which is Caddy with PHP built in, or Caddy with PHP-FPM), the routing any Caddy setup must reproduce, and the traps to avoid.
-
Choosing a web server Updated Markdown page
A decision guide for hosts: which web server or engine to offer for which plan, with the facts that decide it (PHP version, long-running processes, isolation, HTTPS, caching) and a decision record to copy.
-
FrankenPHP Updated Markdown page
FrankenPHP for hosts: what the production-ready alternative engine is, how exp:velocity installs and verifies the binary, its embedded PHP that reads no php.ini, threads, HTTPS, logs, its limits against Velocity, and…
-
Microsoft IIS Updated Markdown page
What the Exponential sources say about Windows hosting with Microsoft IIS and FastCGI PHP: the status, what the kernel detects, what Windows lacks, the routing to reproduce in web.config, and the tests to run before…
-
LiteSpeed and OpenLiteSpeed Updated Markdown page
What the Exponential sources say about LiteSpeed and OpenLiteSpeed hosting: the shipped Apache rules, the LSAPI SAPI, open_basedir, what to test before selling a plan, and where Velocity fits.