Websites

In the folder public_html, which the File Manager in the control panel (Web Files) opens. There you can upload by drag and drop, edit files in the code editor (double-click a file), rename, move, delete, zip and download. Right-click a folder, Get Disk Usage, to see what takes the space. To upload many files at once, use FTP.

The first one found of index.php, index.html, index.htm, index.cgi, index.rb, index.py. For another file, set it in the control panel (Directory Indexing) or in .htaccess:

DirectoryIndex start.php

Yes: the Document Root field in the control panel (Domains for the main domain, Subdomains for the others) can point to any folder of your hosting. That folder must hold the site, or visitors get an error or a list of files.

Folders 755, files 644. The control panel's File Permissions Checker (Scan Permissions, then Fix Selected) repairs wrong ones, a common cause of "403 Forbidden".

Control panel, Custom Errors: for any error code, show a page of your site, redirect to an address, or show a text. No plugin needed.

Other services use it to check your domain (certificate validation files, security.txt). Leave it in place.

At the top of .htaccess:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The old domain stays added to your hosting; the path is kept:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^(www\.)?old-domain\.com$ [NC]
RewriteRule ^ https://new-domain.com%{REQUEST_URI} [L,R=301]

Redirect 301 /old-page.html https://yourdomain.lk/new-page/

A .htaccess file with a .htpasswd password protects that folder. Remove those lines, or the files, if the protection is not wanted.

Every hosting package has a temporary URL, shown in the control panel. It shows the same files as the live site. It is slower than the real site and has no CDN, so do not judge speed on it.

With the hosts file on your own computer: add a line with your hosting's IP address (shown in the control panel) and the domain, then remove it when done.

203.0.113.10 yourdomain.lk www.yourdomain.lk

• Windows: open Notepad as administrator and edit C:\Windows\System32\drivers\etc\hosts.
• macOS: in Terminal, sudo nano /private/etc/hosts, then sudo dscacheutil -flushcache.
• Linux: /etc/hosts.

203.0.113.10 stands for your hosting's address.

Usually a PHP error (a plugin, theme or PHP version change) or a broken .htaccess line; the error log names it. Undo the last change.

Old or broken cookies. Clear cookies and cache for the site, or try a private window.

Our bot protection checks visitors that look suspicious. After passing, your IP address is let through for 48 hours. If it keeps coming back for a real visitor, or blocks a service you need (SEO crawler, payment callback, uptime monitor), write to us with the IP address and the time.

Wrong file permissions (see Files above), a deny rule in .htaccess, a security plugin, Block Visitors (below), or the web application firewall. A 403 for only one action (saving a page, sending a form, an upload) while the rest works is usually the firewall; the error log then shows "ModSecurity: Access denied". Write to us with the address, the time and your IP address, and we allow that request.

The file does not exist under that name (capital letters count), the document root points to the wrong folder, or in WordPress the permalinks need saving again (WordPress errors).

Your IP address sent many requests for missing or forbidden files, usually a page that loads missing scripts or images in the background. Fix the missing files (the browser console lists them). If it keeps happening, write to us with the steps and your IP address (whatismyip.com shows it).

A redirect loop. Usual causes: Force HTTPS together with an https plugin or .htaccess rule, Cloudflare set to Flexible (it must be Full), the WordPress site and home addresses differing, a new plugin or .htaccess rule. Undo the last change.

Check whether it is down for everyone at downforeveryoneorjustme.com. If only for you: restart the router, try another network (mobile data), switch off VPN, antivirus or ad blocker, clear the cache. If your own IP address seems blocked, write to us with it.

Not an error: the browser avoids sending a form twice. Reload the page or open it again.

Google has flagged the site, almost always because it was hacked. Write to us at once. After the site is clean, ask Google for a review in Search Console.

Our servers get security fixes backported, so a version number can look old while the fixes are in. No action needed.

Windows: Command Prompt, tracert yourdomain.lk. macOS and Linux: Terminal, traceroute yourdomain.lk. Send us the whole output.

The Malware Scan (control panel, Security) checks your sites daily and whenever you press "Scan again". Red findings are a real risk; yellow ones are information (logs, database dumps or zip backups that contain suspicious text). While a site has red findings, PHP mail and scheduled tasks of that hosting are switched off, so contact forms stop sending. Both come back by themselves once a new scan is clean.

Write to us at once. Meanwhile:

• replace infected files with fresh copies of the same software and delete files you do not need;
• remove unused plugins and themes and update everything else;
• change all passwords: control panel, WordPress administrators, database and FTP (put the new database password into wp-config.php).

Control panel, Block Visitors: block all countries except chosen ones, or allow all except chosen ones, and block single IP addresses or ranges. Blocked visitors see 403. Blocking the USA can stop Google from indexing your site.

The web application firewall and the bot protection protect every site and cannot be switched off. If they block something you need, write to us and we make an exception.

Control panel, Backup/Restore (Web Files): Create Backup of your files, databases or both, then Download the zip and keep it off the server. To restore, upload such a zip there and choose to replace existing files, only add missing ones, or unpack into a separate folder; tick Restore Databases to include them. Only zips made by this tool can be restored with it, not zips from another host's panel.

Yes: make a backup in one package and restore it in the other.

If your control panel offers no restore for that day, write to us with the date and what should be restored.

More than 80, among them WordPress, Joomla, Drupal, PrestaShop, OpenCart, Moodle, phpBB, MediaWiki, Matomo, osTicket and Laravel. The installer sets up the database too. ImageMagick and the Imagick PHP extension are available.

We move it free of charge. We need the control panel login of the old host (cPanel, or Plesk with API access enabled), or FTP and database access, or a full backup; and the list of your domains and mailboxes. Moves stall when the old account is over its quota or suspended, or its firewall blocks us.

Nothing at the old host is deleted. You check the site on the temporary URL or with the hosts file (above), then change the nameservers. DNS records are not copied: records for mail or services that stay elsewhere have to be added before the switch (see Domains). Keep your own copy of everything before you close the old account.