Site settings

How the form works

Websites → Configure. Panel: Settings — your site. Seven tabs. Change anything, then save once.

General

Box / button	What it does
Forward the visitor's IP to your app	Your app gets the visitor's real address. Off: every visitor looks like one address.
Security headers (HSTS, nosniff, frame, referrer)	Forces HTTPS, blocks MIME guessing and framing, sets a referrer policy.
Trusted proxies	Behind Cloudflare or similar: their ranges, or private_ranges. Stops forged addresses.
Largest upload	e.g. 25MB. Bigger uploads refused before your app sees them.
Other names this site answers for	Extra names, space separated, e.g. www.example.com.
Directory index	File sites. Files tried for a folder, e.g. index.php index.html.
List the files when a directory has no index	File sites. Shows a file listing. Off by default.
Blocked paths	File sites. Never served, e.g. /.env, /.git/*. + block a path adds one.
Streaming / server-sent events	Proxy sites. Sends each chunk at once. For live feeds.
Keep-alive · Connect timeout · Response timeout	Proxy sites. Idle reuse, wait to connect, wait for an answer. e.g. 30s, 10s, 30s.

Security

Three sub-tabs: Firewall & IP, Rate limits, Geo blocking.

Box / button	What it does
Web Application Firewall (OWASP rules)	Blocks common injection and scanning before it reaches your app.
Mode (IP)	off — everyone · only these addresses · everyone except these.
Addresses / ranges	When a mode is set. e.g. 203.0.113.0/24, 198.51.100.5.
Require a client certificate to connect	The on switch for client certificates.
Requirement	ask, accept anyone · demand one, do not check it · check it if one is offered · demand one and check it. Only the last keeps people out.
Trusted client CA (PEM)	Filled in for you when you create the authority below.
Rate limiting	Master switch for the two below.
Per visitor	Each visitor's budget. Default 100 requests per 1m. Windows: 10s, 1m, 5m, 1h.
Whole site	One shared budget. Default 10000 per 1m.
Geo blocking	On/off.
Mode (geo)	Block the listed countries or Allow only the listed countries.
Countries	Codes, e.g. CN, RU.

Performance

Box / button	What it does
Compression (gzip + zstd)	Smaller text responses. Cheap. Usually on.
Brotli compression	Better than gzip for text. A little more CPU.
Cache responses at the edge	Repeat visitors served without reaching your app.
Cache for	How long a cached answer is reused, e.g. 5m.
How long browsers keep files	Per file type: extensions and age, e.g. .css .js .woff2 → 30d. + add a rule.
Sharing	Proxy with several upstreams: round robin (default), fewest connections, same visitor to same upstream, random, first that is up.
Health check path · Every · Expect	Proxy. A path probed, how often, which status. e.g. /health, 10s, 200. A failing upstream gets no traffic.

Headers

Box / button	What it does
set / add / remove	Replace, add alongside, or strip a response header.
Header-Name	e.g. Cache-Control, Server.
value	e.g. no-store. None for remove.
+ add header	Another row.

Redirects & errors

Box / button	What it does
Send the other www/apex form to this one	One address per page: www and bare go to the same place.
Custom redirects	From a path to a path or URL. Address bar changes. e.g. /old/* → /.
301 permanent / 302 temporary	Permanent for moved pages. Temporary for short changes.
Send some paths to another app	A path to another backend, unseen by visitors. e.g. /api/* → 127.0.0.1:8080.
Error message	Shown with the code on any error page.
Error page file	Your own page from the site root, e.g. /404.html.
Single-page app: serve index.html for unknown paths	For apps that route in the browser.

Password protection

Ask for a username and password before a path is served. Covers everything under it.

Box / button	What it does
+ protect a directory	New area. Path, e.g. /admin. Also covers /admin/settings.
username · password	One login. password kept when unchanged.
+ add login	More logins for the same area.

A login with no password is dropped on save. An area nobody can enter would lock the folder.

Access & logs

Box / button	What it does
Logging level	Off · Requests · Requests + headers · Requests + headers + bodies. Default Off. Bandwidth counted at every level.
Request bodies · Response bodies	Bodies level. What to capture. Recorded as sent, nothing hidden.
Methods captured	Default POST, PUT, PATCH, DELETE.
Capture for	1 hour to 7 days. Default 24 hours. Stops by itself.
Keep per body	KB kept per body. Default 64, at most 1024.
Keep captures for	Hours before deletion. Default 24, at most 168.

Client certificates

Under the settings. Only visitors holding a certificate you issued get in.

Box / button	What it does
off / on pill	Whether this site demands a certificate now. Switched under Security.
Create the authority	Only when the site has none yet. Makes this site's own certificate authority. Authority valid for: days, default 3650.
Issue a certificate	Who it is for (e.g. alice-laptop), Email (optional), Valid for days (default 365).
Shown only now	The .p12 file and its password. Download .p12. Not kept by the panel.
Name · Email · Expires · Status	Each certificate: valid, expired or revoked.
Revoke	Refused at once, on every node. Cannot be undone.
ca.pem path	Where this site's authority is kept, e.g. /etc/ozpanel/clients/example.com/ca.pem. The same path fills Trusted client CA (PEM).

Issue first, then switch on Require a client certificate under Security. On with none issued locks everyone out.

Previous: Websites Next: Apps