Web Hosting
Host Websites and Applications with Clear Access Boundaries.
Nodekeeper runs on your own Linux servers and manages websites, application runtimes, databases, background jobs, certificates, mail and backups from one panel. Each site gets its own access boundary. You can start on the Free plan. Paid plans add visitor insight, collaboration and infrastructure tools.
Each site keeps its own boundary All plans, including Free
You can give someone access to one website without handing over the server.
- Strong website isolation: every site runs as its own system user and group, and its root directory is owned by root, so a site cannot loosen its own boundary. PHP-FPM gets one pool per site. Apache (mod_php) gets one instance per site by default.
- Per-site virtual SSH: key-only SSH/SFTP access that is confined to one site and expires after 2 to 24 hours. Permanent access is a separate permission.
- Per-site virtual FTP: the FTP service for a site runs as that site's user. The password is shown only once.
- File manager: browse, upload, edit and extract files in the browser. File operations run with the site's own identity.
- Multi-user and permissions: member accounts are included in every plan. User groups, roles and delegated administration start at Pro.
- Isolation keeps sites apart from each other. It does not protect against someone who already has root on the host.
- If you put several sites on one shared Apache instance, those sites share a runtime user and lose their separation from each other.
- Known issue: after you regenerate an FTP password, restart that site's FTP instance before the new password works.
Websites, applications and background jobs, managed together All plans, including Free
This isn't only a PHP site builder. Runtimes, databases, processes and entry points live in the same workspace.
Runtimes
PHP, Java, Python. PHP 5.2 to 8.5 is compiled on your own server from source. Java, Python and Node.js runtimes are installed by the administrator.
Databases
MySQL, PostgreSQL and MongoDB instances, plus Redis and Memcached.
Jobs and processes
Scheduled tasks for each site, systemd service management and Supervisor processes.
Entry points
nginx, Apache and HAProxy as web server or reverse proxy. Every plan includes them.
- PHP 8.1 and older are end-of-life upstream and carry other known vulnerabilities. Use PHP 8.2 or newer for new sites.
- PHP builds on ARM (aarch64) servers have not yet been through the same security verification as x86_64.
- Supported versions are those listed in the panel for your release. This page does not promise every new version on release day.
Domains, certificates and mail
Domains All plans, including Free
Bind domains to sites and request certificates on every plan. Running your own authoritative DNS / GeoDNS service (the domain list) is part of Business.
Certificates All plans, including Free
SSL/TLS incl. wildcard: certificates for domain names and wildcard names, with automatic renewal. Wildcard names need DNS validation.
Mail All plans, including Free
Self-hosted mail with SMTP, IMAP / POP3, webmail and DKIM, running beside your websites on every plan.
- Certificates are ordered through the host.mw certificate service (CA: ZeroSSL), so issuing and renewing need that service to be reachable.
- Automatic renewal of a wildcard certificate needs a supported DNS provider script or the built-in DNS (Business). Otherwise you add a DNS record at each renewal.
- Mail has no inbound spam or virus filtering. Sending mail needs outbound port 25 open or a relay host, and many cloud providers block port 25.
Backups, logs and monitoring
Local/cloud scheduled backup (rclone) All plans, including Free
Back up websites, MySQL, PostgreSQL, MongoDB and the Nodekeeper configuration to local disk, S3, OSS or another rclone remote. You set a cron schedule and how many runs to keep, and you restore from the panel. More on backups
Audit logs
Every plan records operations in the panel. The website-log and WAF-log viewers start at Personal.
Uptime monitoring All plans, including Free
Every plan includes the connectivity monitor for sites and hosts. Probing from several locations uses sync groups, which are part of Business.
- Tested destinations: local disk, S3-compatible storage and OSS; other rclone remotes need your own test restore. Storage and traffic fees at the destination are yours.
- A remote copy is not version history and does not protect against ransomware on its own. Test a restore before you rely on it.
What Personal adds for site owners
Free keeps the essentials. Personal is for people who run their sites seriously and want to see what visitors do:
- JS website analytics, heatmaps, session replay and IP-based location reports.
- A self-hosted CDN layer with caching, origin rules, rate limits and IP / GeoIP rules.
- Website-log and WAF-log viewers, and mesh networking between your nodes.
Free, Personal and Pro for hosting
Licences are per node: each server that runs Nodekeeper has its own licence. Free is not a time-limited trial.
| Hosting task | Free | Personal | Pro |
|---|---|---|---|
| Sites, file manager, PHP / Java / Python, MySQL / PostgreSQL / MongoDB | Included | Included | Included |
| Cron, systemd, Supervisor, nginx / Apache / HAProxy | Included | Included | Included |
| Site isolation, site SSH / SFTP and FTP, member accounts | Included | Included | Included |
| Domain and wildcard certificates, mail, scheduled backup and restore | Included | Included | Included |
| Base WAF (ModSecurity rule sets), system firewall, uptime monitor | Included | Included | Included |
| Website analytics, heatmaps, session replay, IP location reports | — | Included | Included |
| Self-hosted CDN, rate limits, IP / GeoIP rules | — | Included | Included |
| Website-log and WAF-log viewers, mesh networking | — | Included | Included |
| User groups, roles and delegated administration | — | — | Included |
| eBPF tamper protection, virtual machine management | — | — | Included |
| Price | Free | $3/month, or $30 billed annually, per node | $7/month, or $70 billed annually, per node |
Business adds authoritative DNS, database replication, hosting quotas with the WHMCS modules, distributed storage and network-booted office PCs. Enterprise terms are agreed with sales. See the full comparison on the pricing page.