Web hosting: getting started

Everything below is done from Account → Hosting on medialab.works. The plans and prices are on the hosting page; what is included is described in the hosting overview.

1. Order a plan

  1. Open the hosting page and choose a plan and the billing period (monthly or yearly).
  2. Add options if you need them: more disk, vCPU or RAM, or extended backup. You can change them later.
  3. Enter your e-mail address (or sign in if you already have an account; otherwise your customer account is created when you pay and the temporary password arrives by e-mail), tick the box to accept the Terms, the Acceptable use policy and the Data processing agreement, and pay with Stripe.

Your hosting account is created automatically after the payment, usually within a few minutes, and you receive an e-mail. The 30-day money-back guarantee starts with your first payment.

2. Add a website

In Websites → Add a website:

  • Name: lowercase letters, digits and hyphens. It becomes the folder www-data/<name> in your home folder.
  • Technology: PHP 8.1–8.5, Node.js 22 or 24, Python 3.12 (Node.js and Python from Standard) or static.
  • Web server (PHP only): Apache reads .htaccess files, like most shared hosting, and is the safe choice for WordPress and most PHP apps that ship rewrite rules in .htaccess. nginx is lighter and faster for static files, but ignores .htaccess; WordPress works on it out of the box. You choose for each site.
  • Domain (optional): your own domain or a subdomain of a domain in your account (for example blog.yourdomain.com); the subdomain's DNS record is created automatically. Without a domain the site works right away on its preview address, <site>-<user>.hosting.medialab.works (HTTP only, until you move the domain).
  • Web root (PHP and static): the folder inside www-data/<site> served to visitors, public by default; . means the site folder itself.

When it is created, the site folder gets a starter page (index.php or index.html) showing that the domain reaches the server, where the site is hosted and which PHP version runs. Replace it with your own files.

Where your files go:

Technology Folder
PHP, static www-data/<site>/public (or the web root you chose)
Node.js, Python www-data/<site>/app

3. Connect your domain

When you add a domain (with a website or in Domains), we create for you:

  1. a DNS zone in Cloudflare, in our account, with the web records and the mail records (MX, SPF, DKIM, DMARC, autoconfig);
  2. the mail domain on our mail server, with its DKIM key;
  3. the website on the server, with an SSL certificate as soon as the domain points to us.

What you do: at the company where you registered the domain (the registrar), replace the nameservers with the two shown in Account → Hosting → Domains. The change usually takes from a few minutes to a few hours, sometimes up to 48 hours. The domain page shows each step; when the nameservers are seen, the zone becomes active and the certificate is issued automatically. Check DNS and Issue certificate let you retry at once.

Keeping your current DNS provider? Point an A record to the IP address shown in the account instead, and add the mail records yourself if you want e-mail on the domain (the DNS records table in the account lists them). Without our nameservers, the DNS records are your responsibility.

4. Deploy a PHP site (WordPress example)

  1. Create a site with PHP 8.4 (or the version your app needs) and Apache.
  2. Create a MariaDB database in Databases (for example wp; its full name becomes <user>_wp). The password of your database user is shown once, when you create your first MariaDB database: save it.
  3. Upload WordPress into www-data/<site>/public from Files (a .zip archive, then Extract), over SFTP (section 8) or over SSH.
  4. In wp-config.php use:
    • DB_NAME: <user>_wp
    • DB_USER: your database user (the same as your account user)
    • DB_PASSWORD: the saved password
    • DB_HOST: mlw-db:3390
  5. Open the site's address and finish the WordPress installer.

Other PHP apps (Laravel, Symfony, Drupal, WHMCS, Nextcloud …) work the same way. Upload the project into www-data/<site>, then, in Settings next to the site, press Detect: we recognize the app and suggest its web root (public for Laravel and Symfony, web for Drupal with Composer, the app's folder for WordPress, WHMCS or Nextcloud). Files outside the web root (vendor/, storage/, .env, the Nextcloud data, WHMCS's attachments, downloads and templates_c folders) stay reachable for the app, but not from the browser.

5. Node.js and Python apps

Upload your app into www-data/<site>/app. It must listen on the port in the PORT environment variable (8080 inside the container) on all interfaces (0.0.0.0), not only on localhost. The web server and the certificate are in front of it; you do not open any port yourself.

How the app is started, in this order:

  • Node.js: an executable start.sh in app/; otherwise npm start from package.json (dependencies are installed with npm ci --omit=dev when node_modules is missing); otherwise server.js, index.js, app.js or main.js.
  • Python: an executable start.sh; otherwise asgi.py (served by uvicorn workers in gunicorn); otherwise app.py with an app object or wsgi.py with application (gunicorn). requirements.txt is installed into a virtual environment, and installed again at start when the file has changed.

After uploading a new version, press Restart next to the site. Until an app is found, the site shows a placeholder page that says what is missing.

6. Files and logs

Files in Account → Hosting is a file manager for www-data (your sites), logs (the logs) and restore (restored copies):

  • browse folders, create, rename, move and delete (deleting asks you to type the name to confirm);
  • upload files of any size your plan allows (large files are sent in chunks) and extract .zip, .tar.gz, .tar.bz2 or .tar.xz archives, optionally emptying the destination folder first;
  • edit text files (up to 1 MB) right in the browser;
  • download a file or a whole folder as .zip: the archive is prepared in the background and appears under Operations and downloads, where it stays for 24 hours.

Each site's logs are in logs/<site>/: nginx/ or apache/ (access.log, error.log) and php/ (or node/, python/) for the app's output. You also see them in Settings → Logs, next to the site, and over SFTP.

Also from Settings you can stop and start a site (while it is stopped, visitors see an “unavailable” page), download its archive or restore it from an archive you upload.

7. Databases

  • MariaDB and PostgreSQL. All your databases of the same type share one database user, named like your account. Its password is shown once, at the first database of that type; New password creates another one for all databases of that type (update your sites afterwards).
  • From your websites (inside the containers) the database host is mlw-db, port 3390 for MariaDB and 5490 for PostgreSQL.
  • Over SSH (from Standard), the same databases are at 127.0.0.1, same ports, for example mysql -h 127.0.0.1 -P 3390 -u <user> -p or psql -h 127.0.0.1 -p 5490 -U <user> <user>_db.
  • The web editor (Adminer, for MariaDB and PostgreSQL) opens with Editor next to the database: you are signed in directly, with a temporary login valid for 4 hours, without the database password, and you see only your account's databases.
  • Export (.sql.gz) and import (.sql, .sql.gz; for PostgreSQL also .dump from pg_dump -Fc) from the same list. The import runs with your account's rights: tables with the same names are replaced, so export the database first if you want a copy.
  • The databases are not reachable directly from the internet.

8. SFTP and SSH

The server, port (22) and user name are in Account → Hosting → SFTP / SSH.

  • Start: SFTP with a password. Create a new password shows it once; the old one stops working.
  • Standard, Pro and Business: SFTP and SSH with your SSH keys (password login is off). Add your public key (ssh-ed25519, ssh-rsa or ecdsa-…) and connect with the command shown there. Git is available over SSH.

Your home folder holds www-data (your sites), logs (your sites' logs) and restore (restored copies). Keep secrets out of the web root.

9. E-mail

  1. Add the domain first; mailboxes can be created once its mail setup is done (the domain page shows the step).
  2. In E-mail, create a mailbox and choose its space. The password is shown once.
  3. Most mail apps set themselves up from the address (autoconfig). If yours asks, the incoming (IMAP, port 993) and outgoing (SMTP submission, port 587) server is the mail host in your domain's MX record, listed in the DNS records table.

Sending from your sites: send through SMTP on port 587 with one of your mailboxes (in WordPress, an SMTP plugin). Direct sending on port 25 is blocked for all hosting accounts.

10. Backups and restore

  • A backup of your files and databases is made every night and kept according to your plan: Start 7 days, Standard 14 days, Pro 14 daily + 4 weekly, Business 30 daily + 12 monthly. The extended backup option gives you the next plan's retention (Start → 14 days, Standard → 14 daily + 4 weekly, Pro → 30 daily + 12 monthly).
  • Backups are encrypted and stored on a separate disk in the same server, not in a second location. Keep your own copy of anything important.
  • Restore yourself in Backups: choose the copy and what to restore (the whole account, one website or one database). Files are copied by default into a new folder, restore/, so your current files stay as they are; tick Replace the current files to restore in place. A database restore replaces the database with its copy.
  • Backup now starts a backup outside the schedule (up to 3 times a day), for example before an update.
  • Download a site, all sites or a database from a backup: the file appears under Operations and downloads.
  • Restore by our team: describe what to restore and from when. The first restore each month is free; the next ones cost €10 each.

11. Limits and usage

The account page shows the disk, files (inodes), CPU and memory in use against your plan. CPU and memory are hard limits: an app that needs more is slowed down or stopped, never billed extra. The number of websites, databases and mailboxes follows your plan; on Business they are unlimited within fair use.

Over the disk or files limit: we e-mail you, and you have 7 days to free up space or add disk (the +10 GB option). After 7 days, uploads are blocked (SFTP becomes read-only) until the account is back under the limit; your websites keep running. When usage drops below the limit, uploads are allowed again automatically, at the next daily check.

12. Change the plan or cancel

  • Change plan or options in Account → Hosting: you see the price first. When you upgrade or add options, you pay only the difference for the rest of the current period (prorated) and the new limits apply within a minute. A smaller plan is accepted only if your sites, databases, mailboxes and disk fit in it.
  • Cancel from the same page. The account stays active until the end of the paid period, then it is suspended and deleted 30 days later; the final backup is kept for those 30 days. You can undo the cancellation before the period ends.
  • Failed payment: your sites keep running during the 7-day grace period while the card is retried. If the payment still fails, the account is suspended (not deleted) and starts again as soon as the invoice is paid.
  • Money back: within 30 days of your first payment, ask for a refund from your account (ticket) or at contact@medialab.works; the account is then closed.

Questions? See the frequently asked questions or contact us.