Best Practices

Best Practices gives providers and customers a safe operating model for running SHM in production hosting environments.

Where to find it: Documentation > Hosting Manager > Best Practices.

Available to: Anyone reading the public documentation. The related SHM action still follows the role stated on its page.

What this page does

Best Practices gives providers and customers a safe operating model for running SHM in production hosting environments.

Before you start

Examples use placeholder accounts, domains, addresses, and credentials. Replace them deliberately, and never paste passwords, API keys, tokens, or private keys into tickets or shared notes.

Why use it — and when not to

Use Best Practices to understand or plan the supported workflow. Do not treat an example as authorization or as proof of the current state on a particular SHM server.

Security

• Use root only for platform-wide administration and emergency recovery.
• Enable strong authentication and 2FA for privileged users where available.
• Restrict API keys by role, account/reseller scope, and source IP whenever possible.
• Use NoLogin or JailShell unless a customer has a documented need for normal shell access.
• Review firewall, ModSecurity, antivirus, audit, and logs as part of regular operations.
• Never paste real secrets into documentation, tickets, AI prompts, screenshots, or sample API requests.

Provisioning And Plans

• Create clear packages before provisioning customers.
• Use feature profiles to keep customer-visible tools aligned with the purchased plan.
• Apply CPU, RAM, process, disk, inode, I/O, IOPS, and mail-rate limits intentionally.
• Use reseller packages to control delegated growth and avoid overselling.
• Validate DNS, SSL, mail, databases, backups, and account health before customer handover.

Operations

• Use dashboards, Resource Usage, Monitor, Disk Usage, Traffic Monitor, and process pages before making performance decisions.
• Collect logs and diagnostics before changing configuration during incidents.
• Prefer the guided SHM module over manual shell work when the module exists.
• For destructive work, confirm backups, retention, ownership, and customer approval.
• After changes, verify the customer-facing website, mail, DNS, SSL, or application behavior directly.

Backups And Recovery

• Use scheduled backups for production accounts and keep retention aligned with customer recovery objectives.
• Store critical backups away from the account they protect when remote backup is available.
• Test restore workflows periodically so recovery is not improvised during an incident.
• Document what each restore will replace before running it.
• Review backup logs after scheduled jobs and after manual restores.

API Integration

• Use only the documented `/shm/api` customer API surface for external integrations.
• Create separate API identities per integration or customer system.
• Rotate keys when staff, customers, source IPs, or integration ownership changes.
• Log method, path, sanitized request, status, and response message for support correlation.
• Use list/context endpoints to discover IDs and usernames before mutating calls.
• Handle validation errors and permission errors explicitly instead of retrying blindly.

Customer Support

• Start every case with account, domain, time, symptom, and recent-change context.
• Use AI Assistant for diagnosis and explanation, but verify final actions in SHM.
• Keep support notes focused on evidence: logs, status, resource pressure, error messages, and actions taken.
• Escalate with sanitized details and avoid exposing customer secrets.

How to use it

1. Identify whether the task is server-wide, reseller-scoped, or limited to one account.
2. Open the page that owns the resource instead of using a nearby page with a similar name.
3. Read the page-specific prerequisites and impact before changing anything.
4. Verify the result in SHM and from the customer-facing service.

Result and next check

Reading this page changes nothing in SHM. Follow the linked workflow only after confirming the role, target, and expected impact.