How shared hosting works at Candor

What actually happens when a visitor hits your site — the servers, the isolation model, the exact per-plan numbers, and who manages what.

Most hosts describe their platform with adjectives. This page describes ours with the actual architecture, because if you’re trusting us with your site you deserve to know how it runs. The numbers below come from the same configuration files that provision your account — when they change, this page changes.

What happens when a visitor hits your site

The request lands on OpenLiteSpeed, the web server at the edge. HTTPS is enforced — plain-http requests redirect.
A web-application firewall running the OWASP Core Rule Set inspects the traffic before your site ever sees it.
Server-side caching (included on every plan) answers repeat requests without waking your application.
Anything that needs real work is handed to your site’s own container — PHP runs there, inside your resource allocation, and nowhere else.

That last step is the important one. Every account runs in its own isolated container with its own CPU, memory, and I/O allocation. A neighbor’s traffic spike burns their allocation, not yours.

Guarantees, not caps

The per-plan resource numbers are enforced by Linux cgroups — a kernel mechanism, not a policy document. That cuts both ways, and both ways are good for you: you can’t exceed your allocation and degrade someone else’s site, and nobody can degrade yours. The CPU and memory figures are guarantees — yours even when the server is busy — not caps-in-disguise on an oversold machine.

These are the exact numbers, straight from the provisioning configuration:

	Solo	Studio	Org
Websites	1	5 (+5 staging)	15 (+15 staging)
Storage (NVMe)	10 GB	30 GB	75 GB
Transfer	not metered	not metered	not metered
Mailboxes	10	50	200
MySQL databases	2	10	30
Subdomains	10	25	50
Domain aliases	5	15	30
FTP users	2	10	30
Guaranteed CPU	1 vCPU	2 vCPU	2 vCPU
Guaranteed memory	1 GB	2 GB	2 GB
Disk IOPS	1,024	2,048	2,048
I/O bandwidth	20 MB/s	30 MB/s	30 MB/s
Processes	20	40	40
Inodes (files)	250,000	500,000	500,000
Site cloning	—	✓	✓

“Not metered” is not “unlimited” — we don’t count your transfer or charge overages, and the Acceptable Use Policy governs genuine abuse. That’s what every “unlimited bandwidth” host actually means; we just say it plainly.

The hardware underneath

Your container runs on dedicated OVHcloud servers in the United States with NVMe storage — real machines we administer ourselves, not resold cloud instances. SSH access, cron jobs, server-side caching, a DNS editor, and one-click phpMyAdmin are included on every plan.

SSL, automatically

Every site and domain alias gets a free Let’s Encrypt certificate, issued when the site is created and renewed automatically before it expires. There is nothing to buy, install, or remember.

What you manage, and what we manage

You manage your hosting from the customer portal at my.candorhost.com — no ticket required for any of it. Your service page there has tabs for:

Overview and Usage & Resources — live disk, resource usage, and your limits
Email Accounts — create and manage mailboxes
Domains and DNS Records — subdomains, aliases, and a full zone editor
FTP Accounts — upload logins and SFTP
Databases — MySQL databases and users, with one-click phpMyAdmin
Backups — take, restore, or browse snapshots
WordPress — one-click login and updates
PHP Version — switch per site, PHP 7.4 through 8.4 (8.3 is the default)
Cron Jobs — view, add, and remove scheduled tasks
Change Password — your control-panel login (FTP passwords are set per-account under FTP Accounts)

One click also opens the full control panel, signed in, for anything deeper — managing sites, mail, and DNS included.

We manage everything below your container: the physical servers and the kernel, security patching and automatic updates, the WAF, daily malware scanning with automatic quarantine, host-based intrusion detection, brute-force protection on every login surface (SSH, mail, FTP, web), and the backup infrastructure. Details are on the Security page.

Email that reaches inboxes

Outbound mail goes through a dedicated IP address used only by Candor Host customers, so its sending reputation isn’t shared with strangers. SPF and DKIM records are configured automatically for every domain, and we monitor deliverability continuously from the outside. More in the email guide.

Backups on separate hardware

Automatic backups are included on every plan — never an upsell — and stored on separate backup infrastructure, a different physical server than the one running your site, so one machine failing can’t take out both. From the Backups tab you can take an on-demand snapshot or restore a previous one yourself, in one click. A restore overwrites your current files and databases with the backed-up versions, and the portal warns you before it does. Full walkthrough: backups guide.

You can watch all of this

Our status page is public at status.candorhost.com — uptime checks every 60 seconds on every customer-facing service, timestamped, visible before you have to ask. The uptime commitment is 99.9% monthly, with real service credits when we miss it; the math is in the SLA. Automated monitoring runs around the clock; when you need a human, Candid Support publishes the response times — a site-down ticket gets a first response within 1 hour during business hours (Mon–Fri, 9am–6pm ET), everything else within one business day.

Go deeper

Getting started — from signup to a live site
WordPress · Email · Databases · DNS
FTP, SSH & files · Cron jobs · PHP versions & limits
Backups · Migrations — moving an existing site here is free

Questions the docs don’t answer? Ask us — a straight question gets a straight answer.