Configuration
Most options are managed in the browser under Admin → Settings. A few server-level values live in config/config.php, which the installer creates.
Admin settings
| Section | What you can change |
|---|---|
| General | Site name, page title, meta description, default time zone |
| Branding | Logos, favicon, colors, light/dark appearance, social preview, footer and copyright (see Branding) |
| Links | Default domain, default redirect type, random alias length and characters, custom alias length, reserved aliases, duplicate destination policy, bulk row limit |
| Analytics | Retention period, IP anonymization, storing IP addresses and user agents, counting bots, GeoLite2 database upload |
| Registration | Open or closed registration, required email verification |
Sender name and address, PHP mail() or SMTP (host, port, encryption, username, password), test email | |
| Security | Session lifetime, login lockout, minimum password length, HSTS, blocking private destination addresses, rate limits |
| API & webhooks | Enable or disable the API and webhooks, key and webhook limits, delivery attempts and timeout |
| Domains | Allow users to add custom domains, domains per user, require SSL, re-check interval, failure threshold, DNS resolvers |
| Maintenance | Maintenance mode, message, keep short links working during maintenance |
Changes apply immediately and are recorded in the audit log.
Email is used for password resets, email verification and notifications.
- PHP mail() works on most cPanel hosts with no setup. Use a sender address on your own domain to avoid spam folders.
- SMTP is more reliable. In cPanel, create a mailbox under Email Accounts and use its SMTP settings (usually
mail.example.com, port465with SSL or587with TLS).
Use Send test email in Admin → Settings → Email to confirm delivery. The SMTP password is stored encrypted.
Country and city analytics (GeoLite2)
Geographic analytics use a local MaxMind GeoLite2 database. No visitor data is sent to a third party.
- Create a free account at maxmind.com.
- Download GeoLite2 City (or GeoLite2 Country) in the
.mmdbformat. - Upload the file in Admin → Settings → Analytics.
Until a database is uploaded, location shows as Unknown. MaxMind updates the files regularly; upload a fresh copy every few weeks.
config/config.php
This file is generated by the installer. It is never served to browsers. Edit it only if you move the site or need an advanced option.
| Key | Meaning |
|---|---|
db.host, db.port, db.name, db.user, db.pass | Database connection |
app.url | Base URL of the installation, for example https://example.com |
app.key | Secret key used for encryption and signatures. Never change or share it |
app.timezone | Default time zone |
security.trusted_proxies | IP addresses or CIDR ranges of reverse proxies/CDNs whose X-Forwarded-For and X-Forwarded-Proto headers are trusted |
security.allow_private_network | false by default. Allows private IPs for webhooks and domain checks (intranet installs only) |
Important: app.key encrypts stored secrets (SMTP password, webhook secrets) and signs the audit log. If it changes, those values can no longer be read. Backups include it so a restore keeps everything working.
Moving to a new domain
- Update
app.urlinconfig/config.php. - The main domain changes with it. Existing short links on the main domain now use the new host.
- Custom short domains are not affected.
Behind a CDN or proxy
If you use Cloudflare or another proxy, add its IP ranges to security.trusted_proxies so visitor IPs and HTTPS are detected correctly. Without it, analytics see the proxy's address.