HOSTER

Create the first administrator account to get started.

HOSTER

Sign in to manage your sites.

or
HOSTER

Enter the 6-digit code from your authenticator app.

Lost your device? Enter a recovery code instead.

HOSTER
  • Dashboard
  • Sites
  • Site Explorer
  • Analytics
  • Logs
  • Settings
  • About

Dashboard

Traffic

Top Sites

Bandwidth

Countries

Status Codes

Blocked Requests

Sites

Site Explorer

Select a site to view actions.
No site selected Open ↗
Preview appears here.

Create Blank Site

Creates an empty site with a placeholder page. Open Settings on the new site to enable MCP access so AI tools can populate it.

Deploy New Site

Deploying...

Analytics

Top Paths

Browsers

Recent Requests

Time Method Path Status Browser IP Country Speed

Settings

Change Password

Two-Factor Authentication

Passkeys

Sign in with Touch ID, Windows Hello, or a security key — no password or authenticator code. A passkey only works on the hostname it was created on, so register one for each address you use to reach this panel. Your password stays active as a fallback.

Users

Administrators manage the whole platform: every site, these Settings, users, MCP/OAuth, and backups. There can be as many as you like; the last one can never be demoted or deleted. Site users sign in the same way but see only the sites assigned to them and can't create or delete sites. Every account manages its own password, 2FA, and passkeys under Account. Changes that touch an administrator account ask for your password again.

Add an account

Sites this user may manage:

MCP Access Tokens

Static bearer tokens for CLI tools (Claude Code, Cursor) that don't need an interactive login. Tokens can be scoped to a single site and set to expire.

MCP Activity Log

Recent MCP tool calls across all tokens.

OAuth Connections

Chat clients (Claude.ai, ChatGPT, etc.) connect via OAuth. Each MCP-enabled site is a separate connector — paste its URL into your chat client's "Add MCP server" dialog and complete the consent flow.

Country Restrictions

Only serve hosted sites to visitors from the countries you pick; everyone else (and any visitor whose country can't be determined) gets a 403. Leave the list empty to allow the whole world. The admin panel, MCP, and OAuth endpoints are never geo-blocked.

All countries allowed

IP Auto-Blocking

Automatically block IP addresses that accumulate too many denied requests. Uses the real client IP from Cloudflare headers.

Configuration Backup

Save your entire hoster configuration (settings, sites, versions) to a file for migration or backup. Optionally protect with a password.

Preparing backup...
Loading backup...

Repair Sites

Walk every site in the database and recreate its _current symlink from the recorded active version. Use this if sites are returning 404s after a restore or manual file changes. Safe to run anytime — it's a no-op on healthy sites.

CMS Library

JavaScript and CSS served at /_cms/cms.js and /_cms/cms.css for every CMS-enabled site. The same lib serves every host — canonical, host-aliased, or path-prefixed. Edits take effect on the next request (clients revalidate via ETag).

Confirm Configuration Load

This will replace all current settings, sites, and data.

This action cannot be undone. You may want to save your current configuration first.

About

HOSTER

Lightweight Web Hosting Platform

Hoster is a self-hosted web hosting platform that turns any device into a web server. Upload a ZIP file and your site is live — with versioning, SPA support, analytics, and free HTTPS via Cloudflare Tunnel.

No cloud providers, no monthly fees, no vendor lock-in. Just your code, your device, your domain.

Created by David Geller

github.com/davidgeller/hoster

MIT License