Custom Directives
Custom Directives lets you extend Nginx with your own configuration, safely. Add a snippet (security headers, a rate limit, a bot block), and Panelica validates it in a sandbox, applies it, checks the live server still answers, and rolls the whole thing back the instant anything goes wrong. You genuinely cannot break the web server from here.
Web Server → Custom Directiveshttps://YOUR-SERVER-IP:8443/webserver/directives (ROOT only)add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
What it does
Each snippet is a named block of Nginx directives that applies server-wide (across all your sites), added into Nginx's global http context. Because of that context, this is the place for cross-site rules: response headers, rate-limit zones, IP allowlists, bot maps, caching hints. Per-domain rules (a redirect on one site) belong in that domain's own editor; this page is the operator's global toolkit. Snippets can be toggled off without deleting them, and a second Master tab lets you edit the entire nginx.conf by hand behind a responsibility confirmation.
Ready-made templates
You do not have to write Nginx from scratch. Eleven curated templates fill the editor with tested, ready blocks:
| Template | What it adds |
|---|---|
| HSTS | Force HTTPS via the Strict-Transport-Security header (active on its own) |
| Security headers | X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy (active on its own) |
| Hide server tokens | Remove the Nginx version from responses (active on its own) |
| Cloudflare real IP | Restore the visitor's real IP behind Cloudflare (active on its own) |
| Open file cache | Cache open file handles for speed (active on its own) |
| Block AI crawlers | Define a map flagging GPTBot, ClaudeBot and other AI scrapers |
| Block bad bots | Define a map flagging known scanners (sqlmap, nikto and friends) |
| Block sensitive files | Define a map flagging .git, .env, .sql and similar |
| Login rate limit | Declare a rate-limit zone for login attempts |
| DDoS protection | Declare connection and request-rate zones |
| Referer spam block | Define a map flagging known referer-spam domains |
Pick one, tweak it in the editor, validate, save. There is a Validate button that runs the syntax check without applying anything.
map variable or a rate-limit zone in the global context, which you then reference in a site's own configuration (for example if ($panelica_bad_bot) { return 444; }) to actually enforce it. Adding the snippet is step one; wiring the variable into your vhost is step two.Why you cannot break the server
This is the whole point of the feature, so here is the exact chain every save goes through.
nginx -t, never touching the live config; if it fails, the save stops before anything changes. Only then is the live config backed up, the snippet written atomically, and the whole server re-tested with nginx -t. If that passes, Nginx reloads, and Panelica makes a real HTTP request to confirm the site still answers. If any of the final steps (test, reload, health check) fails, the change is rolled back from the backup and reloaded to the last-good state. The live web server is always left working.server or location block (like proxy_pass) simply fail the http-context syntax test and are refused, which naturally blocks most misuse. Every snippet keeps timestamped backups you can restore from.Access
Strictly ROOT, enforced at the backend for the whole Web Server section, not just hidden in the UI. Snippet names are tightly validated to prevent path tricks, and the Master (full nginx.conf) tab adds two confirmation gates, a responsibility acknowledgement and a save confirmation, before it will let you edit the raw file. See roles and permissions.