Every setting of a site goes through the same request, PATCH /api/sites/<id>: the panel's tabs use it, and so can you. Every field with its range is in the site settings reference.

From the site's tabs

Open Sites, pick the site, then the tab:

Tab	What you change	Button
Overview, card Domains and folder	Aliases (administrators only), Public folder; for a reverse proxy, Upstream URL instead of the folder (administrators only)	Apply
Cache	Performance profile, Page cache, Lifetime (TTL) in seconds (0 = the profile's)	Apply
PHP (under More)	PHP version, Memory limit, Max upload size, Max execution time; in the Workers card, PHP workers (0 = automatic)	Apply
SSL	the HSTS switch	—
WordPress	the Object cache switch	—

Each change starts the Site settings task. The server rewrites the site's configuration and reloads it; if that fails, the panel puts the previous values back and the task shows the error.

WarningHSTS

With HSTS on, for a year browsers refuse any non-HTTPS connection to the domain, even if the certificate stops working. The panel turns it on only when the site has a certificate valid for at least another 14 days.

With the API

From a script, send the same PATCH request with an API token. On the server, as root:

bash

curl --unix-socket /run/cloudground/api.sock http://localhost/api/sites/<id> \
  -X PATCH \
  -H "Authorization: Bearer $CLOUDGROUND_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"php_workers": 4, "memory_limit_mb": 256}'

• <id> is the site's number: it is in the address of its page in the panel (/sites/<id>) and in the output of cgctl sites list.
• CLOUDGROUND_TOKEN is an API token: see API tokens and cgctl.
• Send only the fields you want to change. A request naming no field is refused.

The answer is 202 with the site after the change and the task it started. When there is something to know, for example that the certificate no longer covers every alias, the answer also carries warnings.

If the request is refused

• 400 with fields: a value is out of range. fields names each wrong field with its message, and nothing changed.
• 400 on the PHP budget: workers × memory limit exceeds the server's memory. Lower one of the two. An administrator can force it with "allow_over_budget": true, or from the PHP tab with Apply beyond the budget.
• 403: only an administrator changes aliases and proxy_upstream.
• 409 on hsts: the site has no certificate, or it expires within 14 days. Issue it first.

Next step

Add an alias and its certificate.