What we ship, as we ship it.

The customer API grows up a little for scripts, CI and AI agents. Every list endpoint now pages with ?limit= (up to 100) and ?cursor=, answering with meta.next_cursor and meta.has_more beside the array you already read — a site with hundreds of deploys or backups is no longer cut off at 20. Every error, from a bad token to a full rate bucket, has the same body: error.type to branch on, error.message to read, error.details per field on validation, and error.request_id, which every response also carries as X-Request-Id so support can find your exact request.

Actions that queue work — deploy, backup, restore, staging, cron and DNS writes — accept an Idempotency-Key header: retry a timed-out call with the same key within 24 hours and you get the stored first answer back instead of a second deploy. The OpenAPI spec (version 1.3) now carries full response schemas, the failure responses, the rate-limit headers and a written deprecation policy: breaking changes only under /api/v2. On the API tokens page each token now shows the address it was last used from, and points to Security → Connected apps for OAuth-connected assistants.

Three new pages answer the questions people put to search engines and AI assistants before they contact us. The apps page (/apps) renders the runtime matrix and every app from the same catalogue the dashboard uses, with its real status — available, in progress, planned, or set up on a Business plan — and lists the available ones as structured data. The comparison page (/compare) sets veldhost beside budget shared hosting, a local traditional host and a hyperscaler or DIY VPS on the questions that matter later — who operates it, the data path, backups and restore, security, SLA, support, price band and exit — and says plainly when not to choose us. The Baltics page (/for/baltics) gives businesses in Latvia, Lithuania and Estonia the measured latency from Falkenstein to Riga, EU invoicing with VAT reverse charge, which Baltic domains we register, GDPR and NIS2 alignment, the support languages, and what we do not have.

Home, plans, the apps page and the Baltics page now emit FAQPage structured data from the same FAQ arrays they display; the "Runs on" strip on the platform page and the runtime section of llms.txt are generated from the catalogue, so they change when a status does. All three pages have Dutch versions.

Monitoring → Audit log in veldhost Manage now lists every sign-in, security change, purchase, portal action and API write recorded under your account — with the time, the address it came from, and the credential that made it (you, a named API token, or a connected app). Filter by event family and date, load more as you go, and export the filtered log as CSV or JSON: timestamps are ISO-8601 with timezone, exports cover up to 10,000 rows and a date range you choose.

The same log is available to your own tooling as GET /api/v1/account/audit?since=&until=&cursor= on the read scope, alongside a new GET /api/v1/account/invoices?cursor= that returns the invoice list the billing page shows. Both are documented in the OpenAPI description.

Account → Compliance shows every document that governs your account — Terms, Privacy Policy, DPA, sub-processor register, SLA and AUP — with the version in force today and the version you accepted, when, and by whom. Acceptance at checkout is recorded automatically; when we change a document you see a notice on your dashboard until you re-accept, and the history stays append-only. From the same page you can request a countersigned DPA (it lands with legal@ together with your account details) and download a plain-text acceptance record for your audit file.

On Billing, a new "Invoice details" form takes a purchase-order reference, a cost centre and a footer note; they are saved on your account and pushed to your invoice provider so they print on every invoice from now on.

Every DNS zone in veldhost Manage now has a Download zone file button that gives you a standard BIND zone file — every record exactly as our nameservers serve it, ready for any other DNS provider or for your own backups. Below the records you can paste or upload a zone file to import: you see a preview of what would be added, updated, left alone or refused (with the reason per line) before anything is written, and an import never deletes a record. The same is available over the API as GET /dns/{zone}/export and POST /dns/{zone}/import with a dry run by default.

On the Account page, Export everything prepares one zip with all your zone files, a JSON of your registered domains and the list of your restore points with a download link for each, behind a signed link that expires after 24 hours. Site archives are not bundled — each restore point already has its own download.

Support now works in Latvian as well as English and Dutch — the founder speaks it — and the Baltics page, the contact page and the vendor profile say so. EcoTrend, a Latvian drinks brand, has agreed to be named: its web shop at zavetaji.lv runs on veldhost.

A pre-launch review of every marketing page found the same facts stated differently depending on when a page was written. The site now says one thing everywhere: backups are weekly on every plan and nightly with the daily add-on, with every backup replicated nightly to a second region; production runs in Falkenstein and Nuremberg, both in Germany, on servers we rent from Hetzner and operate ourselves; health checks run every five minutes. The acceptable-use policy now names the right abuse mailbox, the legal texts no longer carry an internal milestone codename, and the plans page gained a plain-language billing FAQ. During the public testing phase the header and plan buttons say when ordering opens instead of leading into a closed checkout.

Under the hood every page now carries a canonical URL, Open Graph tags and language alternates where a Dutch version exists, blog posts publish their article schema, the sitemap lists every help article, and the Dutch plans page is fully translated.

Bringing a domain you already own is now the first door, not the third. Under Domains → Use a domain you already own, a five-step wizard reads your domain's live records off the public internet (apex, www, the common subdomains, MX, SPF, DMARC, DKIM, CAA, SRV), shows you the zone we would serve with a reason on every line, and writes it into your veldhost DNS through the same rules as the editor — before anything changes. If you pick a site, its records are laid over the top; if the domain has a mailbox here, the mail records come with it, with your SPF merged rather than replaced.

Then it tells you exactly where the nameserver setting is at your registrar — GoDaddy, Namecheap, TransIP, Hostnet, Mijndomein, Versio, one.com, IONOS, OVH, Openprovider and more, with a general guide for the rest — warns you first when DNSSEC is on at your current provider, and watches for the change to land: every ten minutes for three days, with an email the moment it does. The domain stays registered where it was; nothing here touches your registrar. Registering a new domain and transferring one in are still there, and now say plainly that they are optional.

The same probe is available as a dry run over the API (POST /api/v1/dns/zones/probe, dns scope) and to AI assistants as the probe_domain_dns MCP tool. Documented under Docs → Move your DNS to veldhost.

Five Node.js apps join the "What are you building?" picker as one-click installs: Ghost (publishing and newsletters, on MariaDB), Strapi and Directus (headless CMS on PostgreSQL), n8n (workflow automation on PostgreSQL, running on Node.js 24) and Umami (privacy-friendly analytics on PostgreSQL). Each is installed from a pinned release into your own container, started as a systemd service on the Node.js runtime, and your first administrator or owner account is created for you — the sign-in address and password appear on your site page for seven days, with a note on how to update.

Picking Next.js, Nuxt, SvelteKit or Astro (Node adapter) now gives you the framework's own minimal starter, built and running on your address, instead of a placeholder page — connect your repository on the Deploy tab and every push replaces it. Ghost, Strapi, Directus and n8n need the memory of a Pro plan (1 GB); Umami and the starters run on Starter. Every installer was exercised end to end on our staging sandbox before it was marked available; the docs carry a "first steps" guide for each app.

veldhost now runs JavaScript apps. Pick JavaScript app when you create a site and you get a container with Node.js 22 (or 24) behind nginx, run as a supervised system service: connect a Git repository and we run your install and build commands, install production dependencies, start the app on the PORT we hand it and wait for it to answer before calling the deploy done. Files in public/ are served by nginx directly; everything else — including WebSockets — goes to your app.

The site page gets a Node.js card in place of the PHP one: switch between Node 22 and 24, and set a start command when your framework needs one (node build for SvelteKit, node .output/server/index.mjs for Nuxt). Environment variables, the managed PostgreSQL/MariaDB database and Build & deploy work exactly as for PHP sites, and the Logs tab shows your app's own output. Next.js, Nuxt, SvelteKit and Express are marked available in the app catalogue; one-click installs for Ghost, Strapi, Directus, n8n and Umami follow. Read Node.js apps for the details.

"What are you building?" now shows the whole app catalogue, grouped into shops, websites, business apps, frameworks and bring-your-own, with an honest status on every entry: what you can order today, what is still being validated, what is planned, and what we set up per order on a Business plan. Four new apps install themselves the moment your site is provisioned, the way WordPress already did:

• WooCommerce — WordPress with WooCommerce and the Storefront theme, shop pages created, prices in EUR including VAT, no demo products.
• PrestaShop 9 — the current stable release with an empty catalogue and a randomly named back office.
• Nextcloud — data folder outside the web root, APCu and Valkey caching, real cron every five minutes, CalDAV/CardDAV discovery.
• Matomo — your site registered, IP anonymisation and Do-Not-Track on, hourly archiving from cron.

Every install is pinned to a release we verified against the project's published checksum or PGP signature, gets its own database in your container, nginx rules from the project's own documentation, and reports its admin address, version and a generated admin password to the site page's new App card, where the password stays readable for seven days. Apps that need more memory than a plan offers say so in the picker and are refused server-side — Nextcloud and PrestaShop start at Pro. The API and the MCP quote_new_site tool accept an app key, validated against the same catalogue. Each shipped app has its own guide under Docs → Publishing.

Every destructive action in veldhost Manage now asks before it acts — removing a scheduled task or redirect, cancelling a team invitation, turning off SSH or password login, disconnecting GitHub — and closing your account asks you to type your email address first, the way deleting a site already asks for its name.

Times across the portal (restore points, migration timelines, SSH time limits, invitation and domain expiry dates) are shown in your own timezone in one format, with the exact UTC moment on hover. Confirmation and error messages appear in one place at the top of every page instead of in nine slightly different banners, empty lists say what to do next, and the site page's tab bar now works properly with screen readers and keyboard focus.

The Security page in veldhost Manage now lists every browser signed in to your account, with device, address and last activity, and lets you sign out any one of them or all others at once. Below it, every AI assistant or other application you authorised over OAuth is listed with its scopes and can be disconnected in one click; personal API tokens stay on their own page.

Two smaller fixes: a second click on Deploy while a deploy is already running no longer queues a phantom second deploy, and the dark theme no longer renders error banners and "Delete" links in light pink.

The platform status page at veldhost.eu/status, and every public per-site status page, now has an Atom feed (/status/feed.atom, /status/<site>/feed.atom) with one entry per incident update, and an email subscription box. Subscribing is double opt-in — we send a confirmation link first — and once confirmed you get an email when an incident is opened and when it is resolved. Every email carries a one-click unsubscribe link.

veldhost Manage now has account-level roles. The new Team page (Account › Team) lists everyone on your account, lets you invite colleagues by email as admin, billing, developer or viewer, change their role or remove them, and shows who has two-factor sign-in switched on. An owner does everything; an admin manages every site and the team but never sees billing or deletes the account; billing sees the sites and handles invoices, the card and the plan; a developer deploys and changes settings and backups; a viewer only looks.

Owners and admins can also require two-factor sign-in for every member of the account — anyone without an authenticator app or passkey is sent to the Security page to set one up before they can open a site.

Per-site invites keep working exactly as before for outside collaborators, and every site you can reach — your own, your account's, or one shared with you — now appears on the dashboard and on the Monitoring page alike.

veldhost Manage can now push what happens to your sites to your own systems. Under Account → Integrations, add a webhook URL and pick the events you want: deploys succeeding or failing, backups and restores finishing, a site going down and coming back, incidents opening and resolving, a domain approaching expiry, and invoices being paid or failing. Every delivery is a signed JSON POST (X-Veldhost-Signature, HMAC-SHA256 with a secret shown once), retried three times, and listed in a per-endpoint delivery log with the response code and any error.

The same pipeline feeds chat: choose Slack or Microsoft Teams as the kind, paste an incoming-webhook URL, and events arrive as readable messages in the channel. Endpoints that fail twenty events in a row are paused and you get an email; a "Send test event" button checks a new one in seconds. Everything is also available over the API (/api/v1/webhooks, manage scope) and documented under Docs → Webhooks, Slack and Teams.

Every WordPress and WooCommerce site now comes with an admin gate: an extra browser login (HTTP basic auth) in front of /wp-admin/ and /wp-login.php, checked at our edge before the request reaches WordPress. Automated scripts never get to your login page or your plugins; visitors, admin-ajax.php and the scheduled tasks are untouched. New sites get a generated gate login next to the WordPress one; the Settings tab of the site page shows it (with an audit-logged reveal) and lets you change the username or password, regenerate it, or turn the gate off. The App card on the Overview tab points to it too.

Two things are blocked on every WordPress site regardless of the gate: the /wp-json/batch/v1 REST endpoint, which lets one request carry many and was recently exploited in the wild, and /xmlrpc.php, the old remote-publishing interface that mostly serves password guessing today. /wp-login.php is also rate-limited per address underneath the gate.

Sites on their own domain can log in to their admin again. The edge used to treat /wp-admin and /wp-login.php on any host outside the *.apps.veldhost.eu zone as a probe and refuse it, which locked customers with a custom domain out of their own dashboard. That rule now applies only to our own platform hosts; customer sites are protected per site instead. Docs: WordPress: your first steps, Security at veldhost.

The DPA sub-processor register is now at v1.1. Cloudflare, Inc. has been removed: veldhost.eu and the Manage portal have been served directly from our own EU infrastructure and our own authoritative nameservers since July 2026, so no edge, CDN or third-party DNS provider sits in front of any veldhost property. The privacy policy and the sovereignty page say the same thing, and the register now carries a change log so an evaluator can see what changed and when.

Evaluating veldhost for a tender, an RFP or a supplier due-diligence file no longer means collecting facts from six pages. The new trust centre gathers legal identity, EU data residency, security controls, sub-processors, contract terms, continuity and exit in one place — every line linked to the published document it is quoted from, and the things we do not have (ISO 27001, SOC 2, a published pen test) stated just as plainly.

It ships with a one-page vendor profile that also comes as JSON and plain text for supplier registers, and a pre-answered security questionnaire organised the way SIG-Lite and CAIQ questionnaires are. The site's structured data now carries the legal name, KvK and VAT identifiers, registered office and role-specific contacts, so vendor-research tools can read them directly.

SSH/SFTP access to your site can now be enabled for a window you choose — an hour, a day, a week, or until you turn it off — and switches itself off when the time is up. For quick sessions without key setup there's a temporary password login: one hour by default, 24 hours with an explicit risk acknowledgment, revoked automatically at expiry.

The platform now has a public status page with live component health and uptime history measured every five minutes, and a security page documenting our infrastructure, encryption and account-security posture — including what we don't have yet.

Behind the scenes, every site backup and the platform databases are now replicated nightly to storage in a second region, physically separate from the servers that run customer sites.

AI assistants can now operate your hosting directly: a built-in MCP server with OAuth sign-in lets tools like Claude check site health, read logs, manage DNS and deploy on your behalf — anything that spends money or deletes data always hands back to you. The same capabilities are available over a documented REST API with scoped tokens, plus live log streaming and monthly traffic figures in the dashboard.

Deploying from GitHub is now a two-click flow: connect the veldhost GitHub App, pick a repository (private ones included), and every push deploys with history and one-click rollback. Upload limits were also raised fleet-wide to 64 MB for file and media uploads.

Every site now ships with opcode caching, an in-memory object cache (wired automatically into WordPress), long-lived asset caching, and a short page micro-cache for WordPress front pages. No configuration needed — existing sites were upgraded in place.

Domains are now registered under their real owner's verified contact details, with email confirmation, EU VAT validation for businesses and identity verification for individuals — meeting registry requirements and making sure your domain is legally yours.

Transfer a domain in with just its auth code — pre-checks, payment and progress tracking included — and transfer out whenever you want: unlocking and revealing the auth code is self-service, always. DNSSEC signing on our EU nameservers is now self-service too.

A big safety release: one-click restore from daily backups (a full production-site restore completes in under a minute), private staging copies of your site, per-site team members with their own logins, scheduled tasks, deploy history with rollback, and a free assisted migration service for moving existing sites over.

The platform moves to its permanent home: veldhost.eu, with the dashboard at manage.veldhost.eu and our own European nameservers at ns1/ns2.veldhost.eu. One brand, one promise — your site, looked after, with data in the EU.