Object storage (S3)

WebShield provides S3-compatible object storage for backups, media, logs, and application data. Any S3 client works: aws CLI, rclone, s3cmd, and the AWS SDKs.

• Endpoint: https://s3.webshield.pro (path-style addressing: https://s3.webshield.pro/<bucket>/<key>)
• Billing: pay-as-you-go — stored volume (per GB per month) and outbound traffic beyond the free allowance; debited from the account balance once a month. Current prices are on the service page.

Enabling the service

1. Open S3 storage in the control panel (account level).
2. Click Enable storage. The service generates an access key pair.
3. Save the Secret Access Key immediately: it is shown only right after enabling the service or rotating the keys.

Access keys belong to the account and cover all its buckets. Rotate keys issues a new pair; the old one stops working within about a minute.

Buckets

• Bucket names automatically receive your account prefix (for example, u42-): you enter backups, the final bucket is u42-backups. Use the full name in S3 clients.
• Bucket creation opens after the first balance top-up and requires a positive balance (enabling the service and browsing existing buckets are always available).
• When creating a bucket you choose its region: ru-1 (Russia) or eu-1 (Europe). The region determines where the data is durably stored; the region is set at creation and cannot be changed later. The endpoint is the same for all regions.
• A bucket is private by default. A public bucket allows anonymous downloads by direct URL (https://s3.webshield.pro/<bucket>/<key>) — for example, to serve images or files on a website; listing the bucket contents stays private. The type can be switched at any time with the lock/globe button; the change takes effect within about a minute.
• The Files button next to a bucket opens the built-in file manager: browse folders (contents load lazily as you expand them), upload small files, download and delete objects. For bulk transfers and large objects use an S3 client.
• A name may contain lowercase letters, digits, and hyphens (up to 40 characters).
• Buckets are created and deleted only in the control panel. Deleting a non-empty bucket asks for an extra confirmation and removes all objects irreversibly.

Versioning and Object Lock

• Versioning is enabled with a button in the bucket list: every overwrite keeps the previous version of the object, and a delete puts a delete marker instead of erasing data. Versions are available through standard S3 calls (list-object-versions, get-object --version-id; restore by copying the desired version over the current one).
• Object Lock (WORM) protects object versions from deletion and overwrites for a set period: after enabling it, set retention with an S3 client (put-object-retention, GOVERNANCE/COMPLIANCE modes). Suitable for backups that must survive compromised keys. Enabling Object Lock automatically enables versioning.
• Both settings are irreversible (as in AWS S3): versioning and Object Lock cannot be turned off once enabled.
• Old versions occupy billed storage just like regular objects. There is no automatic cleanup of stale versions — delete unneeded versions with an S3 client (delete-object --version-id).
• Versions, like regular objects, are kept in the region storage alongside current data.

Pricing and limits

• Storage is billed per GB·month based on the average daily volume: 1/N of the monthly price accrues each day (N — days in the month).
• Outbound traffic is free up to three times the monthly average stored volume (store 100 GB — serve 300 GB per month for free); beyond the allowance it is billed per GB. Inbound traffic and operations (GET, HEAD, LIST, PUT, POST, etc.) are not billed and not limited in number.
• Charges accrue daily and are visible in the control panel; the balance is debited once a month, when the calendar month ends.
• If the balance runs short, access is not cut off immediately: we send a notification asking you to top up. If the debt stays unpaid for 7 days, the storage switches to read-only: downloads keep working, uploads are rejected, and no data is deleted. Full access is restored automatically after a top-up.
• A single PUT is limited to 5 GB; upload larger objects with multipart upload (S3 clients do this automatically).

Media delivery and caching

• Objects in public buckets are served through the WebShield edge node closest to the visitor and are cached on it: repeated downloads and Range requests (video seeking) are served locally, without a round trip to the storage.
• After overwriting an object under the same name, the old version may be served from the cache for up to 1 hour. For an instant switch, upload the file under a new name (for example, with a version in the name: logo-v2.png).
• The Cache-Control header set at upload time is honored by both the edge cache and browsers: set a long max-age for immutable files.
• Signed requests (S3 clients with keys, presigned URLs) are never cached and always go straight to the storage.
• Turning off bucket public access stops the delivery (including cached objects) within a minute or two.

Connecting a client

Any S3-compatible client works with the WebShield endpoint. Step-by-step setup guides:

• AWS CLI — the official command-line client.
• rclone — sync and mirror directories.
• s3cmd — a lightweight command-line client.
• SDKs — boto3 (Python), JavaScript, Go, PHP.

In every client you need three things: the endpoint https://s3.webshield.pro, the access key pair from the control panel, and path-style addressing.

Notes

• Use path-style addressing (most clients handle it automatically with a custom endpoint; in boto3 it is the default for custom endpoints).
• Traffic to the endpoint goes through the WebShield edge with rate limiting and ban protection; there is no browser challenge on this host.