Object storage (S3)

WebShield provides S3-compatible object storage for backups, media, logs, and application data. Any S3 client works: aws CLI, rclone, s3cmd, and the AWS SDKs.

• Endpoint: https://s3.webshield.pro (path-style addressing: https://s3.webshield.pro/<bucket>/<key>)
• Billing: pay-as-you-go — stored volume (per GB per month) and outbound traffic beyond the free allowance; debited from the account balance once a month. Current prices are on the service page.

Enabling the service

1. Open S3 storage in the control panel (account level).
2. Click Enable storage. The service generates an access key pair.
3. Save the Secret Access Key immediately: it is shown only right after enabling the service or rotating the keys.

Access keys belong to the account and cover all its buckets. Rotate keys issues a new pair; the old one stops working within about a minute.

Buckets

• Bucket names automatically receive your account prefix (for example, u42-): you enter backups, the final bucket is u42-backups. Use the full name in S3 clients.
• When creating a bucket you choose its region: ru-1 (Russia), eu-1 (Europe), or us-1 (United States). The region determines where the data is durably stored; the region is set at creation and cannot be changed later. The endpoint is the same for all regions.
• A new bucket stays in the “Provisioning” state for about a minute while it is being attached to the region storage; uploads are unavailable during that time. The status in the bucket list refreshes automatically.
• A bucket is private by default. A public bucket allows anonymous downloads by direct URL (https://s3.webshield.pro/<bucket>/<key>) — for example, to serve images or files on a website; listing the bucket contents stays private. The type can be switched at any time with the lock/globe button; the change takes effect within about a minute.
• The Files button next to a bucket opens the built-in file manager: browse folders (contents load lazily as you expand them), upload small files, download and delete objects. For bulk transfers and large objects use an S3 client.
• A name may contain lowercase letters, digits, and hyphens (up to 40 characters).
• Buckets are created and deleted only in the control panel. Deleting a non-empty bucket asks for an extra confirmation and removes all objects irreversibly.

Pricing and limits

• Storage is billed per GB·month based on the average daily volume: 1/N of the monthly price accrues each day (N — days in the month).
• Outbound traffic is free up to three times the monthly average stored volume (store 100 GB — serve 300 GB per month for free); beyond the allowance it is billed per GB. Inbound traffic and operations (GET, HEAD, LIST, PUT, POST, etc.) are not billed and not limited in number.
• Charges accrue daily and are visible in the control panel; the balance is debited once a month, when the calendar month ends.
• If the balance runs short, access is not cut off immediately: we send a notification asking you to top up. If the debt stays unpaid for 7 days, the storage switches to read-only: downloads keep working, uploads are rejected, and no data is deleted. Full access is restored automatically after a top-up.
• A single PUT is limited to 5 GB; upload larger objects with multipart upload (S3 clients do this automatically).

Media delivery and caching

• Objects in public buckets are served through the WebShield edge node closest to the visitor and are cached on it: repeated downloads and Range requests (video seeking) are served locally, without a round trip to the storage.
• After overwriting an object under the same name, the old version may be served from the cache for up to 1 hour. For an instant switch, upload the file under a new name (for example, with a version in the name: logo-v2.png).
• The Cache-Control header set at upload time is honored by both the edge cache and browsers: set a long max-age for immutable files.
• Signed requests (S3 clients with keys, presigned URLs) are never cached and always go straight to the storage.
• Turning off bucket public access stops the delivery (including cached objects) within a minute or two.

Connecting a client

Any S3-compatible client works with the WebShield endpoint. Step-by-step setup guides:

• AWS CLI — the official command-line client.
• rclone — sync and mirror directories.
• s3cmd — a lightweight command-line client.
• SDKs — boto3 (Python), JavaScript, Go, PHP.

In every client you need three things: the endpoint https://s3.webshield.pro, the access key pair from the control panel, and path-style addressing.

Notes

• Use path-style addressing (most clients handle it automatically with a custom endpoint; in boto3 it is the default for custom endpoints).
• Traffic to the endpoint goes through the WebShield edge with rate limiting and ban protection; there is no browser challenge on this host.