Messages we send you

Sometimes the panel writes to you without being asked. Not because you requested something, but because something happened that you need to know about: your disk is filling up, a certificate cannot be renewed, a backup failed, or somebody signed in to your account from a device we had not seen before.

This page explains which messages those are, how often you can get them at most, and why they arrive.

What one looks like

Every message has the same shape, on purpose:

1. A heading that says in one sentence what is going on.
2. A summary with the number in it. Not "your disk is nearly full" but "9.6 GB of 10 GB (96%)" — something you can act on.
3. The details: which account, and which step we are reporting.
4. One button, with the same link underneath it as plain text. If the button does not work in your mail program, copy the link.
5. At the bottom: why you are receiving this, and a link to your message preferences.

Every message goes out in two forms — styled and as plain text — so a mail program without formatting still shows you the words.

You may reply. Our messages never come from a noreply address: a reply reaches your provider's support desk.

Which language

Yours — not the language of whoever did something. If you chose Dutch or English in the panel, that is the language of your messages. If you have not chosen yet, we remember what your browser asks for the first time you sign in. A language you set yourself is never overwritten by a browser afterwards.

You set your language under Settings → Preferences.

The messages

Your hosting account is ready

The first message you get from us. It arrives once, when somebody creates a hosting account for you, and it carries your username, your website, the address of the panel — and a link to choose a password.

There is no password in it, and that is deliberate: mail is not encrypted on its way to you, and it stays in your mailbox for years. So we send a link instead. It works for seven days and can be used once; open it, choose a password, and sign in with your email address and that password.

Missed it, or waited too long? Ask whoever created your account — they can send a new link. Nobody can read the old one, not even us: we keep only a fingerprint of it.

Whoever created the account may also have read a password off their own screen and given it to you another way. That works too; you can change it afterwards under Sign-in & security.

Your disk, mailbox or bandwidth is filling up

You hear at 80%, at 90% and at 95%. One message per step — not one every hour.

If usage falls back below a step (five points below it, so under 85% for the 90% step), that step counts again: cross it later and you hear about it again. Within 24 hours you never get the same step twice.

From 95% your provider is copied as well. Below that they are not — that is between you and your disk.

Went from 79% to 96% while nobody was looking? Then you get one message, about the 95% step. Not three.

A certificate is expiring and will not renew

Certificates renew themselves. When that fails three times and the certificate expires within a fortnight, you hear about it — at most once every 48 hours, and your administrator gets the same message.

We send this because the certificate authority no longer does: Let's Encrypt stopped sending expiry mail on 26 June 2025. Without us, nobody would warn you.

A backup failed

Straight away, because a failed backup is something you find out about at the moment you need it. If it keeps failing every night, that is one message a day.

The weekly summary of successful backups is something you switch on yourself; it does not arrive by default.

Security

A new sign-in from an unknown device, a changed password, a passkey added or removed, two-step verification switched on or off: those always arrive, and are never held back.

You cannot switch them off either. That is not stubbornness: a message about your security that somebody can silence is a message an intruder silences.

The same is true of password resets and of invitations.

Unblocking your internet address

Two messages, both without delay and neither of them switchable.

The link that lifts the block only arrives when somebody asked for it, and it works for fifteen minutes, once, and only from the address that is blocked. If you did not ask for it there is nothing to do: without the link nothing changes.

The confirmation afterwards always arrives, even when you pressed the button yourself. That is exactly why it exists: if it arrives and you did not ask, somebody else used the self-service in your name and it is time to change your password.

How that journey works is in Your internet address is blocked — how to get back in.

A mailbox hit its sending limit

Immediately, with no delay. A mailbox suddenly sending hundreds of messages an hour is almost always a stolen password or a compromised website, and an hour of waiting is an hour of spam with your domain on it.

Your account keeps reaching its limits

Your hosting plan sets ceilings — processor time, memory, how many processes at once — and most of the time you never meet them. When your account is stopped at one of them often enough that visitors notice, you get one message a day for as long as it lasts.

It names which ceiling, because the three mean different things: held at the processor ceiling is a slow website, refused memory is an error page instead of a website, refused a process is a cron job that did not run.

It is a warning and not an alarm. Nothing is broken and nothing is lost — the server did exactly what your plan says it does. What it means is that the site is slower than you are paying for, and there are two ways out: make it use less, or move to a bigger plan. The message links to Usage and limits, where the moment it happened lists the processes that were running.

One exception has no threshold. If a process of yours was killed because the account ran out of memory, you hear about it however the platform is configured — that account is not busy, it is broken.

A task finished

Only when it ran for more than two minutes. If it was quicker you were still looking at the screen and do not need mail about it.

What we do not send

Payment reminders. Invoices and dunning come from HostFact, and two systems chasing one invoice is how somebody who has already paid receives a demand. In the panel you may see a banner about an outstanding invoice, and nothing more.

For resellers: what of yours is in them

If you are a reseller, every message to your customers carries your name, logo and colour. The platform's name appears nowhere in them.

What you set is under Settings → Brand:

• Product name — the name in the heading and in the signature.
• Logo — appears at the top of the message. Without one, your product name is used.
• Colour — the button and the links, in both light and dark.
• Reply-to address — where a customer's reply arrives. Left empty, the platform's address is used.

The wording and the layout are not editable. That is deliberate: the why-line, the preferences link and the readable link under the button are in every message, and they should not be removable.

Sending through your own mail server? Fill in your own SMTP relay in your brand settings. Then the messages leave from your domain with your DKIM signature. Without a relay of your own we send them for you — with your name in front, but from the platform's mail domain, because a message claiming to come from your domain while leaving our server is one the recipient refuses.

Looking at what was sent

Administrators can check on the server exactly what went out:

# Everything the panel can send, with the damping rule for each kind
corecp-panel mail catalog

# What is queued or has been sent
corecp-panel mail queue --to you@example.com

# One message as it was sent (recorded in the audit log)
corecp-panel mail show <id>