cPanel runbook · Beginner · 5 min
How to create a subdomain — A Document Root, a Record and a Certificate
You want app. or staging. running as its own site rather than as a folder that the main install can see, index and accidentally serve.
The short answer
Create it in cPanel and you get three things at once: a DNS entry pointing at the account, a document root on disk, and a certificate from AutoSSL a few minutes later. The only decision worth slowing down for is the document root, because everything awkward about subdomains comes from nesting one inside another site.
By default cPanel proposes a folder inside public_html. That is fine for something trivial and wrong for anything real: the parent site can serve those files directly, its rewrite rules apply to them, and a crawler can find both copies. Put an independent application in a sibling directory outside public_html instead.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Skill floor
4
Stages start to end
Free
Support, every tier
Proven
Run on the live stack
You need cPanel access and about five minutes. The Subdomains tool sits under Domains, and it does the DNS row and the folder in one submission.
Reversible in both directions. Removing a subdomain removes the DNS entry and leaves the files, so nothing is destroyed by experimenting here.
What cPanel creates, and what it does not
Submitting the form adds an A record for the new hostname in the zone, creates the document root directory, and registers the hostname with the web server so it answers on the account. AutoSSL then picks it up on its next run and adds it to the certificate.
What it does not do is give the new site its own PHP settings, its own cache rules or its own database. Those are separate, deliberate steps, and per-site PHP version switching is available from the control panel once the subdomain exists as a site in its own right.
The document root decision, and why nesting hurts
If the root sits at public_html/app, then the parent site is also serving those files at yourdomain.com/app. Two hostnames now serve the same code, the parent's .htaccess rewrites apply to it, and a WordPress install at the parent can rewrite requests it was never meant to see.
Put anything independent at a sibling path such as /home/user/app rather than under public_html. It costs one edit to the auto-filled field, and it saves the entire class of bug where a change to the main site quietly alters the behaviour of the subdomain.
Cache and PHP are per-site, and that is the point
A subdomain with its own document root gets its own .htaccess, which means its own LiteSpeed cache rules. That is exactly what you want for a staging copy that must not be cached, or an API endpoint where caching would be actively wrong.
The same applies to PHP. A legacy application can sit on an older version on its own subdomain while the main site runs a current one, without either of them compromising. Set it explicitly after the subdomain exists rather than assuming it inherited anything sensible.
Staging hosts, and keeping them out of the index
A staging subdomain is a public hostname unless you make it otherwise, and staging copies get indexed constantly. Password-protect the directory, or return X-Robots-Tag: noindex from the server rather than relying on a plugin checkbox that a database sync will overwrite.
For WordPress specifically, the managed plans allow up to 10 staging copies, and a clone kept behind HTTP authentication is the version of this that survives contact with a real deployment cycle.
The stack these steps were measured on
Every walkthrough here is run against the platform we operate — cPanel, LiteSpeed in front of NVMe, Softaculous, WP-CLI over SSH — so the field names in the instructions are the field names on your screen.
Backups run daily on every plan, and restoring a file or a database is one action in the panel rather than a support ticket.
- The document root treated as the real decision
- Per-site cache and PHP explained, not assumed
- Verification commands, not hopeful refreshing
- Engineers on support at any hour
Why HostingFast
Standard on every plan
One decision, called out
The document root is the only choice on this page with lasting consequences, so it gets a section rather than a passing mention.
Nesting explained
The page shows exactly how a root inside public_html lets the parent site serve and rewrite the subdomain's files.
Per-site settings covered
Cache rules and PHP version are per document root, which is the whole reason a subdomain is more useful than a folder.
4 steps, no padding
Four actions, each with something observable at the end, including the certificate check people skip.
Staging handled properly
Keeping a staging hostname out of the index is a server-level instruction here, not a checkbox a database sync can undo.
Engineers on call
If AutoSSL will not cover the new hostname, support answers at any hour with the actual reason.
Quick Start
From order to online
- 1
Create it, then read the root cPanel proposed
Open Domains and then Subdomains, enter the label such as app or staging, and stop before you submit. The Document Root field will have auto-filled to public_html/app, and that default is the thing this page exists to make you reconsider.
- 2
Move the root outside public_html for anything independent
Change it to a sibling path such as /home/user/app so the parent site cannot serve or rewrite those files. Leave it inside public_html only when the subdomain is genuinely part of the same site and you want the shared rules.
- 3
Confirm the hostname resolves and the certificate covers it
Run dig A app.yourdomain.com @1.1.1.1, then wait for AutoSSL and check with openssl s_client -connect app.yourdomain.com:443 -servername app.yourdomain.com that the SAN list includes the new name.
- 4
Deploy, then set PHP and cache rules for that root
Put the application in place, choose the PHP version for this site specifically in the control panel, and write the cache rules into its own .htaccess. If it is staging, add HTTP authentication or an X-Robots-Tag: noindex header now rather than later.
Built In
Loaded onto every plan
- NVMe storage on every tier, not only the expensive ones
- Staging environments for testing before you ship
- Year one of the domain free when you order annually
- Daily backups with self-service restores from the panel
- In-place account upgrades, with no migration to change plan
- Softaculous for one-click application installs
- Support staffed by humans, every hour of the day
- LiteSpeed caching in the server, not bolted on by plugin
- WordPress and 400+ other applications in one click
- Free migration: our engineers move the existing site
Frequently Asked
What people ask us most often
Does a subdomain need its own DNS record on the same account?
cPanel creates one for you as part of the form, so normally there is nothing extra to do. It matters when DNS is hosted elsewhere: the panel writes the row into a zone that is not authoritative, so the hostname never resolves. In that case add the A record at whichever nameservers actually answer, then confirm with dig A app.yourdomain.com.
Can I run a different PHP version on a subdomain?
Yes, provided the subdomain has its own document root. Per-site PHP version switching is available from the control panel, so a legacy application can stay on an older version while the main site runs a current one. If the root is nested inside public_html the two share configuration, which is one more reason to give an independent app its own directory.
Staging on a subdomain or in a subdirectory?
A subdomain, every time. Its own document root means its own .htaccess, its own cache rules and its own PHP version, so you can test an upgrade without the live site's configuration leaking into the result. A subdirectory shares the parent's rewrite rules, which means you are not actually testing the thing you are about to deploy.
How do I keep a staging hostname out of search results?
Put HTTP authentication on the directory, or return X-Robots-Tag: noindex from the server. Both survive a database sync from production, which the WordPress search-engine-visibility checkbox does not — that setting lives in the database and gets overwritten the moment you copy live data down. Belt and braces is authentication plus the header.
Keep reading
How to Migrate a WordPress Site
Move an install between hosts with the database, the paths and the search-replace all accounted for.
How to Check DNS Propagation
There is no propagation, only TTLs expiring — here is how to watch the countdown properly.
Subdomain (Glossary)
The definition this page leans on, with the document root relationship explained.
Website Builder
A drag-and-drop builder that publishes onto the same NVMe hosting as everything else.
Domain Names
Search, register and transfer names — first year free with an annual hosting plan.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Give the subdomain quicker ground.
NVMe behind a LiteSpeed cache, free SSL that covers new hostnames automatically, free migration, and a price that never moves.
View Website Builder plans