Create a subdomain

A subdomain such as blog.your-domain.tld is not just a folder: it is a distinct DNS name, with its own web root and often its own certificate. Three layers must line up, or the browser returns a DNS error, the main site page, or a certificate warning.

1. Understand the three layers

Creating the subdomain in KeyHelp without a DNS record is not enough, and the reverse produces a connection error. Do both, then wait for propagation before testing.

2. Create the subdomain in KeyHelp

In KeyHelp, open the main domain's subdomain section and add, for example, blog. Choose a dedicated root, separate from the main site root: blog/ rather than the existing root.

Why a separate root? If both names share the same folder, the subdomain shows the main site and the two .htaccess files conflict. One root per name keeps files, logs and redirects independent.

Also select the PHP version and required options. Save, then note the exact path shown.

3. Configure DNS

If the DNS zone is managed by NeoHeberg, the record may be created automatically. Otherwise, at your registrar:

• A for blog to the hosting IPv4 address;
• AAAA to the IPv6 address if available;
• or a CNAME for blog to the main domain.

A CNAME cannot coexist with other records at the same name. During setup, use a low TTL (300 to 600 seconds) so fixes propagate quickly; raise it afterwards. Check:

dig +short blog.your-domain.tld A
dig +short blog.your-domain.tld AAAA

4. Upload content and secure it

Upload a test index.php into the subdomain root, with 644/755 permissions. Confirm the subdomain does not serve the main site: if it does, the root is misconfigured.

Then enable a Let's Encrypt certificate for blog.your-domain.tld. A certificate issued for your-domain.tld does not automatically cover the subdomain unless it explicitly lists that name or uses a wildcard. Do not assume a wildcard exists: request the exact name.

5. Verify

• dig returns the expected address.
• curl -I https://blog.your-domain.tld/ returns 200.
• The certificate shows the right name, with no warning.
• Main site files are not reachable through the subdomain.
• The subdomain appears in KeyHelp with its own root.

On failure, test in this order: DNS, root, certificate. Changing all three at once makes diagnosis impossible.