Updated on 2026-11-02 GMT+08:00

Static Website Hosting

Scenarios

OBS buckets can host static websites. You can configure an index page, an error page, and page redirection. To host a static website in OBS, upload the static website files to a bucket, grant anonymous users read permissions for those files, and enable static website hosting for the bucket.

Static websites contain only static web pages and some client-side scripts, such as JavaScript and Flash. In contrast, dynamic websites rely on servers to process scripts, such as PHP, JSP, and ASP.NET. OBS currently does not support scripts that run on servers.

Figure 1 Static website hosting

After static website hosting is configured, you can access OBS in either of the following ways:

  • Resource management: In this method, you access OBS through a standard domain name. You can use APIs or SDKs together with the default OBS domain name that includes an endpoint to perform common bucket and object operations, such as uploading, downloading, deleting, and listing.
  • Static website: In this method, you access OBS through a dedicated domain name. When static website hosting is enabled, OBS applies the configured hosting rules to display index pages or error pages and redirect requests.

The configuration of static website hosting takes about two minutes to take effect. After it takes effect, you can access static resources using the following URLs:

https://<static-website-domain-name>/object-name
http://<static-website-domain-name>/object-name

The <static-website-domain-name> is in the format of BucketName.obs-website.Endpoint. BucketName indicates the bucket name and Endpoint indicates the regional endpoint. For details about the endpoint of each region, see Regions and Endpoints. For example, suppose you want to use a static website domain name to access bucket testbucket in the CN-Hong Kong region. The endpoint for CN-Hong Kong is ap-southeast-1.myhuaweicloud.com. Therefore, the static website domain name should be testbucket.obs-website.ap-southeast-1.myhuaweicloud.com.

  • Avoid using periods (.) in a bucket name, or accessing the bucket over HTTPS may result in certificate verification failures on the client.
  • Static website hosting requires public-read access. When users access static website files over a public network, they will be charged for outbound Internet traffic and requests.

To enable your customers to access the content hosted on the website endpoint, you must make all your content publicly readable. You can use bucket policies or ACLs on objects to grant the required permissions.

The following table lists the differences between the resource management and static website methods.

Key Difference

Resource Management

Static Website

Access control

Both public content and private content are supported.

Only publicly readable content is supported.

Error message handling

An error response in XML format is returned.

An HTML document is returned.

Redirection support

Not applicable

Both object-level and bucket-level redirection are supported.

Supported requests

All bucket and object operations are supported.

Only GET and HEAD requests on objects are supported.

Response to GET and HEAD requests at the root level of a bucket

A list of object keys in the bucket is returned.

The index file specified in the configuration is returned.

Important Notes

For security and compliance purposes, Huawei Cloud OBS does not allow you to use static website hosting based on the default domain name (a bucket access domain name or static website domain name). When you use such a domain name to access web pages in a browser, no content will be displayed. Instead, the content is downloaded as an attachment. This restriction takes effect in different regions at the following times:
  • January 1, 2022: CN North-Beijing1, CN North-Beijing4, CN East-Shanghai1, CN East-Shanghai2, and CN South-Guangzhou
  • March 25, 2022: CN-Hong Kong, AP-Bangkok, AP-Singapore, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago
  • Other regions follow their actual effective time.
  • The body of the request used to configure static website hosting must not exceed 10 KB.

Configuring Static Website Hosting

Overview

To host a static website in a bucket, you must configure the bucket with the required website settings. The settings include:

Default homepage

When you enter a URL such as http://example.com, you are not requesting a specific page. In this case, the web server returns the default page that contains the directory of the requested website. This page is called the default homepage and is usually named index.html. When you configure a bucket for website hosting, you must specify a default homepage. OBS returns this default homepage when requests are made to the root domain or any subfolder.

Default 404 error page

If an error occurs, OBS returns the default HTML 404 error page. For 4XX errors, you can optionally provide a custom 404 error page, where you can offer additional guidance for your users.

Redirection of all requests

If your root domain is example.com and you want to respond to requests for both http://example.com and http://www.example.com, you can create two buckets named example.com and www.example.com. Then, store your website content only in one bucket (such as example.com), and configure the other bucket to redirect all requests to the example.com bucket.

Advanced conditional redirection

You can redirect requests based on a specific object name or prefix in the request, or based on the response code. If you delete or rename an object in your bucket, you can add a routing rule that redirects requests for that object to another object.

To configure redirection in website hosting, use the following syntax format:

<WebsiteConfiguration> 
    <IndexDocument> 
        <Suffix>index.html</Suffix></IndexDocument> 
    <ErrorDocument> 
        <Key>SomeErrorDocument.html</Key> 
    </ErrorDocument> 
    <RoutingRules> 
        ...RoutingRules...
    </RoutingRules> 
</WebsiteConfiguration>

The following gives the syntax format of RoutingRules. The content in square brackets ([]) is optional.

<RoutingRules> = 
    <RoutingRules> 
        <RoutingRule>...</RoutingRule> 
        [<RoutingRule>...</RoutingRule> ...] 
    </RoutingRules> 

<RoutingRule> = 
    <RoutingRule> 
        [ <Condition>...</Condition> ] 
        <Redirect>...</Redirect> 
    </RoutingRule> 

<Condition> = 
    <Condition>  
        [ <KeyPrefixEquals>...</KeyPrefixEquals> ] 
        [ <HttpErrorCodeReturnedEquals>...</HttpErrorCodeReturnedEquals> ] 
    </Condition> 

<Redirect> = 
    <Redirect> 
        [ <HostName>...</HostName> ] 
        [ <Protocol>...</Protocol> ] 
        [ <ReplaceKeyPrefixWith>...</ReplaceKeyPrefixWith> ] 
        [ <ReplaceKeyWith>...</ReplaceKeyWith> ][ 
        <HttpRedirectCode>...</HttpRedirectCode> ] 
    </Redirect>

For details on redirecting all requests and configuring redirection rules, see the "Request Elements" section in Configuring Static Website Hosting for a Bucket.

Examples:

Example 1: Redirecting requests by changing the object name prefix

Assume your bucket contains the following objects:

index.html

docs/article1.html

docs/article2.html

You decide to rename the folder from docs/ to documents/. After the change, any request that uses prefix /docs needs to be redirected to documents/. For example, a request for docs/article1.html should be redirected to documents/article1.html.

To achieve this, you can add the following routing rule to your website configuration.

 <RoutingRules> 
    <RoutingRule> 
    <Condition> 
      <KeyPrefixEquals>docs/</KeyPrefixEquals> 
    </Condition> 
    <Redirect> 
      <ReplaceKeyPrefixWith>documents/</ReplaceKeyPrefixWith> 
    </Redirect> 
    </RoutingRule> 
  </RoutingRules>

Example 2: Redirecting requests for a deleted folder to a specific page

Assume you have deleted the images/ folder (meaning all objects with the images/ prefix). You can add a routing rule that redirects any request for those deleted objects to a page named folderdeleted.html.

<RoutingRules> 
    <RoutingRule> 
    <Condition> 
       <KeyPrefixEquals>images/</KeyPrefixEquals> 
    </Condition> 
    <Redirect> 
      <ReplaceKeyWith>folderdeleted.html</ReplaceKeyWith> 
    </Redirect> 
    </RoutingRule> 
  </RoutingRules>

Example 3: Redirecting requests when an HTTP error occurs

Assume you want to redirect requests to www.example.com whenever a requested object cannot be found. You can add a routing rule that triggers when HTTP status code 404 (Not Found) is returned. In the following example, the rule adds the prefix report-404/ to the redirected object name. For example, if someone requests ExamplePage.html and receives an HTTP 404 error, they will be redirected to the page report-404/ExamplePage.html on the www.example.com. If there is no routing rule and an HTTP 404 error occurs, the error document defined in your website configuration will be returned.

<RoutingRules> 
    <RoutingRule> 
    <Condition> 
      <HttpErrorCodeReturnedEquals>404</HttpErrorCodeReturnedEquals > 
    </Condition> 
    <Redirect> 
      <HostName>www.example.com</HostName> 
      <ReplaceKeyPrefixWith>report-404/</ReplaceKeyPrefixWith> 
    </Redirect> 
    </RoutingRule> 
  </RoutingRules>

Index Document Support

An index document is the web page that a website returns when a request is made to the root directory or any subfolder. For example, if a user enters http://www.example.com in a browser, they are not requesting any specific page. In this case, OBS returns the index document, also known as the default page.

When configuring website hosting for your bucket, you must specify the name of the index document. You also need to upload an object with that name and ensure it is publicly accessible.

The trailing slash (/) in the root URL is optional. If your website uses index.html as its index document, any of the following URLs will return index.html.

http://bucketname.obs-website.example.com/
http://bucketname.obs-website.example.com

In OBS, objects are stored in buckets in a flat structure rather than in a hierarchical file-system layout. However, you can create a logical hierarchy by using object names that resemble folder paths. For example, consider a bucket that contains the following three objects:

  • sample1.jpg
  • photos/2006/Jan/sample2.jpg
  • photos/2006/Feb/sample3.jpg

Although these objects are not stored in actual folders, their names imply the following logical structure:

  • sample1.jpg is located at the root level of the bucket.
  • sample2.jpg is located in the photos/2006/Jan subfolder.
  • sample3.jpg is located in the photos/2006/Feb subfolder.

Custom Error Document Support

Table 1 lists the HTTP status codes that OBS returns when an error occurs.

Table 1 Error code list

HTTP Error Code

Description

301 Moved Permanently

When a user sends a request directly to the OBS website endpoint, OBS returns a 301 Moved Permanently response.

302 Found

When OBS receives a request for the key x that does not end with a slash, it first checks whether an object with the key x exists. If no such object is found, OBS determines that the request is intended for the subfolder x. It then adds a trailing slash to x, redirects the request, and returns a 302 Found response.

304 Not Modified

OBS uses the If-Modified-Since and If-Unmodified-Since headers to determine whether the requested object is the same as the cached copy on the client. If the objects are the same, the website endpoint returns a 304 Not Modified response.

403 Forbidden

If the requested object is not publicly readable, the website endpoint returns a 403 Forbidden response. To fix this, the object owner must update the bucket policy or object ACL to allow public read access.

404 Not Found

The website endpoint returns a 404 Not Found response in the following situations:

  • The website URL references an object key that does not exist.
  • The request is for an index document that does not exist.
  • The bucket specified in the URL does not exist.
  • The bucket specified in the URL exists but is not configured for website hosting.

You can create a custom error document to be returned when a 404 Not Found error occurs. Make sure the document is uploaded to a bucket configured for website hosting and the document is specified as the error document in the website hosting settings.

500 Service Error

If there is an internal server error, the website endpoint returns a 500 Service Error response.

503 Service Unavailable

If your OBS request rate is too high, the website endpoint returns a 503 Service Unavailable response.

Permissions Required for Website Access

When you configure a bucket for website hosting, you must make the objects publicly readable. To achieve this, you need to add a bucket policy that grants the GetObject permission to everyone. If the requested object does not exist on the website endpoint, OBS returns an HTTP 404 Not Found response. If the object exists but does not have public read permission, the website endpoint returns an HTTP 403 Access Denied response. The requester can use the response code to determine whether the requested object exists. If you do not need this behavior, do not enable website hosting for the bucket.

Static website hosting requires public-read access. When users access static website files, charges apply for outbound Internet traffic and for requests.

The following example bucket policy grants everyone the permission to access objects in a specified folder. For more information about bucket policies, see Bucket Policy Overview.

{ 
   "Statement":[{ 
    "Sid":"PublicReadGetObject", 
      "Effect":"Allow", 
      "Principal": {"ID":"*"}, 
      "Action":["GetObject"], 
      "Resource":["example-bucket/*"  ] 
    } 
  ] 
}

A bucket policy applies only to objects owned by the bucket owner. If the bucket contains objects that are not owned by the bucket owner, object ACLs should be used to grant public read access to those objects.

You can use bucket policies or object ACLs to grant public read access to your objects. To make objects publicly accessible using ACLs, grant the read permission to everyone, as shown in the following example. You can add the authorization elements below to an object ACL. For details, see ACLs.

<Grant> 
  <Grantee> 
    <Canned>Everyone</Canned> 
  </Grantee> 
  <Permission>READ</Permission> 
</Grant>

Related Functions

Function

Relationship with Static Website Hosting

Reference

CORS

By default, a static website hosted in an OBS bucket can only respond to requests from the same origin. You can configure CORS for the bucket to allow the static website to be accessed from a different origin.

Configuring CORS to Allow Cross-Origin Access to OBS

User-defined domain name configuration

OBS allows you to access a static website hosted in OBS using a user-defined domain name. You can continue using your original domain name to visit the website without making any changes to your website code.

Accessing a Bucket Using a User-Defined Domain Name

Using a User-Defined Domain Name to Access a Static Website

URL validation

URL validation protects your website hosted in OBS from hotlinking. OBS checks incoming requests using the Referer field in the HTTP header.

Configuring URL Validation to Prevent Unauthorized Access to Your Data

Prerequisites

Web page files required for static website hosting have been uploaded to the specified bucket.

The static website files hosted in the bucket are accessible to all users.

Static web page files in the Archive or Deep Archive storage class have been restored. For more information, see Restoring Archive or Deep Archive Objects.

Ways to Configure Static Website Hosting

You can configure static website hosting using OBS Console, APIs, or SDKs, but not using OBS Browser+ or obsutil.

Application Practices

Best Practices

  • Secure Transmission: Configuring HTTPS

    Configure an SSL certificate for a user-defined domain name and enforce HTTPS access. HTTPS provides end-to-end data encryption between the client and server using TLS/SSL. It also verifies server identity via certificates to ensure data confidentiality, integrity, and authenticity. The SSL certificate for a bucket's default domain name is centrally managed by Huawei Cloud and requires no additional configuration. However, you must configure a separate certificate for a user-defined domain name or CDN acceleration domain name. You are advised to prepare a backup certificate and configure an HTTP fallback policy in advance to prevent service interruptions caused by certificate expiration.

    For details about how to configure HTTPS, see Certificate Hosting.

  • Cross-Origin Access: Configuring CORS Rules

    When a frontend application needs to access OBS resources across origins (with different protocols, domains, or ports), you must configure CORS rules to allow cross-origin requests from specified domains. You are advised to configure specific Allowed Origin instead of using the wildcard (*), to follow the principle of least privilege to narrow down Allowed Method, and to explicitly list the necessary Exposed Header. In scenarios with high security requirements, the wildcard (*) is strictly prohibited. In scenarios with high performance requirements, you can configure a longer cache duration to reduce preflight requests.

    For details about how to configure CORS rules, see Configuring CORS to Allow Cross-Origin Access to OBS.

  • Access Acceleration: Configuring a CDN Acceleration Domain Name

    If you need to distribute static resources to users around the world, we recommend configuring a CDN acceleration domain name for your bucket. By caching content on globally distributed CDN edge PoPs, you can reduce access latency and enhance user experience.

    Choose a CDN service type (website acceleration, file download acceleration, or VOD acceleration) based on your specific workload to achieve acceleration. When configuring acceleration, specify the service area (Chinese mainland, outside the Chinese mainland, or global) and the bucket type (public or private). For private buckets, the system automatically creates a CDNAccessPrivateOBS agency to authenticate requests and allow CDN to retrieve data from the bucket.

    For details about how to configure a CDN acceleration domain name, see Accessing a Bucket Using a CDN Acceleration Domain Name.

  • Data Backup and Recovery: Configuring Versioning

    If you want to restore a deleted file or restore a specific version of a file that is concurrently, frequently edited online, you can enable versioning for the OBS bucket. In a versioning-enabled bucket, OBS keeps multiple versions of the same object. This allows you to quickly retrieve and restore any object version, helping you recover data from both accidental actions and application failures.

    For details, see Versioning.

Security Protection

  • Data Theft Prevention: Configuring URL Validation

    Some unauthorized websites link directly to images, videos, and other assets hosted on other sites to expand their own content at no extra cost. This increases the load on origin servers while driving up bandwidth consumption and traffic costs. To prevent this, OBS supports URL validation using referer whitelists and blacklists. Whitelists allow access from trusted sources, while blacklists block malicious ones.

    Note that requests may bypass URL validation rules if they hit a CDN cache. Therefore, if you have configured a CDN acceleration domain for your bucket, you must set up corresponding URL validation rules on the CDN side as well.

    For details about how to configure URL validation, see Configuring URL Validation to Prevent Unauthorized Access to Your Data.

  • Fault Analysis and Troubleshooting: Configuring Bucket Log Storage and Auditing

    Enable OBS bucket log storage to automatically record access details, format log files according to fixed naming rules, and upload them to a specified log storage bucket. Bucket logs capture all request details, including access timestamps, source IP addresses, request types, operation types, and response statuses, helping you perform security auditing, performance analysis, and troubleshooting. For details, see Bucket Logging Overview.

    Cloud Trace Service (CTS) is a dedicated audit logging service in Huawei Cloud security solutions. It tracks and records operations performed on your cloud resources, including user identities, IP addresses, operation details, and response statuses. These operation records enable efficient security auditing, issue tracking, and resource tracing. For details, see Using CTS to Audit OBS Operations.