Grid Hosting

Improvement Add Database sizes to Database overview page
Improvement Allow sorting of databases by size and emails by quota used

Internal Allow for notifying hosting account owners when a WP site contains critical security vulnerabilities
Fix Prevent possible deadlock when updating many sites concurrently

Fix Allow A-Z and - in DB names after introducing too restrictive validation
Improvement Increase the frequency of package inventory updates for WP Installations to detect security vulnerabilities quicker
Improvement Automatically fetch plugin vulnerability information for popular packages on an hourly basis

Improvement Show a warning when SPF include is missing or duplicate records are found

Feature Add “Mail Migration” feature allowing to migrate email accounts from other providers to us, this is considered a beta feature
Improvement Show the SSL certificate status in the Domains page as requested by customers
Internal Update composer and npm packages

Fix In certain cases vhosts and redirects would not get cleaned up correctly when deleting a domain or subdomain

Fix “Rename” input field on File Manager didn’t handle dark mode correctly
Fix Handle multiple layers of subdomains for A/AAAA records in the cPanel DNS Migration feature
Improvement Show a diff of what would be changed when migrating a domain from cPanel to the panel
Improvement Do a bit of consistency improvements for the UI in general
Internal Move all config handling for servers to a dispatcher service to standardize the code and improve maintainability

Internal Add cache to the cPanel DNS Gateway API to improve performance
Fix Handle multiple content-types in the /export endpoint for the cPanel DNS Gateway API due to inconsistent content-type handling in the cPanel platform

Improvement Add Node.js “Restart Application” feature to allow restarting a Node.js application running on LiteSpeed Node.js integration
Fix Delegation when a domain would use external nameservers would not work correctly for the cPanel DNS Migration feature
Fix ftp. subdomains wouldn’t get updated to point to the correct A/AAAA records when migrating a domain from cPanel to the panel
Fix Certain dropdowns would not handle default states correctly due to incorrect default type definitions, this has been fixed
Fix Additional work required to properly clean Node.js application data when deleting an application such as handling the stale .htaccess content

Infrastructure Move the firewall to nftables

Feature cPanel Domain Migration allows moving a domain (DNS) from cPanel to the panel automatically using an ownership verification process

Internal Build cPanel DNS Gateway to allow cPanel to talk to the panel to perform DNS operations on shared DNS zones
Internal Increase the retries for zone creation to 5 wth a backoff delay between each attempt
Internal Move all PowerDNS handling to a single shared service to improve code maintainability

Internal Add an internal domain checking call between the cPanel platform and the panel to prevent creating domains that share upcoming common infrastructure

Security Stricter form validation when checking the “Alias Domain” checkbox in domain/subdomain pages
Security Strict directory validation when loading vulnerability information from a given WordPress installation and vulnerability URL hardening
Security Stricter validation in regards to IDN domains
Security Improve GRANT generation for temporary phpMyAdmin credentials
Security Expand the list of reserved system accounts to include various service accounts from imunify360, etc
Security Add a missing Authorization Gate for the add-patchstack call that would allow users with no Patchstack license to access the feature
Security Restrict File Manager uploads to not allow files bigger than the available quota for an account
Security Introduce rate-limit on File Manager API calls to prevent abuse
Security Prune stale File Manager uploads to prevent resource exhaustion
Security Valkey activation only enforced a max memory limit of 512MB instead of the correct value based on the plan, allowing users to bypass their plan limits
Security File Manager now does a stat on the file in File Viewer or File Editor to prevent opening/loading files that was too big to be opened (10MB)
Security Improve the temporary MySQL Credential pruning job to trigger alerts if credentials were not properly deleted due to a connectivity issue, introduce job to clean orphaned credentials
Security Change the File Manager Download feature to limit memory usage when clients have slow internet connections by only buffering a single socket read at a time
Internal Update composer and npm packages

Security Reduce audit logging data for provisioning API to be opt-in instead of opt-out for variables logged
Security Refined validation control flow with explicit early returns, making failure behaviour deterministic
Security Tighten subdomain query matching by enforcing both (sub)domain ID AuthID instead of just AuthID
Security File Manager authentication improved by using short-lived tokens instead of 24 hour credentials
Security Improve security of phpMyAdmin authentication by using short-lived tokens to do server to server communication
Security Prevent logging in using Passkeys if an account is suspended
Security Improve salt generation for password hashing to improve security
Security Add locked properties for reseller accounts
Security Add better sanitization of WordPress plugin names loaded from the WP Directory
Security Move Google’s PSI token to x-goog-api-key instead of the documented &key= parameter to prevent leaking the token into panel error logs in case of PSI API failures
Security Redact certain keywords coming from external services prior to logging to audit logs
Security Switch to environment variables for certain FTP account management actions to prevent hashed credentials being visible in cmdline output
Security Recompute quotas upon submission for resellers to prevent over-allocation of resources (bugfix and small security improvement)

Security Improve security of domains through the provisioning API by covering the same strict hostname validation as through the control panel
Security Improve security of the Roundcube change-password endpoint by tighter IP validation rules and short-lived tokens
Feature Implement Read-Only MCP Server to allow AI agents to interact with the panel
Internal Artisan command to manage the acme DNS zone

Security Certain passwords could result in WordPress rejecting the generated password, causing the installation to fail and exposing an uninstalled WordPress installation to the public internet, this has been fixed by using a different way of supplying the password to WordPress

Internal Add various useful metrics to log into Sentry

Feature Expose read-only calls for email-accounts, forwarders, databases, ftp-accounts, cronjobs, url-schedules, nodejs-applications, valkey, photon-optimizer, stats and psi in the API
Improvement Add feature to suggest e.g. default._domainkey if people put default._domainkey.example.com in the DNS Editor
Fix Handle cases where a domain may be deleted prior to a subdomain being deleted e.g. when queue items are out of order
Internal Remove Laravel Telescope from the panel since it isn’t used
Internal Update composer and npm packages

Feature Introduce the Grid Hosting API (read-only for now)
Improvement Improve SSL issuance process when moving a domain from one account to another by adopting the existing managed certificate instead of attempting to issue a new one
Internal Replace acmephp/ssl library with openssl_* functions to improve compatibility

Security Improve security of impersonation feature (only available for admins and super-users) by adding shortlived tokens bound to the impersonated user, browser and IP address
Security Improve validation of usernames to be strictly POSIX compliant (preparation for upcoming changes to user management)
Improvement Introduce a faster “view only” mode for File Manager which is used for certain filetypes to improve performance
Improvement Use computed attributes for the cancel button in File Manager’s editor to improve performance
Improvement Allow setting from email/from user in WordPress Overview for SMTP configuration
Feature Implement a feature request form to allow customers to request new features and improvements

Improvement Check for available disk space prior to allowing cloning a WordPress installation
Internal Gzip database dumps during cloning if they exceed 1GB in size

Improvement Move all modals to FluxUI modals to improve consistency

Feature Dark mode support

Internal Wildcard SSL certificate issuance for previewr.eu has been moved to same ACME backend as the other domains to improve consistency
Improvement Show the custom document root for alias domains in the Domains page

Improvement Support for custom_docroot option (admin only) on alias domains and honoring it when generating vhosts

Internal DNS Only termination functionality have been fixed to not warn upon termination
Fix Add a missing flux icon that didn’t render correctly on the “What’s New” page

Feature Add Passkey authentication support for the panel
Improvement Show the last 3 new added features on the Dashboard banner to make it easier to discover new features
Fix Align the padding across interfaces to be consistent
Internal Move testing from phpunit to PestPHP
Internal Remove Jetstream dependencies (Teams, 2FA implementation, login views, etc.)
Internal Rebuild the login pages, 2FA pages and other pages that were using Jetstream into native FluxUI components for easier maintenance and customization
Internal Enforce some better defaults for provisioning API requests

Internal Upgrade Laravel to Laravel 13.x
Internal Upgrade composer and npm packages

Feature Monitor for WordPress plugin/theme vulnerabilities and show them in the WordPress Overview page

Improvement Allow deploying SMTP plugin and credentials for existing WordPress installations
Improvement Allow reconfiguring SMTP credentials in case the WordPress configuration was changed (e.g. restoration from Duplicator, etc.)
Improvement Introduce caching of the WP Overview page to prevent calling the WordPress installation for every request
Improvement Speed up WP Overview data loading by utilizing WordPress core functions to get the data instead of relying WP-CLI output data
Internal Do not delay termination of Mail Routing information during account termination
Fix Add GoSMTP Pro plugin to the list of plugins to detect when deploying FluentSMTP plugin to improve accuracy

Feature Implement domain redirects to allow redirecting a domain to a different domain and/or URL

Internal Do not allow SSO logins for suspended accounts

Improvement Allow DNS Only plans to be created with their own set of nameservers
Improvement Expose the Stats page for DNS Only plans
Internal Add unit tests for the DNS zone creation
Internal Decrease the standard TTL of DNS-Only records from 3600 seconds to 60 seconds to allow for faster propagation for newly created domains
Internal Change SMTP Matching logic to be exact match instead of substring match to improve accuracy, include various pro and premium plugins in the detection logic
Internal Split the DNS-Only navigation into a separate file
Internal Upgrade Vite to version 8.x to improve build performance
Removed Everything related to Redirect record has been removed from the panel

Feature Automatically deploy FluentSMTP plugin and configure SMTP connection for WordPress installations installed or cloned through the WordPress Installer to improve email delivery
Internal Update the list of plugins to detect when deploying FluentSMTP plugin to improve accuracy
Internal Update composer packages

Internal Tooling for dealing with bulk DNSSEC deployment

Fix If SSL issuance would fail it would not clear out the _acme-challenge record correctly. This has been fixed
Improvement Add a CAA Checker service to validate we have the expected CAA records (if any) prior to attempting to issue a certificate
Internal Move all _acme-challenge record management to a shared AcmeChallenge service to improve code maintainability
Internal Improve handling of errors when talking to the DNS backend

Feature Manage Account SSH keys through the panel (User dropdown -> SSH Keys)
Internal Introduce new AccountFilesystem service to handle file operations in a single place
Internal Add check service for FileManager access consistency checking
Internal Introduce orphan zone cleanup job to remove possible stale DNS zones
Fix Fix missing import of AccountFilesystem service in the File Manager’s edit endpoint

Feature Add WordPress Overview page to show WordPress installation details (WP Version, PHP Version, Plugins, Themes, and allow updating, disabling/enabling, and deleting plugins)
Feature Add What’s New page to show the latest updates and changes to the control panel
Improvement Update the Patchstack page to follow the design style of WordPress Overview page
Improvement Interlink the WordPress overview page to the Patchstack page for easier navigation
Fix Patchstack sometimes counting components incorrectly
Fix Patchstack API changed how SiteID and API keys are handled. Integration have been updated to reflect this

Improvement Speed up access logs querying by introducing a hot query table in Clickhouse optimized for logs representation
Improvement Show user-agent in logs, move visitor country info to IP field, merge LiteSpeed Cache response with status code
Improvement Allow auto-refreshing the interface every 30 seconds, add info about data delay

Feature Introduce Photon Optimizer Logs page to show Photon Optimizer logs

Internal Log DNS patch when generic validation errors occur in the DNS Editor.
Improvement Move ns3/ns4 nameservers from dnscluster.dk to ns-infra.nl to limit impact in case of TLD or domain issues. (Only applies to new domains created after this date.)
Feature Introduce Access Logs page to show website logs

Fix After saving a file in File Manager, clicking the “Up one level” button would send you to the root directory instead of the parent directory. This has been fixed.

Improvement Unset a set of wp-config.php options upon clone that may result in unexpected behavior
Improvement Add --skip-themes and --skip-plugins to the WordPress installer to speed up the installation process

Feature Implement “Scan for WordPress” feature to detect WordPress installations on domains and subdomains
Improvement Replace APEX Charts with FluxUI’s own charts for statistics
Improvement Enhance the PHP error and 5xx error log tables by making them consistent with others, and switch to relative timestamps for 5xx errors
Improvement Add HTTPS and DNSSEC related query metrics to DNS Statistics
Internal Change Software Installations model to use a polymorphic relationship for domain/subdomain models (domainable).
Fix Password Strength bar didn’t work on WordPress installation page

Fix Determine Valkey Max Memory settings correctly based on the plan, and validate accordingly instead of fixed values
Internal Composer and npm package updates

Security Improve the security of the Provisioning API by introducing a new ACL group for the provisioning API itself
Internal Prepare for migration of lego from version 4.x to 5.x
Internal Disable random-sleep in lego to speed up certificate issuance
Internal Introduce ARI (ACME Renewal Information) to optimize certificate renewal process
Internal Upgrade lego to version 5.x
Internal Remove debug information from ProcessCreateDnsZone job
Fix Check for record coexistence didn’t account for reverse order of records when checking for conflicts and resulted in generic validation errors
Fix When adding multiple records at once, changing the record type would update the placeholder text for all new records, resulting in incorrect placeholder text
Fix File Manager couldn’t deal with non-UTF8 file names such as ISO-8859-1 encoded files
Fix Switch to new JetBackup API endpoint
Improvement Debounce field edits in DNS Editor by 1000ms to prevent excessive re-renders

Internal Deploy new acme-challenge system to use PowerDNS as the DNS backend instead of acme-dns
Fix Set a default TXT record value for _acme-challenge subdomains to bypass NXDOMAIN caching from resolvers and speed up certificate issuance

Internal Data migration for rewritten acme-challenge setup, including cleanup of old unused records

Internal Composer and npm package updates
Improvement Switch node.js handling to use LiteSpeed nodejs integration instead of nginx

Improvement Persist DNSSEC keys for domains upon deletion of domains, to allow restoring the same key when re-adding the domain on the same account
Internal Composer and npm package updates
Fix Correct some broken database migrations

Internal The audit logging of WordPress Clone feature has been improved with additional information
Fix Do not allow deleting domains and subdomains that have WordPress installations tied to them (requires deletion of the WordPress installation first)

Internal Composer and npm package updates

Fix Mail Routing models not being deleted correctly upon domain deletion
Feature Allow setting NS records on subdomains to allow sub-delegation, e.g. for services like Klaviyo

Internal Move imunify360 webserver reload job to be handled by the panel queue system to increase reliability

Improvement Split the SSL reload hook into separate jobs for issuance and renewal to delay the reload until after the certificate has been renewed
Fix Handle bug in certificate issuance where it doesn’t increase the retry interval after a failure
Internal Update composer packages

Security Upgrade Roundcube webmail to 1.16.14

Fix Handle unsuspension better to ensure cronjobs are reenabled as expected

Internal Composer and npm package updates
Improvement Add Blaze support to speed up Blade components with a 5x to 100x performance improvement for File Manager
Improvement Replace progress bars with Flux native progress bars
Feature Allow cloning to www. version of a domain in the WordPress Clone feature
Fix Always search and replace both www and non-www versions from the source domain when cloning WordPress

Feature Implement adding ARPA domains as DNS zones
Internal Composer and npm package updates

Fix Reduce cache TTL for 400 to 499 status codes in Varnish for Photon Optimizer
Fix Correct an error in DNS Editor for options that may result in a 500 internal server error
Internal Composer and npm package updates

Internal Upgrade to Laravel Livewire 4
Fix Log additional information when vhost generation fails and reprocess the job

Internal Fix idn_to_utf8 errors caused by PHP 8.4 fatal errors
Internal Upgrade PHP 8.3 to PHP 8.4 for the control panel

Feature Release PHP 8.5 on all servers and make it available in the panel
Fix Use certificate_renewal_days config option for HTTP-01 challenge certificates
Improvement Prevent overlaps with SSL issuance tasks
Internal Add tooling for self-signed certificates

Security npm and composer package updates that fix CVE-2025-64500
Change Increase max-allowed-packet to 512 megabytes in WordPress cloning functionality
Change Add a note on the Edit DB modal that clicking save changes the password to the shown password in the modal
Internal Add initial work on ingesting installed plugin versions to warn about WordPress vulnerabilities
Internal Add initial work on automated uptime monitoring for reseller accounts

Fix Delete mail routing when a domain is deleted
Fix Exclude trashed domains from uniqueness check when making a WordPress clone
Fix Do not delete previewr.eu subdomain on temporary domain deletion and only remove the vhost
Fix Use prime256v1 instead of secp256k1 due to lack of support from BoringSSL
Improvement Implement self-signed certificate on domain creation to handle Cloudflare SNI matching
Improvement Implement ACME HTTP-01 challenge to handle Cloudflare SSL issuance breakage and use it only in emergencies
Internal Handle customer ACME HTTP challenge endpoints within hosting-panel.net
Internal Expand terminate account call with additional cleanup and audit logs
Internal Package updates through composer
Internal Move some information to Sentry logs instead of Sentry exceptions

Change Include Photon Optimizer requests and bandwidth in dashboard metrics
Change Extend billing maps to support multiple super users per account
Improvement Move Patchstack pages to Livewire components to speed up loading time
Improvement List both IPv4 and IPv6 addresses on super-user account overview
Fix Resolve cases where Patchstack would not show the correct metrics for sites with vulnerabilities where no patch exists
Internal Log JSON responses from Patchstack API in audit logs
Internal Composer and npm package upgrades

Fix Pass domain model instead of ID to the temporary domain deletion job so it deletes correctly
Internal npm and composer package upgrades
Feature Add Patchstack feature for WordPress sites as a paid add-on
Change Update package matching logic for Valkey limits to accommodate multiple packages of the same flavor

Fix Correct FTP account deletion on alias domains by fixing incorrect domainable mapping

Change Enable PSI monitoring for all domains temporarily

Internal Add additional logging for ACME issue hook, webserver vhost generation, and webserver restart jobs
Internal Keep the webserver reload job unique for only 30 seconds to prevent possible stale lock
Change Switch pmg1.h4r.eu, pmg2.h4r.eu, and de-mail01.h4r-infra.net to in1.mail-infra.net, in2.mail-infra.net, and de-mail01.mail-infra.net for reseller purposes

Internal Add soft deletes across Cronjob, Domain Redirect, Email allow/block, FtpAccount, SoftwareInstalation, UrlSchedule, and User models
Internal Add cleanup for old soft deleted models
Security Update composer and npm packages
Internal Remove unused npm packages to reduce bundle sizes

Fix Add uniqueId method to ProcessWebServerReload
Fix Make ProcessMailRouting use uniqueId instead of withoutOverlapping
Fix Replace some SVGs with new versions

Security Update composer packages to latest versions

Improvement Generate preview domain DNS entries when creating a domain or subdomain to prevent DNS propagation issues
Improvement Add Server column to the overview page for super users so they can see which server a domain is located on
Fix Resolve 2FA page issues where modal shadow overlaps the actual modal
Change Confirm 2FA code before enabling 2FA

Feature Add PSI monitoring for all domains on a weekly basis

Fix Improve UI layout for DNS Hosting plans
Fix Show delete domain button on DNS Hosting plans after UI refresh

Internal Update composer and npm packages to latest versions
Improvement Switch new domains to using 2048 bit DKIM keys

Performance Improve the CloudLinux Domains API endpoint with improved logic and prevent N+1 queries
Performance Optimize index usage for subdomain generation

Internal Modify some defaults in Rspamd filtering
Fix Properly provision system FTP account when using the provisioning API

Improvement Rewrite the temporary domain functionality from scratch to provide better compatibility and allow for more features
Improvement Add temporary domain support for subdomains

Fix Various smaller UI changes to be more consistent
Feature Add the option to persist Valkey data to disk and save the setting in Valkey

Fix Properly trigger account suspensions via the provisioning API
Fix Smaller UI changes in regards to badges and margins

Feature Implement allow/blocklist feature for email accounts

Fix Add /usr/local/bin to PATH in cronjobs to expose composer and wp-cli directly

Fix Incorrect alias handling on updates which prevented updating PHP version
Fix Pull Valkey metrics data from the last item in the array to get more up-to-date numbers
Improvement Show full hostname such as nlsh05.shared-infra.net instead of nlsh05 in Server on the dashboard page, and replace IP with hostname in the connection details

Fix Properly delete FTP accounts on subdomains when deleting a domain
Fix Remove duplicate c on cronjob placeholders
Internal Add additional audit logging for delete features
Internal Change Add Domain form to use App\Models\.. instead of s and d
Internal Move to Auth facade across the codebase

Internal Add additional chunk patch validation in File Manager uploads to further increase security

Improvement Add historical Valkey statistics and graphs

Feature Add initial Valkey statistics

Internal Move to polymorphic relationships for alias domains and domain ACME credentials
Internal Update to the latest composer packages and remove the Flowbite dependency to reduce CSS and JS assets
Improvement Standardize more UI elements
Improvement Redesign the dashboard page
Fix Fix domain alias counting logic to allow adding alias domains even when the domain limit has been reached and add a callout when that happens

Internal Change backoff for vhost jobs to 5, 10, and 20 seconds to allow for in-progress webserver restarts
Improvement Detect PHP version to use for source and destination domains in WordPress installer and clone functionality depending on the configured domain PHP version
Improvement Refactor WordPress install and clone plus File Manager pages to use new UI components, and make Generate Password an actual button on the Add Email page
Fix Determine upload path correctly on the initial change-directory call in File Manager when uploading new files

Improvement Add example command helper text when creating cronjobs and update the form layout slightly
Improvement Make add and edit forms for domains and subdomains usable on mobile devices
Fix Show Photon Optimizer in the menu when using a mobile device
Fix Correct the spacing between quick action buttons on mobile devices

Internal Move Photon Optimizer provisioning to a separate background job
Feature Allow purging the Photon Optimizer cache per domain under Tools -> Photon Optimizer

Fix Restore ApexCharts tooltip colors
Improvement Move Photon Optimizer handling to dedicated pages to allow future development

Improvement Change some UI elements to be based on FluxUI, including buttons, tables, and callouts
Improvement Make domain dropdowns in Email and Stats pages searchable
Improvement Paginate URL Scheduler and Cronjob pages
Fix Adjust File uploader to account for storage location change
Improvement Change page breadcrumbs to the new layout and make items linked to parent pages when supported

Internal Change the reseller memory limits
Internal Update Laravel 11.x to 12.x, Tailwind CSS 3.x to 4.x, and FluxUI 1.x to 2.x

Infrastructure Fall back to the original image in case of negative savings on WebP or AVIF served images in Photon Optimizer

Fix Temporarily disable model caching for domains to resolve alias domain PHP version synchronization

Infrastructure Move Photon Optimizer workers to 7900-based systems for increased performance

Feature Add feature to export DNS zone in AXFR format
Internal Add additional logging for various components
Maintenance Update composer packages

Improvement Allow using domain ID or domain in the DNS zone editor URL for easier bulk updating
Fix Add additional checks during WordPress clones to ensure wp-config.php updates have been committed to disk
Fix Resolve the domain correctly in the WordPress Installer notification and toast

Feature Add PHP 8.4 support and set it as the default for new domains
Internal Add additional symbols for Rspamd to filter spam
Internal Log the updated accounts for quota metrics

Feature Add support for customer sieve mail filtering through webmail

Improvement Normalize incoming headers for Photon Optimizer to increase cache hit ratio and savings

Feature Allow defining a cronjob expression instead of fixed values, giving you more control of cronjob execution

Fix Delete FTP accounts on domain deletion
Fix Expose correct document root for alias domains in the CloudLinux API

Internal Add client IP address to remaining audit logs
Improvement Persist LVE limits locally to remove CloudLinux API dependency

Internal Add force option for account suspension
Internal Improve email quota API endpoint to reduce SQL queries
Internal Implement skipMailServer flag for hosting account and user quota jobs
Fix Resolve bug with vhost generation for subdomains
Feature Implement reseller functionality to create packages and accounts and edit accounts
Improvement Handle reseller and superuser redirection better

Infrastructure Replace Falkenstein, DE with Amsterdam, NL caching infrastructure for Photon Optimizer

Infrastructure Add Miami, US as a cache location for Photon Optimizer

Fix Resolve Alpine.js error in File Editor
Internal Delete Node.js applications upon account termination
Improvement Clarify usage of mail ports on the Email overview page

Improvement Add Los Angeles, US as a third cache location for Photon Optimizer

Improvement Allow serving AVIF and WebP support for Google PageSpeed Insights in Photon Optimizer

Improvement Add Singapore, SG as a second cache location for Photon Optimizer to cover Asia

Feature Add distributed caching support to Photon Optimizer and add the first cache location in Ashburn, US

Improvement Add better validation for domain counting when adding domains
Improvement Do not count alias domains in the domain count, effectively providing unlimited alias domains
Fix Show all Valkey and Redis memory options by correcting package detection
Feature Allow changing mail routing settings from Domains -> Dropdown -> Mail Routing

Internal Add internal API route for server metrics
Internal Add two-way consistency checks to alert on possible data sync issues

Improvement Change the file uploader to a custom JavaScript implementation for future features
Improvement Move notifications in WordPress clone functionality to websockets for realtime updates
Internal Refactor API routes

Improvement Add missing tools to the mobile menu
Fix Solve UI issues related to charts on the Stats page

Fix Pass all request headers through to Node.js applications

Fix Correct the condition that prevented users from saving files in File Manager
Internal Speed up internal job processing

Fix Refresh File Manager view correctly when using the browser back button according to the working directory

Feature Add Valkey (Redis) Manager feature
Improvement Allow stats filtering for subdomains
Fix Improve exception handling and error messages for File Manager Edit on unreadable files
Internal Rework File Manager related code
Fix Hide symlinks from the File Manager overview
Fix Prohibit creating files and directories with names . and .. since it will fail regardless
Security Ship a hardened pure-ftpd binary with virtualchroot disabled and remove the EPEL upstream package

Improvement Implement initial websocket support for streamlining backend notifications
Feature Add rename file and directory functionality in File Manager
Internal Refactor File Manager code

Fix Fix SSO due to Carbon 3 incompatibility

Internal Upgrade Laravel to Laravel 11

Improvement Start downloading files immediately from buffers when using File Manager

Feature Implement file upload and fix issue #53

Internal Enhance internal metrics with URL Scheduler delay

Improvement Enable line wrap when using the editor

Fix Bypass internal buffering that prevented downloading large files
Fix Send content-length header when downloading files
Fix Send the correct filename when downloading from subdirectories
Improvement Do not allow editing certain file types such as images

Feature Add initial File Manager support for browse, edit, create file and directory, delete, and download

Feature Expose the last 25 5xx request and PHP error logs on /stats
Improvement Disable chart animations to speed up rendering
Internal Add tooling to resync all vhosts for config updates

Improvement Change table heading design and improve responsiveness
Improvement Make modals center on mobile devices as well
Internal Move the Flowbite dependency internal and upgrade it to 2.3.0

Improvement Move PHP error logs to /logs/ for all domains

Feature Release Node.js applications functionality
Internal Disable profiling on the internal CloudLinux API
Internal Improve PAT performance for the internal CloudLinux API

Internal Implement Prometheus endpoint to expose domain count

Improvement Gather more information when issuing or renewing certificates fails
Fix Do not allow deleting domains if existing Node.js applications are tied to the domain
Cleanup Remove unused templating
Improvement Switch the Node.js overview page to use shared modals
Improvement Allow updating domain path, startup script, and Node.js version for applications
Improvement Add FTP configuration box on the FTP overview page

Fix Fix provisioning accounts with internationalized domains when idn_to_ascii is unavailable
Fix Prevent the Domains page from returning an error when no domains exist because of shared modals

Improvement Bump the default PHP version for new domains and subdomains from PHP 8.2 to PHP 8.3

Feature Add the initial internal release of Node.js support
Fix Apply minor Tailwind CSS class fixes
Maintenance Upgrade composer packages
Improvement Rewrite cronjob and domain pages to use shared modals because of slow DOM performance

Feature Extend account deletion logic

Improvement Add more Sentry metadata
Fix Fix DNS Editor replacement and move the local change to a new tag
Improvement Move scripts around internally on all servers
Fix Make password reset trigger the correct system FTP account password reset
Fix Ensure SSL renewals on subdomains take GTS and LE into account and move the local change to a new tag
Fix Move SPF from _relayspf.hosting4real.net to spf-record.net
Fix Prevent account migration from double hashing passwords
Fix Make reseller account matching from WHMCS trigger correctly during account provisioning
Fix Increase internal CloudLinux API rate limits to prevent 429 Too Many Requests during data synchronization
Improvement Show quota usage in percentage next to MB usage and highlight it when reaching 90%

Improvement Expose raw DNSKEY for registrars that do not support digests on the DNS page

Fix Count correctly on paginated pages
Fix Remove domain limit for subdomains
Feature Expose API endpoint for returning Photon Cache IPs for WAF, IPS, and IDS allow lists

Feature Implement per-domain statistics

Improvement Prevent flickering by increasing wire:loading to 1000ms for DNS

Improvement Add new logo

Improvement Improve stats performance by switching to ClickHouse materialized views

Fix Fix Add Email button by forcing it as a link internally

Internal Rework graph generation to support better templating

Improvement Make HTTP stats available

Feature Add stats page with weekly and monthly views for DNS

Security Emergency upgrade Laravel Livewire to 3.4.9 to resolve XSS
Improvement Triple email storage
Fix Fix notifications not displaying correctly for domain and subdomain updates
Fix Remove wire:navigate.hover because it appeared buggy overall

Improvement Change layout of the primary dashboard
Fix Resolve the $persist issue triggered on the login page
Feature Expose Photon Optimizer metrics on the primary dashboard

Improvement Expand Photon Optimizer support to subdomains

Feature Add basic account metrics for DNS queries, HTTP requests, and HTTP traffic for the past 7 days

Change Send user ID and domain ID to Photon Optimizer to allow statistics generation for the panel

Change Switch to domainable morph to allow future support for subdomains for Photon Optimizer

Improvement Allow enabling www. setting for Photon Optimizer
Change Decrease shared memory cache to 300 seconds to accommodate www. settings

Feature Release the basic version of Photon Optimizer for WebP and AVIF delivery
Fix Fix password strength generation when filling out passwords manually in the WordPress installer

Improvement Persist domain data locally on servers to reduce internal CloudLinux API calls in stage 1

Improvement Change MX priority from dropdown to text field to allow more priorities
Improvement Default to the first domain in the dropdown on the Add FTP Account page
Improvement Configure Sentry for exception handling
Improvement Add additional validation for domains to use the internal RBL service
Fix Fix 500 internal server error caused by incorrect notification handling when enabling DNSSEC

Fix Reload subdomain vhost on subdomain SSL issuance
Improvement Lock release on vhost processing after 30 minutes
Fix Allow deleting WordPress installations when a domain has been deleted

Improvement Invalidate existing login session when logging in with SSO
Feature Implement PHP X-Ray from CloudLinux
Improvement Enable default none policy for DMARC on zone creation
Feature Implement SSO from shop.hosting4real.net to hosting-panel.net
Fix Fix missing styles that broke 2FA login
Improvement Upgrade the internal Livewire framework to 3.x and Jetstream to 4.x
Improvement Switch to using Livewire forms throughout the panel
Improvement Standardize modals and notification banners throughout the panel

Improvement Add username as part of reset password email

Fix Fix email setting updates that failed without setting a password

Feature Allow changing email passwords in RoundCube webmail

Feature Allow disabling Rspamd spam filter and setting reject score and feed this into the Rspamd cluster

Feature Add PHP 8.3 support and keep PHP 8.2 as default until i360.so releases
Improvement Move PHP version management to a central location

Improvement Add info about connecting via SSH, SFTP, and RSYNC in the panel

Improvement Move DNS backend from MySQL to LMDB with Lightning Stream

Feature Allow account-wide phpMyAdmin access through temporary users

Improvement Add info about external DNS usage and _acme-challenge subdomains
Improvement Add overall mail config box to the Emails page

Improvement Allow mass synchronization of SSL certificates to Imunify360 on a given server

Fix Properly synchronize SSL certificate uploads during domain migration
Fix Fix virtual host generation to include the proper IPs during migration
Improvement Implement several migration tools for migrating accounts between servers

Feature Add FTP support
Improvement Automatically generate DKIM for servers upon deployment

Feature Allow adding a domain during account creation for an easier ordering flow

Feature Add PHP 8.2 support
Improvement Add ACME DNS record checker
Improvement Promote DNSSEC feature to stable and show it by default

Fix Improve SRV validation to give more meaningful errors
Improvement Add ns2 and ns4 nameservers
Fix Prevent forwarders from looking at deleted records during validation
Fix Disable API rate limiting for trusted IPs
Fix Fix UI when cronjobs or URLs in URL Scheduler get too long

Improvement Update internals from PHP 8.1 to 8.2
Improvement Update Laravel to 10.x
Fix Default user_type to user

Feature Allow initial reseller functionality
Fix Handle punycode xn-- domains better for SSL issuance by falling back to LE instead of GTS
Improvement Do not allow www subdomain to be created since it is mapped to the main vhost

Feature Implement provisioning API for shop.hosting4real.net

Improvement Switch from Google Fonts to Bunny Fonts
Feature Add support for alias domains

Feature Add SSL support for subdomains for admins

Improvement List IDN domain format

Overview

Changelogs

Domains

cPanel

General

DNS Hosting

Grid Hosting