What's new in KoaPanel

0.90.0

Installation with panel name, certificate and key for KoaBilling

Whoever installs can choose the panel name with parameters, get the certificate right away and receive at the end the key that connects it to KoaBilling.

• NewInstallation: with --hostname you choose the name of the panel and the Let's Encrypt certificate arrives by itself, if the name already points to the server and port 80 is open.
• NewInstallation: with --koabilling, at the end you get the address and the API key to paste in KoaBilling. With --license you activate the license too: without it, the panel answers (the key included) only after the account is linked. On the server, as root, you can also create a key later with the command panel-agent apikey create.

0.89.2

More reliable migrations from Plesk and cPanel

Real migrations from Plesk and cPanel showed errors that lost sites, aliases and mail, sometimes with no warning. They are now fixed.

• FixedFrom Plesk 18 all the sites of a subscription arrive: additional domains and subdomains disappeared with no warning, with a "succeeded" result. Domain aliases, the PHP version of each site and mail aliases arrive too.
• FixedThe backup of a whole Plesk server is recognised and split by subscription, with the customer as the suggested account. Before, it became a generic import, with no sites and no mail.
• FixedA Plesk address that only forwards stays a forwarder: it no longer becomes a mailbox with a new password to hand out.
• FixedFrom cPanel an addon domain arrives with its own name: before, it arrived as the technical subdomain of the main domain and its mail was left with no site.
• FixedOld cPanel with an expired licence: the panel showed zero accounts without saying why. Now it reads accounts and databases from cPanel's files and says so.
• FixedFinal sync: with more sites the report lost the results and the copy errors of all but the last one; into a new account the messages arrived in the meantime were not copied.
• FixedThe one-click switch no longer turns on cron jobs that cannot work: the site folders and the PHP of Plesk and cPanel become the ones of this server.
• FixedWith rsync and direct copy the domain aliases and the PHP version of each site stay; the technical subdomain of an addon domain no longer becomes a duplicate site.

0.89.1

The panel finds the public address behind NAT too

On a server with a private IPv4 behind NAT, the panel did not see the public address and used the IPv6 only. Now it finds it by itself.

• FixedServers behind NAT: the panel finds by itself the public IPv4, which does not appear on the network interfaces. Before, it saw the IPv6 only and said that a domain did not point to the server (for example in Security › Certificate). The addresses saved in DNS › Public address of the server still come first.

0.89.0

A complete firewall, like the one of WHM

Security › Firewall becomes a complete firewall: ports by service, Allow / Block / Ignore lists with expiry, search an IP, register of the blocks, sign-in protection for every service (the panel too), permanent block, countries, flood, lists of malicious addresses, alerts and a security score. With test mode, if a change locks you out the panel puts everything back.

• NewFirewall: ports by service (websites, SSH, panel, mail, FTP, DNS, databases), with who can reach them: everyone, some addresses only or nobody, in one click. SSH and the panel are never closed to everyone.
• NewFirewall: Allow, Block and Ignore lists for the whole server, with note, author and expiry (from 1 hour to for ever), also on the linked servers.
• NewFirewall: "Search an IP" tells where an address is blocked (lists, fail2ban, sites, rules) and unblocks it everywhere in one click; the register shows the blocks and unblocks of fail2ban and of the panel and the addresses blocked most.
• NewFirewall: test mode (on by default). After a risky change you have 5 minutes to confirm; without a confirmation the panel puts the previous configuration back.
• NewProtection: thresholds of the sign-in attempts for every service, the panel sign-in included (not protected by fail2ban before), and permanent block for whoever is blocked several times.
• NewProtection: block by country (or only some countries allowed), on every port or only on some services; the panel won't save a choice that would lock you out.
• NewProtection: connection limit per address, flood and port scans; Spamhaus DROP and DShield lists updated every day; outgoing mail from the mail server only (an infected site can't send spam by itself).
• NewEmail alerts to the administrators: address blocked for good, SSH sign-in from an address never seen, possible attack (also shown in the alerts on top).
• NewSecurity check with a score out of 100 and the things to fix, each with the button that takes you where it is done.
• ImprovedThe Security page is divided into tabs: Firewall, Access (fail2ban and two-step sign-in), Certificate and Terminal.

0.88.0

PHP processes set from the panel

The PHP processes of every site (how many, in which mode, with how many spare) are set from the panel and stay after the updates. The panel warns when a site runs out of them and suggests the value from the server's RAM.

• NewSite PHP settings: "PHP processes" (pm.max_children, up to 200), ondemand, dynamic or static mode, processes at start, minimum and maximum spare and requests per process. Administrators and resellers set them, within the account's package.
• NewPHP versions: "PHP processes per site", the value of the whole server for the sites without their own, with a suggestion computed from the server's RAM.
• NewA warning when the PHP-FPM log reports "reached max_children" (the site used all its processes and requests waited), with how many times in the last 7 days and a button to raise them.
• NewPackages and resellers: the maximum PHP processes per site.
• ImprovedAt the first start after the update, the process values changed by hand in the pool files become site settings, so they are not lost when the pool is rewritten.
• ImprovedIsolation and limits: the default limits in use (RAM, I/O, CPU) are saved in the panel, so a new version with different starting values does not change the server's.
• FixedSite rules: the error messages of the limit of requests and of the CDN are now in English and French too.

0.87.0

Busy sites: limit of requests, CDN and most active addresses

A limit of pages a minute per address stops the scripts downloading the whole site even when they change address. Behind a CDN the panel sees the visitors' real address, and in the Logs you find who asks the most pages, with "Block" next to them.

• NewSite rules: "Limit the requests per address", with pages a minute (20 proposed) and a margin for the peaks (40 proposed). Over the limit the visitor gets error 429. Static files and the server never count; with the proposed options neither do the users signed in to WordPress, Google and Bing. A list of addresses always allowed.
• NewSite rules: "The site is behind a CDN" (1PrimeCDN, Cloudflare or another). IP blocker, limit of requests, fail2ban and the WordPress sign-in limit see the visitor's real address, taken from the CDN's header only for requests coming from its nodes. Cloudflare's addresses are updated every night.
• NewSite logs: "Most active addresses" in the last 15 minutes, the last hour or the last 24 hours, with the pages asked, the requests stopped by the limit, the declared browser and the "Block" button.
• ImprovedIP blocker: every blocked address can have a note and shows the day it was blocked.

0.86.1

Clearer real-time disk and no Chrome autofill

In "Limits and usage › Real time" the disk is measured over the last 30 seconds, small values read in KB/s and there is a row for the database and the system services. Chrome no longer writes the panel password in the key fields.

• FixedFields for keys and passwords of external services (Anthropic key, tokens, FTP and SSH passwords and others): Chrome wrote the panel's saved password in them and the user name in the menu search field. It no longer fills them.
• ImprovedReal time: disk and IOPS are measured over the last 30 seconds instead of the last 3 (writes reach the disk in bursts every 5–30 seconds), under 1 MB/s they read in KB/s and small IOPS with one decimal, so a working site no longer shows 0.
• NewReal time: "Database and system services" row (MariaDB, PostgreSQL, Redis, mail) for the administrators. With WordPress most of the disk is used by the database, which is not in the site's row.

0.86.0

KoaPanel AI: the assistant without a key, with the licence's credits

The AI Assistant works without entering a key: every licence, free ones too, includes 100 Haiku and 5 Sonnet calls a month. Deep analysis with Sonnet, a PRO subscription, nightly check of the sites with problems only and AI for resellers and users when the administrator opens it.

• NewKoaPanel AI: new default provider of the AI Assistant, with no key to enter. Requests go through the KoaPanel console with the server's licence; the model key never reaches the panel. Every licence, free and distributors' ones too, includes 100 Haiku and 5 Sonnet calls a month. Your own Anthropic key is still possible.
• NewAI Assistant: box with this month's credits (Haiku and Sonnet used and left) and "Upgrade to PRO": KoaPanel AI PRO, €29 a month, with 3,000 Haiku calls and Sonnet up to €10 a month.
• NewAI Assistant: "Deep analysis (Sonnet)" under a diagnosis and in the debug chat. When Haiku does not find the cause, Sonnet looks again by itself once, while credits are left. Every result says which model answered.
• NewAI Assistant: the administrator can open the diagnosis, the debug chat and "Ask the AI" in the migration to resellers and users, on their own sites, with the server's credits or key. Fixes that change the whole server stay with the administrators.
• ImprovedAI Assistant: with KoaPanel AI the nightly check of all sites sends to the AI only the sites showing problems (5xx errors, errors in the logs of the last 24 hours, antimalware findings, migration check not green); the others use no credits.
• ImprovedSite builder: the draft written with the AI can be longer.
• ImprovedAI Assistant: the diagnosis for resellers and users is now closed until the administrator turns it on in the settings (before, it appeared to everyone as soon as a key was set).

0.85.0

A more precise antimalware, also in the database

The antimalware recognizes the original files of wordpress.org and does not flag them, checks the WordPress database too, puts the official file back in place of the infected one and works on several findings at once.

• NewAntimalware: files identical to the originals of wordpress.org (WordPress, plugins and themes of the official directory) are no longer flagged by the heuristic rules, neither in the scans nor in real time. ClamAV signatures always count.
• NewAntimalware: check of the WordPress database (read only): obfuscated scripts in posts and settings, site address pointing to another domain, new administrators since the first check.
• NewAntimalware: "Put the original back" downloads the official file of the installed version of WordPress, of the plugin or of the theme, checks it against the published checksums and puts it in place of the flagged one. The previous file stays in the quarantine.
• NewAntimalware: actions on several findings at once (quarantine, originals, false positives) and, for administrators, false positives valid for every site of the server.
• NewAntimalware: new rules for SEO spam redirects and images run as PHP in .htaccess files, includes with a hidden name, small upload scripts, administrators created in the code with the password written in it, obfuscated JavaScript (also in .js and .html files) and spam mailers.
• ImprovedAntimalware: every finding also says what to do.
• NewReal-time protection: option to quarantine at once the PHP files written in the WordPress uploads (off until you turn it on).

0.83.1

Antimalware without false alarms

The antimalware no longer flags the ordinary files of plugins and applications as suspicious, and findings the new rules do not confirm close by themselves at the nightly scan.

• FixedAntimalware: nightly scans check only the changed files, so findings made with older rules stayed open until a full scan. Every scan now checks again the files with an open finding and closes those that are no longer confirmed.
• FixedAntimalware: "Obfuscated data blob" no longer flags images and fonts embedded in the code, certificates and the encrypted settings of Scriptcase applications.
• FixedAntimalware: "Nested decoding" flags only data hidden in the file itself, written to another file or in a file that can run code, not plugins decoding their own settings (WPML, Formcraft, IP Location Block).
• FixedAntimalware: "Code written with escape sequences" flags only escapes that hide dangerous names, not the character tables of libraries.
• FixedAntimalware: "PHP file in the uploads folder" recognises Sucuri's data files, the guard pages of plugins and the templates of Ajax Load More.
• FixedAntimalware: a WordPress file that differs from the original only by blank lines at the end is no longer "modified".

0.83.0

Migrations that resume, site check and one-click cutover

Migrations resume from where they stopped, every imported site gets a traffic light and “Complete the cutover” runs sync, DNS, SSL and cron in one click, at night too. Plus: hybrid method for cPanel, full DirectAdmin, many accounts in one procedure, function search and a menu in groups.

• NewCheck after every migration: each imported site gets a traffic light (works, to check, does not work). The panel compares the home page and up to 10 pages on the old and the new server, before the DNS change too; it checks the resources that are missing or point to the old domain, the PHP and nginx errors, the WordPress sign-in, the old server's paths in the configuration and in the cron jobs, the mail to move.
• NewComplete the cutover, now or at a time you choose: final sync, check, DNS change (automatic where the panel manages the zone) only for the sites that work, SSL certificates as soon as the names point here (tried again for 48 hours) and the imported cron jobs turned on.
• NewCheck before the migration: for each site, before copying, the risks already visible (a missing PHP version, files encoded with ionCube or similar, .htaccess rules, paths of the old server, very large databases).
• NewA migration over SSH that stops starts again from where it was, with “Resume the migration”: the accounts already downloaded are not downloaded again, and running a migration again makes no duplicate databases or cron jobs. “Retry the failed ones” migrates only the accounts or sites that failed.
• NewHybrid method for cPanel: the cPanel backup brings the configuration, databases, cron and DNS, while files and mail come with rsync. It brings everything, the old server needs no room for an archive of the files, and the copy resumes if the connection drops.
• NewDirectAdmin: DirectAdmin backups are imported (sites, databases, mailboxes with their original password, forwarders, cron and DNS), and the migration over SSH as administrator uses the DirectAdmin backup of each user.
• NewBackups with many accounts in one procedure: the list of the accounts found, a choice and a destination account for each, one job with one summary.
• ImprovedFaster migrations: while an account is downloaded, the old server prepares the next one and the previous one is extracted here; databases are imported three at a time; the migration from WordPress reads the tables by key and in parallel. Bytes and estimated time for databases and mailboxes too.
• ImprovedA safer final sync: it also removes here the files deleted on the old server (only the ones that came with the migration), puts the old WordPress sites in maintenance during the last copy of the databases and copies the mail arrived meanwhile. With the panel key it no longer asks the password.
• ImprovedMigrations no longer have a 2-hour limit and have their own queue: they stop only if they make no progress for 30 minutes, and backups and updates no longer wait for them. A site that cannot be copied no longer stops the others.
• ImprovedBackups uploaded from the browser in pieces: if the connection drops it starts again by itself, and “Resume the upload” goes on after a closed page. There is no longer a 10 GB limit per file.
• ImprovedMove between KoaPanel servers: in the final copy the databases that did not change are not copied again, so the site is down for less time.
• NewEmail to the administrators at the end of every migration and every cutover, with the result of the check (System email › Migration ended).
• NewAI assistant in the migration, for administrators: “Ask the AI” on the sites to check starts from the check and proposes one-click fixes, always with a preview and undo (PHP extension, old server path in the configuration, WordPress addresses, Apache compatibility, permalinks and caches). And a debug chat on the site: describe the problem and the AI answers looking at the logs, the configuration and the site's answers. It uses the AI key set by the administrator.
• FixedAntimalware: no more false alarms for WordPress's Hello Dolly and for the files plugins create themselves.
• NewFunction search in the menu, like in WHM: type what you look for (cPanel and Plesk names too) and get to the right page or section; it finds sites and accounts too. Ctrl K or / from any page, and on the phone from the magnifier button.
• ImprovedThe menu is reordered in groups that close; “Server status” and “Settings” become pages with tabs; on the phone “More” is split in groups and the rows are compact.
• ImprovedMore uniform look on every page: the same spacing, headers, empty pages and switches; compact rows on the phone in Services, PHP and Databases; search and filters in Websites; the Audit log with the actions written in full; What's new with the old versions closed.

0.82.2

Forced updates and faster antimalware scans

A forced update no longer sits waiting for the running operations, and antimalware scans use the ClamAV service also where clamdscan was missing.

• FixedUpdates: forcing the update while a long operation was running (for example an antimalware scan of several hours), the panel still waited for it to end before restarting, and meanwhile the check of the new version expired and put the previous version back. The operations are now interrupted as announced and the panel restarts at once.
• FixedUpdates: the minute given to the new version to respond starts only once the previous version has really stopped.
• FixedAntimalware: an interrupted scan stops ClamAV too, which could otherwise keep running for hours.
• ImprovedAntimalware: when the ClamAV service is running but the clamdscan program is missing, the panel installs it on its own at the first scan. Scans go through the service instead of clamscan, which is much slower: on a site with 1.5 million files it took more than four hours.

0.82.1

Antimalware scan history

The Antimalware page has the history of the scans of all the sites, with the result and whether ClamAV ran; every site has its own.

• NewAntimalware › History: the scans of all the sites over the last 1, 7, 30 or 60 days, with the type (nightly, full, by hand), files checked, ClamAV used or not and why, new findings, duration and result. "Only the ones with problems" shows the failed scans, the ClamAV errors and the new findings. The page of every site has its own history at the bottom.
• ImprovedThe last 60 scans of every site are kept instead of 20.
• ImprovedLimits & usage › Live and the bar at the top: small layout touches.

0.82.0

Live usage and site errors

Limits & usage shows the usage of every account second by second, like CloudLinux's lvetop, with the processes and the errors of the sites; at the top of the panel, a bar with the server load and the alerts.

• NewLimits & usage › Live: for every account, CPU, memory, processes, PHP requests being served, disk and IOPS of the last seconds, with a bar against its limits, refreshed every 3 seconds. You see when an account is at its CPU, memory or process limit; a click opens its processes with the CPU of each one.
• NewSite errors, read from the nginx logs: failed pages (500, 502, 503, 504, 508), PHP busy because the account ran out of simultaneous requests, timeouts, PHP out of memory or time, with the last error and a link to the logs. Over the last 15 minutes, the last hour or the last 24 hours.
• NewA bar at the top for administrators and resellers, like in WHM: the server load (with CPU, memory and disk for administrators) and the alerts that need a look, each one linked to its page: failed services, disks almost full, security updates, antimalware findings, expiring certificates, failed backups, sites with errors, accounts at their limits.
• FixedFrench translation: missing spaces in three texts of the migration and of Limits & usage.

0.81.3

ClamAV and images in antimalware scans

Scans use ClamAV again on servers where clamdscan was missing and no longer report ordinary images as dangerous.

• FixedAntimalware: on servers with the clamd service running but without the clamdscan program, ClamAV checked no files (only the panel's own checks ran). The scan now uses clamscan when clamdscan is missing, and the update installs clamdscan.
• FixedAntimalware: an ordinary image could be reported as critical ("PHP code in an image") because its compressed data happened to contain the characters "<?php". It is now reported only when real code follows the opening tag.

0.81.2

Antimalware scans of very big sites

The antimalware scan of a site with millions of files can no longer slow down or stop the panel.

• FixedAntimalware: the scan of a very big site (for example 1.5 million files) filled the panel's memory, which stopped answering until it was restarted. Every scan now runs in a memory group of its own (a quarter of the RAM, at least 1 GB) and the list of the checked files is written to disk as it goes, instead of staying in memory.
• FixedAntimalware: the incremental scan of a site with millions of files could fail because the list of files went over 256 MB.
• ImprovedThe panel frees memory before reaching its service's limit, instead of being slowed down by the system.

0.81.1

Migrations: www alias, memory_limit and antimalware paused

Migrations from cPanel, Plesk and other servers also bring the sites' www alias and PHP memory_limit; the real-time antimalware does not check the files while the migration writes them and scans the sites at the end.

• ImprovedMigration: the new site of a main, addon or parked domain also answers on www., as on the old panel; subdomains don't.
• ImprovedMigration: the old server's PHP memory_limit goes into the site's PHP settings when it was higher than the default. The panel reads it from the domain's PHP settings on Plesk (from the backup or over SSH), from MultiPHP Manager on cPanel and from the php_value lines of the .htaccess, which PHP-FPM would ignore.
• ImprovedReal-time antimalware: paused for the sites a migration or a final sync is writing, with a scan of those sites at the end, instead of thousands of checks and alerts during the copy.

0.81.0

Migration with rsync and final sync from files too

The migration over SSH can copy with rsync straight into the site's folder, with no archives; migrations from backup files have the final sync; you can import into a new account with the name you choose.

• NewMigration over SSH: choice of the copy method between the source panel's backup and rsync straight into the site's folder. With rsync no archives or intermediate space are needed, an interrupted transfer resumes and the databases are copied one by one.
• NewMigration from a backup file: final sync. From the migration's page you link the old server over SSH; the panel finds the folders of the domains and the access to the databases and brings here the changes made after the backup.
• NewMigration: "New account…" for administrators, for any source (Plesk, DirectAdmin, CWP, any server, from a file or over SSH). The account is created when the import starts, with the chosen name, email and package.
• NewLimits & usage: the sites without an account (the administrator's, with no resource limits) at the top, with the choice of the account to assign them to.
• NewLink the old server: the panel key can be used too, besides password and private key.
• ImprovedMigration: progress of the file copy with the bytes copied, and the Stop button really stops the copy in progress.
• ImprovedReal-time antimalware: repeated alerts on the same file are grouped in one row with the number of repetitions; fewer false positives on plugin files (for example MailPoet's Twig templates).
• ImprovedCertificates: the email for Let's Encrypt is optional.
• ImprovedWordPress: if wp-config.php has no "stop editing" line, WP-CLI adds it instead of failing (for example when enabling Redis).
• FixedDatabase import: a dump with a backslash at the end of a string was read wrongly and the table ended up as "SQL statement too large"; it is now imported.
• FixedMigration: when a database is not imported, the report says so with a note instead of showing it as completed.
• FixedPanel certificate: port 443 answers with the panel only on the IP address, not on the domains of sites not configured yet.
• FixedProcesses: the ps command started by the panel itself no longer shows at 100% CPU.
• FixedWordPress › Tools: the buttons no longer leave an empty space.

0.80.3

Fast analysis of backups with many files

The analysis of a backup with hundreds of thousands of files no longer stays stuck for hours, and the Migration page shows the list with the operations in progress.

• FixedAnalysis of a backup with many files (for example a million): listing each folder scanned the whole archive and the analysis could take hours. It now takes minutes.
• ImprovedThe Migration page always opens on the list; extractions and downloads in progress are at the top, each with an Open button.
• ImprovedActivity: the extraction and the download of a backup have a readable name.

0.80.2

Analysis of big archives with progress

The analysis of a big backup shows the extraction with its bar, also after reloading the page.

• ImprovedAnalysis of a backup of 1 GB or more: the extraction is an operation with a bar (read, speed, estimated time) and the analysis comes when it ends, instead of a waiting page that could time out.
• ImprovedA backup of 1 GB or more downloaded or uploaded to the panel is deleted as soon as it is extracted, to leave room for the import (a file already on the server is never touched).
• FixedAnalysis of a backup with no databases or cron jobs: the page broke (Cannot read properties of null). Empty lists now arrive empty.
• FixedPlesk backups: a dump still compressed in databases/<name>_<n>/backup_sqldump_* is recognised as a database.
• ImprovedThe analysis of a big backup is made once, in the background with the extraction, and kept: opening the backup again shows it at once.
• FixedReloading the Migration page while a backup is extracted or downloaded, the page shows the operation in progress instead of going back to the first step.

0.80.1

Plesk 18 backup databases and panel stop

The import finds the databases of Plesk backups also when the index describes them elsewhere, and the panel no longer waits long for a stuck operation when it restarts.

• FixedPlesk backups: the databases saved in databases/<name>_<n>/ (backup_sqldump_….tzst) are always found and imported, also when the backup index describes them where the analysis did not read; domains nested deeper in the index are read too.
• ImprovedDownload of a backup from an address (https, ftp, sftp): a bar with transferred, speed and estimated time instead of a log line every 2 seconds.
• FixedPanel restart and update: running operations are still waited for, but not those stuck for more than 10 minutes (a stopped transfer kept the panel stopping for 25 minutes).

0.80.0

Safer migration from Plesk: space, method, exclusions and panel key

The migration over SSH checks the space on the old Plesk server before it starts, lets you choose between the Plesk backup and the direct copy, and can connect without the root password.

• NewMigration over SSH from Plesk: in the "What to import" step choose between the Plesk backup (complete, with mail, DNS and cron) and the direct copy of files and databases (no temporary space on the old server).
• NewBefore it starts, the panel checks the free space on the old server: the Plesk backup needs about twice the subscription. When it is not enough it says so, with the GB needed and the GB free, and proposes the direct copy instead of stopping halfway.
• NewPanel key: instead of the root password you paste on the old server a command with a temporary key, which the panel removes by itself at the end.
• NewThe analysis reports the files anyone can download from the sites' public folder: database dumps, archives, backups and .env files.
• ImprovedCopy of the files: by default dumps and archives in the site's folder, Wordfence logs and the *-backups folders also stay on the old server; you can add folders and files of your own to leave out.
• FixedMigration over SSH of accounts over 20 GB: the transfer stopped at 20 GB with no error. Now the limits follow the size of the account and a write error stops the command on the old server at once.
• FixedThe time left appears only once the real transfer speed has been measured: no more "about 3 minutes" for 130 GB.
• Improvedhttp://<address>/ and https://<address>/ take you to the panel on port 8443 instead of not answering.

0.79.0

Remote mail server and item-by-item import

An account's mail can live on another linked server, and importing a backup lets you choose mailboxes, forwarders and scheduled jobs one by one.

• NewRemote mail server: for each account the administrator chooses where the mail lives, on this server or on one of the linked servers. The account and its (empty) sites are created there, and the DNS here publishes that server's MX, SPF and DKIM.
• NewFrom the Mail page the user goes straight into the mail server, with no other password, in a section limited to the mail.
• NewSuspending or deleting the account here suspends or deletes it on the mail server too; new sites get there automatically.
• ImprovedImporting a backup (cPanel, Plesk, CWP): in the preview you also choose mailboxes, forwarders and scheduled jobs one by one, with "All" and "None".

0.78.2

Security fixes

Fixes from the internal security review: database copies of the app updates, symbolic links between sites, limits of the migration archives and Go 1.27.3.

• SecurityApp updates: the database copy made before the update now stays in a reserved folder of the panel, no longer in the site's folders, and the restore checks it before importing it.
• SecuritySymbolic links: the protection that keeps a site from publishing another site's files through a link is on for every server, also without the module Isolamento e limiti. An administrator can still turn it off.
• SecurityMigrations: the uploaded archives respect the size and file count limits before writing to disk.
• SecurityThe panel is built with Go 1.27.3, which fixes known vulnerabilities of the standard library.

0.78.1

Fixes: Backup tab, migration errors, demo

The site's Backup tab says the backup includes mail and settings too; in the demo the backup log shows the saved messages.

• FixedSite Backup tab: the text now says the backup includes the site's files, databases, mail and settings.
• FixedPublic demo: the backup log shows the saved mail messages, like the list of copies.
• FixedMigration: in the summary and in the history the errors of the mailboxes and forwarders not imported are in the language of the interface (before they stayed in Italian).
• FixedPublic demo: the largest sample account in the migration over SSH is 680 GB (before an unrealistic value).

0.78.0

Demo: migration from CWP and simulated backups

In the public demo the migration over SSH also simulates a CWP server, and the site backups show copies, restore and download. The migration texts mention CWP.

• ImprovedMigration: the texts of the page and of the migration over SSH mention CWP, and for a CWP server the option is "Create a panel account for each CWP account".
• ImprovedPublic demo: the migration over SSH also simulates a CWP server (an address that contains "cwp"), with the mailbox and its original password.
• ImprovedPublic demo: the site backups are simulated with credible sizes: list of copies, restore of files, databases, mail and settings, download of the .tar.gz archive.

0.77.0

Migration: backups from an address or from the server, and backups of several accounts

The backup to import can be downloaded from an address (https, ftp, ftps, sftp) or read from a file already on the server, without the browser's 10 GB limit. Backups of several accounts are split into one upload per account.

• NewMigration: a backup can also come from an address (https, ftp, ftps or sftp): the panel downloads it in the background and resumes where it stopped if the connection drops. The credentials are used for the download only and are not stored; users can download only from public addresses.
• NewMigration: administrators can use a backup already copied to the server (with scp or rsync), read where it is, without the 10 GB limit of the browser upload.
• NewMigration: backups of several accounts are split into one upload per account: a folder on the server (for example WHM's backups) or an archive that holds the account backups.
• ImprovedMigration: the extraction limits follow the size of the backup, for accounts of tens of gigabytes; the disk space is always checked before starting.
• ImprovedManual: "Migration" explains large backups and backups of several accounts.

0.76.0

Process manager

New Processes page: the programs running, the busiest first, stopped one by one. Administrators see the server, resellers and accounts the processes of their sites.

• NewProcesses: user, site, CPU, memory and time of every process; "Stop" asks it to close, "Kill now" ends it. The system, the kernel and the panel are protected; every stop goes into the activity log.
• NewResellers and accounts see and stop only the processes of their sites' users, checked again when stopping.
• ImprovedManual: "Services" updated.

0.75.0

Email to every account and template folder of the new sites

Administrators and resellers write a message to all their accounts, and choose the files new sites start with instead of the welcome page.

• NewNotices and template › Email to everyone: subject and text for the accounts, the resellers or everyone; one email each with their reseller's branding, and the list of the sent ones. A reseller writes to their accounts.
• NewNotices and template › Template folder: a .zip archive with the files every new site finds in its web folder. One for every site and, when they like, one for each reseller.
• ImprovedResellers: two new permissions that can be taken away, "template folder" and "email to everyone".
• ImprovedManual: "Accounts and roles" updated.

0.74.0

Git deploy for PHP sites

Every PHP site connects a Git repository: the panel fetches the branch into a folder of the site and updates it with "Deploy" or by itself at every push, with the webhook.

• NewSite › Git: repository (public, or private with the deploy key), branch and folder of the site; "Deploy" fetches the branch as the site user and the following deploys update it without touching the files outside the repository.
• NewWebhook for GitHub, GitLab, Bitbucket and the others: at every push the deploy starts by itself. Optionally composer install after the deploy. The Feature Manager can take the function away from a package ("Git deploy").
• ImprovedManual: "Websites" updated.

0.73.0

Shell for the accounts, closed in the site

Accounts can open a terminal in their site, like cPanel's jailshell: system read-only, only the site's folder writable, no other sites and no privileges.

• NewSite › Terminal for the accounts: the shell runs as the site user, with the system read-only, only the site's folder writable, the other sites and the panel hidden, its own temporary folder and no privileges. The site's PHP, WP-CLI, Composer and Git are available.
• NewOff by default: the administrator turns it on in the terminal settings and a package can take it away ("Site terminal" in the included functions). It needs the account's password; the people of the Team don't have it.
• ImprovedManual: "Terminal" updated.

0.72.0

Full PHP editor and PHP extensions one by one

Every site sets further PHP directives from a safe list, such as the time zone or error_reporting. Administrators install and remove PHP extensions one by one.

• NewSite › PHP settings › More PHP directives: time zone, error_reporting, short_open_tag, allow_url_fopen, uploads, sessions, output_buffering, compression, pcre and OPcache, each checked by the panel. The server's security directives stay locked.
• NewPHP versions › Extensions: for every version, the extensions the panel can manage (soap, imap, ldap, gmp, apcu, memcached, pgsql, xdebug and more) are installed or removed one by one; the base ones always stay.
• ImprovedManual: "PHP versions" updated.

0.71.0

Adjustable antispam for every mail domain

Whoever manages a mail domain chooses how strict the filter is, whether spam goes to the Spam folder and which senders are always accepted or always refused.

• NewMail › domain › Antispam: filter strictness (off, low, normal, high), spam in the Spam folder or in the inbox with "[SPAM]" in the subject, senders always accepted and senders always refused (addresses or domains).
• ImprovedManual: "Mail" updated.

0.70.0

Custom permissions for resellers

The administrator chooses what each reseller can do, like the reseller privileges of WHM: for example no deleting accounts or no changes to the sites of their accounts.

• NewResellers: new "What they can do" section in the reseller's window. You can take away: create, delete, suspend and edit accounts, packages, enter as their accounts, change the sites, databases, mail and DNS of their accounts, branding, nameservers, API keys, webhooks and migration.
• NewA permission taken away disappears from the reseller's panel and is refused in the API too; the reseller still sees their accounts and their sites.
• ImprovedManual: "Resellers" updated.

0.69.0

API keys for user accounts and suspension over the traffic

User accounts also create API keys for their sites, read-only too. A package can suspend the sites when the month's traffic runs out. The WHMCS and Blesta modules pass files and traffic to the packages.

• NewAPI keys for user accounts: for scripts, deploys and monitoring, they act only on the account's sites. A key can be read-only. The Feature Manager can take them away from a package ("API keys"): the page disappears and the keys stop working.
• NewPackages: with "Over the traffic, suspend the sites" the sites show the suspension page when the month's traffic has run out and come back by themselves the next month; the account can still sign in to the panel.
• ImprovedWHMCS module 1.6.0 and Blesta module 1.3.0: "Files and folders" and "Traffic per month" in the packages created from the product limits.
• ImprovedManual: "API and webhooks" and "Packages" updated.

0.68.0

Migration from CWP (Control Web Panel)

From a CWP server, over SSH as root, whole accounts migrate: sites, databases with their users, mailboxes with their original passwords, forwarders, cron jobs and the PHP version of each domain.

• NewMigration from CWP (Control Web Panel) over SSH as root: the panel recognizes CWP, lists its accounts with domains, subdomains and databases, and migrates each chosen account with its files, databases (optionally with their original users and passwords), mailboxes with every message and the original password, forwarders, cron jobs and the PHP version of each domain.
• NewLike from cPanel: automatic account creation for administrators, domain map, summary and final sync before the DNS change.
• FixedMigration: if a site's PHP version is not installed here, the site gets the closest version (for example 8.2 instead of 8.1) rather than the server default, and the summary says so.
• ImprovedManual: "Migration over SSH" explains the migration from CWP and points out that the final sync does not bring the mail.

0.67.0

Real disk quotas, files and monthly traffic in packages

The space and the files of packages can become a limit of the disk, shared by all the sites of an account. Packages also get the number of files and the traffic per month, with alerts.

• NewServer › Disks › Disk quotas: with real quotas the space and the files of the package become a limit of the disk, shared by all the sites of the account; over it writes are refused. They work on XFS disks (the main disk of AlmaLinux and Rocky, after a reboot) and on the disks for the sites prepared by the panel; on an ext4 already in use the panel's limits apply.
• NewPackages: new "Files and folders" and "Traffic per month" limits. The traffic is read from the sites' logs: at 80% and 100% the account and its reseller get an email, and the account's home shows the month's traffic.
• ImprovedDisks: new disks for the sites are ready for quotas from the start.
• ImprovedManual: "Packages" and "Disks" updated.

0.66.0

Functions included in packages

In packages you choose which functions of the panel their accounts get, like cPanel's Feature Manager: for example a website-only package, without mail, or without WordPress.

• NewPackages: new "Included functions" section. Untick WordPress, app installation, site builder, file manager, SFTP, FTP, databases, mail, DNS, scheduled tasks, backups, wildcard and uploaded certificates, site rules, application firewall, statistics and logs, antimalware, AI assistant, migration or Team.
• NewThe functions left out disappear from the panel of the package's accounts and their Team, and the panel blocks them in the API too. What is already there keeps working: for example mail already on keeps arriving.
• ImprovedManual: "Packages" updated.

0.65.0

SSL certificates uploaded by hand, mail queue message by message and delivery log

For a certificate bought elsewhere you now just paste it on the site page. Administrators manage the mail queue one message at a time and whoever has a domain sees what happened to its emails.

• NewSSL: new "Certificate uploaded by hand" card on the site page, for certificates bought elsewhere (OV, EV or your company's authority). You paste the certificate, private key and chain: the panel checks that the key matches and that the certificate is for the domain and valid, and warns when it doesn't cover an alias or the intermediate certificate is missing.
• NewA certificate uploaded by hand doesn't renew by itself: 14 and 3 days before it expires you get an alert to upload the new one. The SSL card shows who issued it and when it expires; the site backups keep it.
• NewMail › Message queue: search by sender, recipient or ID, filter by state, message headers, and for each message (or the selected ones) Retry now, Hold, Release and Delete.
• NewDelivery log: in the new "Deliveries" tab of the mail domain whoever manages it sees the emails sent and received, whether they were delivered, are waiting, bounced or were refused on arrival, with the server's answer. Administrators see it for every domain on the Mail page.
• ImprovedManual: "HTTPS" and "Mail" updated.

0.64.0

Full backups: site settings, downloadable archive, SFTP, FTP and Google Drive

The site backup also saves settings, cron jobs, DNS and certificate, restored from the same window. Every backup can be downloaded as a .tar.gz archive. Destinations now include SFTP, FTP and Google Drive.

• NewBackup: every site backup also saves its settings: PHP version and values, aliases, site rules (redirects, protected folders, blocked addresses, error pages), SFTP access, cron jobs, DNS records of this server's zones and the SSL certificate.
• NewRestore: new "Site settings" option. Cron jobs become the backup's again; missing aliases and DNS records are added, none is removed; the backup's certificate comes back only if the site has no working one.
• NewDownload a backup: from the site's Backup tab every backup downloads as a .tar.gz archive with the files, databases, mail and config folders. The download comes straight from the backup repository, with no copy on the server's disk.
• NewNew backup destinations: SFTP (with an SSH key made by the panel), FTP/FTPS and Google Drive, besides S3 and the local folder. For FTP and Google Drive the panel installs rclone and never writes passwords in clear text on the disk.
• ImprovedManual: "Backup and restore" updated (settings, download, new destinations).

0.63.0

Mail goes into the site backups

The backup of a site also saves the mailboxes of its domains, with passwords, forwarders and settings. From the restore you get back all the mail or one mailbox, without losing or duplicating the messages that arrived after the backup.

• NewBackup: together with files and databases, every site backup saves the mailboxes of its domains (main domain and aliases with mail): messages of every folder, password, quota, forwarders, autoresponder and filters. Same repository and same retention as the files; compressed messages stay compressed.
• NewRestore: new "Mail of the site's mailboxes" option, for all mailboxes and forwarders or for a single mailbox. Missing messages come back; the ones already there are neither touched nor duplicated, even if they were read or moved in the meantime. A deleted mailbox is created again with its old password.
• NewList of the site's backups: for each backup, how many mailboxes and how much mail it contains.
• ImprovedManual: "Backup and restore" and "Mail" explain the backup and restore of the mail.

0.62.0

Services page; application firewall and isolation on AlmaLinux and Rocky Linux too

New Server › Services page to restart, start and stop the services of the server, with the configuration checked before a restart. The application firewall and the Isolation & limits module work on AlmaLinux 9 and Rocky Linux 9 too, with SELinux on.

• NewServer › Services: state of nginx, PHP, databases, mail, DNS, FTP, antivirus, fail2ban, cron and SSH, with Restart, Start and Stop. Before restarting nginx, PHP, Apache, Postfix and Dovecot the panel checks the configuration: if it has an error the service is left as it is and you see the error. SSH can be restarted but not stopped. Everything goes into the activity log.
• NewApplication firewall (ModSecurity with the OWASP CRS rules) on AlmaLinux 9 and Rocky Linux 9 too: nginx module from EPEL and CRS 3.3.10 rules from the official release, verified before they are installed.
• NewIsolation & limits on AlmaLinux 9 and Rocky Linux 9 too, with SELinux on: PHP and cron of every account in its sandbox, CPU, memory, process and database limits, PHP on demand, emails per hour and X-Ray.
• FixedPHP on demand: an account idle for longer than the chosen time is stopped at the first useful check, without waiting one more minute.
• NewMigration: each site gets the PHP version it used on the old server (cPanel, Plesk or, for Linux servers without a panel, the nginx, Apache and PHP-FPM configuration), changeable site by site among the versions installed here; when the old server's one is missing, the panel picks the closest and says so.
• NewMigration: logs, backups (folders of plugins such as UpdraftPlus, All-in-One WP Migration, Duplicator) and caches stay on the old server, each with its own choice. They apply to the final sync too.
• NewMigration: choose between sites and mail, everything but the mail, or only the mail (with an empty site for the domains that don't have one here yet).
• NewMigration: optionally, the databases keep the old server's name, user and password (from the site's configuration or, from cPanel, the hashed password): the sites' configuration and external scripts don't change. If a name is already taken here, that database gets new credentials and the summary says so.
• NewMigration: during the import the list of the sites, and before that of the old server's accounts, says which are done, which one is running and which are left.
• FixedMigration: reopening a running migration, the detail page showed zeros and "final sync not available"; it now shows the live progress.
• ImprovedManual: new "Services" section; application firewall and Isolation & limits updated for AlmaLinux and Rocky Linux.

0.61.0

KoaPanel on Ubuntu 26.04 LTS

KoaPanel also installs on Ubuntu 26.04 LTS, with the same command, besides Ubuntu 24.04, AlmaLinux 9 and Rocky Linux 9. Sites, PHP 8.5, databases, mail, DNS, backups and WordPress work as on 24.04: the full test confirms it, 1,143 checks on a real server.

• NewUbuntu 26.04 LTS: the installation (curl -fsSL https://get.koapanel.app | sudo bash) and the updates also work on servers running Ubuntu 26.04.
• NewOn Ubuntu 26.04 the sites use PHP 8.5, the one shipped with the system. The other versions are shown as not available until the ondrej/php archive publishes packages for 26.04: the panel explains it instead of failing.
• ImprovedMail on Ubuntu 26.04: new configuration for Dovecot 2.4, Postfix 3.10 and postsrsd 2. Quotas, autoresponder, filters, forwarding, webmail and compressed mail work as on 24.04.
• ImprovedThe site rules (redirects, protected folders, IP blocking) are active as soon as they are saved: the panel waits until nginx has loaded the new configuration.
• ImprovedA domain just enabled for mail receives messages right away.
• ImprovedApplications from Git: if git is missing on the server, the panel installs it before the first deploy.
• ImprovedWith nginx 1.25.1 or newer (Ubuntu 26.04) HTTP/2 is turned on with the new form, with no warnings in the logs.
• ImprovedManual: Ubuntu 26.04 in the PHP versions, Isolation & limits and Application firewall pages.

0.60.0

Savings: less RAM and less disk

New Server › Savings page: it shows how much RAM the server really uses, site by site, and frees RAM and disk without touching the sites. Compressed RAM, PHP stopped for the versions without sites, compressed mail, identical files of the sites shared on XFS and Btrfs, guided cleanup.

• NewServer › Savings: the RAM the server really uses, split among sites, PHP, databases, mail, web server, DNS, panel, system and kernel, and the RAM of each site right now.
• NewCompressed RAM (zswap, zstd) and, if missing, a swap file: when the RAM runs out, rarely used pages stay in RAM compressed instead of getting processes killed.
• NewPHP stopped for the versions no site uses: the panel starts them again by itself as soon as a site needs one. On the Server page they show as "idle".
• NewSystem services a web server doesn't need (fwupd on virtual machines, ModemManager, udisks2, upower, multipathd without multipath disks) blocked with one click, and they can be turned back on.
• NewCompressed mail: Dovecot saves the messages compressed and the panel also compresses the existing ones. Nothing changes for the people using the mail, not even the quota. On the test server real mail shrank by 41%.
• NewIdentical files of the sites shared on XFS and Btrfs: the kernel compares the files byte by byte and makes them share the disk blocks, every week. 10 WordPress sites went from 1.1 GB to 458 MB. On ext4 the panel measures what it would save.
• NewGuided cleanup: package cache, journal beyond 100 MB, leftovers of deleted sites, temporary files of the sites, leftovers of WordPress updates, debug.log and error_log. Never the content of the sites, the mail or the databases.
• SecurityIn the folders of the sites the cleanup removes files as the site user and doesn't follow symbolic links.
• ImprovedMoving an account with compressed mail to a server running an older version is blocked with a message.
• ImprovedManual: new "Savings" section.

0.59.0

Team: collaborators with their own sign-in

Every account can give collaborators, agencies and developers access to the panel, each with their own name, password and passkeys, and only in the chosen sections: sites, files, databases, mail, DNS, WordPress, backups, scheduled tasks.

• NewTeam (like cPanel's Team Manager): the account adds the people who work on its sites, up to 20, without giving away its own password.
• NewFor every person you choose the sections: sites, files (SFTP and FTP too), databases, mail, DNS, WordPress, backups, scheduled tasks. The panel shows only those and refuses the rest.
• SecurityTeam members don't see the account, API keys, billing and the team, and can't enter other accounts; every operation of theirs appears in the activity with their name.
• SecurityEveryone signs in with their own credentials and can turn on passkeys and an authenticator app; an account suspended or deleted means the team is out.
• ImprovedManual: new "Team" section.

0.58.0

Application firewall (WAF) with the OWASP CRS

Sites can be protected by ModSecurity with the OWASP Core Rule Set: the most common attacks are detected or blocked before they reach the application, with exclusions for false alarms one click away.

• NewApplication firewall: ModSecurity with the OWASP Core Rule Set checks the requests to the sites and stops SQL injection, XSS, file inclusion, remote commands and scanners.
• NewFor the whole server and for every site: detection only (logs without blocking) or blocking, with a protection level from 1 to 4.
• NewRecent events in the Firewall tab of the site, with the rules that matched; "Exclude this rule" removes a false alarm for that site only.
• SecurityThe rules are loaded once for the whole server and every change is checked before it's applied: a mistake never stops the sites.
• ImprovedManual: new "Application firewall" section.
• ImprovedThe panel's name is now written "KoaPanel", like KoaVM and KoaBilling: interface, manual, emails and pages generated by the panel.

0.57.1

Certificate renewal: "Renew now" and alerts for wildcards too

A Let's Encrypt certificate can be renewed right away with one click, and the expiry alert also comes when a wildcard certificate fails to renew.

• NewSite SSL / HTTPS: "Renew now" button for the Let's Encrypt certificate, useful after fixing what blocked the automatic renewal. A certificate issued less than 24 hours ago is not renewed again, to stay within Let's Encrypt's limits.
• FixedThe expiring certificate alerts (email to the administrators and site notifications) also check wildcard certificates: before, a failed wildcard renewal was not reported.
• ImprovedManual: "Renewal" section of the HTTPS page updated.

0.57.0

KoaPanel on AlmaLinux and Rocky Linux 9 too

The panel now also installs on AlmaLinux 9 and Rocky Linux 9, with SELinux enforcing: the same features as on Ubuntu, from sites to mail, tested with all the release checks.

• NewInstallation on AlmaLinux 9 and Rocky Linux 9 with the usual command: the panel sets up the repositories by itself (EPEL, Remi for PHP, PostgreSQL 16, rspamd) and uses dnf instead of apt.
• NewPHP 7.4 to 8.5 from Remi, nginx, MariaDB 10.11, mail (Postfix, Dovecot, rspamd, webmail), DNS (PowerDNS), PostgreSQL, Apache, FTP, Node.js, Python and .NET: everything as on Ubuntu.
• SecuritySELinux stays enforcing: the panel sets the booleans, labels and a small module the sites need by itself, and updates them with every new version.
• NewFirewall with firewalld: the Firewall page, remote MySQL and FTP open their ports in firewalld, with the same protection for SSH and the panel.
• NewSystem updates with dnf, security advisories included, and automatic security updates with dnf-automatic.
• FixedA malware scan that could not start could look clean: it is now an error.
• FixedA backup to a repository that does not answer now stops after 90 seconds with a clear error, instead of waiting for minutes.
• ImprovedManual: "Installation" section with AlmaLinux and Rocky Linux.

0.56.0

French for errors, emails and the manual too

Whoever uses the panel in French now also gets the error messages, the system emails, the manual, the news and the descriptions of scheduled tasks in French.

• ImprovedServer error messages and details of background operations in French.
• ImprovedSystem emails in French: alerts, new accounts, passwords, backups, updates, news, WordPress and antimalware.
• ImprovedComplete manual in French.
• ImprovedNews in French from 0.51 on, and scheduled tasks described in French.
• FixedServer restart from the panel in French: the confirmation word REDEMARRER is now accepted.

0.55.0

Remote MySQL and FTP/FTPS

Databases can be opened to chosen addresses, to connect from a program on your computer or from another server; and sites have FTP and FTPS accounts, for people coming from cPanel or using FileZilla.

• NewRemote MySQL: on the page of a database you allow the hosts (IP addresses or networks) that may connect from outside, with the same users and passwords; password changes and deletions apply to them too.
• SecurityPort 3306 opens in the firewall to the allowed hosts only, and only with the firewall active; removing a host closes its access right away.
• NewFTP and FTPS: an administrator turns on the FTP server (pure-ftpd) for the whole server; every site creates its own name@domain accounts, each locked in its folder of the site.
• SecurityFTPS with the panel's certificate and an "FTPS only" option to refuse plain FTP; no access with system users, passwords stored encrypted.
• ImprovedManual: "Databases" and "Files and SFTP" sections updated.

0.54.0

Wildcard certificates and a dedicated IP per site

A single HTTPS certificate for the domain and all its subdomains, obtained with the DNS challenge and renewed by the panel; and the option to give a site an IP address of its own.

• NewWildcard certificate (*.domain) for every site: Let's Encrypt issues it with the DNS challenge, and the panel writes the record by itself in the zone it manages (this server's DNS, Cloudflare or 1PrimeCDN). The domain doesn't have to point to the server yet.
• New"The site also answers on every subdomain" option, together with the wildcard certificate.
• NewThe panel renews wildcard certificates by itself, 30 days before they expire.
• NewDedicated IP: administrators give a site an IP address of the server of its own; if the panel manages the DNS zone, the site's records follow the new address.
• ImprovedThe DNS check before the certificate and "Point to the server" use the site's dedicated address, when there is one.
• ImprovedManual: "HTTPS" section updated with wildcard certificate and dedicated IP.

0.53.0

The panel speaks French too

French is the third language of the interface: choose it on the sign-in page or in your account, and whoever has a French browser already finds it that way.

• NewInterface in French: every page, button and message of the panel. Choose it from the selector of the sign-in page (IT · EN · FR) or from "Your account", also as the server default language.
• NewWhoever opens the panel with a French browser (France, Belgium, Switzerland, Canada) sees it in French right away; links with ?lang=fr open the panel in French.
• ImprovedIn French, dates and numbers follow the French conventions, and the AI assistant answers in French.
• ImprovedFor now the manual, the news, the emails and the server's error messages reach French users in English.
• ImprovedManual: "Language" section updated.

0.52.0

Visit statistics and logs of every site

Two new tabs on the site page: Statistics, with visitors, page views, traffic and referrers computed from the server logs without cookies or external services, and Logs, with the errors to read and the raw logs to download.

• NewSite statistics: visitors, page views and traffic per day, most viewed pages, where visits come from, browsers and systems, pages not found, robots and peak hours, over 7, 30, 90 or 365 days.
• NewThe statistics are computed from the web server logs: no scripts in the pages, no cookies, no external service. IP addresses aren't kept and the totals of each day stay for 13 months.
• NewLogs tab: the last lines of the error and access logs, with a text search, to understand right away why a page doesn't work.
• NewRaw logs to download, including those of the previous days (compressed), as in cPanel.
• ImprovedManual: new "Logs and statistics" section.

0.51.0

Site rules: redirects, protected folders, IP blocker

The page of every site has the new Rules tab: 301 and 302 redirects, password-protected folders, IP address blocking, hotlink protection, custom error pages and MIME types. The features people coming from cPanel look for, without touching .htaccess files.

• NewRedirects: send a page, a folder or the whole site to another address, permanent (301) or temporary (302), with every page below it too.
• NewPassword-protected folders: the browser asks for a user name and a password before showing a folder or the whole site, with several users per folder. Passwords stay encrypted and outside the site.
• NewIP blocker per site: single addresses or whole networks (IPv4 and IPv6) get a 403 error on that site.
• NewHotlink protection: other sites can no longer show your images and videos using your bandwidth; you can allow friendly sites.
• NewCustom error pages (404, 403, 503...) and MIME types for particular extensions.
• SecurityEvery rule is checked before it's applied: a mistake never takes the site down. The rules also apply to WordPress, installed apps and sites with Apache.
• ImprovedThe rules follow the site when you move the account to another server.
• ImprovedManual: new "Site rules" section.

0.49.0

Backup in plain sight and two new WordPress protections

The WordPress page of every site now has a Backup card: a copy in one click and a restore in seconds, always with a safety net. And two more protections: hidden version and user names that cannot be discovered.

• New"Backup" card on the WordPress page: "Back up now" immediately copies files and database (plus a remote backup, if configured) and lists every copy with date, reason and disk space.
• NewOne-click restore of local copies: the copies the panel takes by itself before updates, publishing and replacements can now also be put back by hand, in seconds.
• ImprovedBefore every restore the panel copies the site as it is: if something goes wrong or the site stops answering, it puts it back by itself.
• NewThe latest remote backups of the site can be restored from the same card.
• NewNew protection "WordPress version hidden": the version no longer appears in pages, feeds and the addresses of styles and scripts.
• NewNew protection "User names cannot be discovered": visitors can no longer list the users with ?author=, the REST API or the sitemap.
• ImprovedThe two new protections are on by default for new WordPress sites and imported sites; on existing sites you turn them on with a switch. The AI assistant can turn them on too.
• ImprovedManual: "WordPress" and "Backup and restore" sections updated.

0.48.3

Site builder: chat with the AI

Describe the site you want in a chat and artificial intelligence builds it step by step while you watch the preview; then refine it by writing to it, as you would to a person.

• NewChat with the AI in the builder: write which site you want and watch it appear page by page; then carry on with "add a services page", "use warmer colours", "make this section shorter". Every answer can be undone with one click.
• ImprovedThe chat replaces the guided wizard: you start by writing, or from a ready-made template.
• SecurityThe AI edits the site only through checked operations (pages, sections, colours, style, texts): it writes no code, never makes up emails, phone numbers or addresses and uses only the pictures you uploaded.
• ImprovedManual: "Site builder" section updated.

0.48.2

Site builder preview and new AI models

The site builder's preview updates live and the editor fills the window; the AI assistant offers the latest Claude models.

• FixedSite builder: the live preview did not update, the editor did not fill the window and pictures uploaded to the site did not show in the preview.
• ImprovedAI assistant: the models now include Claude Sonnet 5.5 (now the recommended one) and Claude Haiku 5.5, much cheaper; the cost estimate uses their prices. If you had already picked Claude Sonnet 5 you stay on it until you change it.

0.48.1

Site builder with AI

Create a website in minutes: answer three questions and artificial intelligence prepares pages and texts, then fine-tune them in a full-screen editor with a live preview.

• ImprovedThe "Builder" tab now opens in a full-screen page, also in a new browser tab.
• NewCreate the site with AI: name, kind of business and a description, and the AI assistant writes pages, texts and sections in the chosen style and colour. It never makes up emails, phone numbers or addresses.
• NewEditor with a large preview: click a section to edit it, drag to reorder, try computer, tablet and phone, undo and redo, automatic draft saving.
• NewAI tools in the editor: rewrite a section (shorter, more formal, more persuasive…), create a page from a description, write the descriptions for Google.
• NewFive ready-made templates (firm, restaurant, portfolio, shop, event), four styles and sections such as numbers, reviews and FAQ.
• ImprovedPublished pages now also have a sitemap and social previews.
• ImprovedManual: "Site builder" section updated.

0.48.0

Site builder

Build a website from blocks right in the panel, optionally with the help of artificial intelligence, and publish it with one click.

• NewNew "Builder" tab on every site: pages and blocks (cover, text, highlights, images, gallery, contact…) that you reorder by dragging, with a live preview.
• NewCreate with AI: describe the business in a few lines and the AI assistant prepares pages and texts, to review before publishing.
• NewPublishes fast, safe plain HTML pages, with no PHP or database; content already on the site is never replaced without confirmation.
• ImprovedManual: new section "Site builder".

0.47.0

Migration from any WordPress site, with address and password

Bring onto KoaPanel a WordPress site from any host (SiteGround, Hostinger, Bluehost…), even without SSH: all it takes is the address, user and password of wp-admin. The panel copies files and database, creates the site and guides you step by step when something is needed.

• NewMigration › From a WordPress site: enter address, user and password of an administrator; the panel signs in to wp-admin, installs a temporary plugin, copies files and database, creates the site with a new database, rewrites wp-config.php and checks that the site answers. At the end the plugin is deleted from the old site.
• NewGuided flow with the obstacles explained: two-step sign-in (it asks for the code), captcha, custom sign-in page, too many attempts, firewall or Cloudflare, non-administrator user, plugin installation turned off or behind FTP. For each one it says what to do and starts again where it stopped.
• NewManual installation of the plugin when the host does not allow it from wp-admin: download the zip from the panel, activate it and paste a code.
• ImprovedWith a new domain the addresses are replaced in the whole database (plugin data included) and in WP_HOME/WP_SITEURL; the old host's object cache is turned off and the site joins the WordPress section right away.
• SecurityThe wp-admin password stays only in memory for the time of the migration; the temporary plugin answers only to the panel with signed requests, its key expires after 12 hours and, if forgotten, it deletes itself.

0.46.0

WordPress: alerts on plugins and themes with known vulnerabilities

Every night the panel compares WordPress, plugins and themes of every site with the public list of known vulnerabilities of Wordfence Intelligence, sends an email and, when the administrator turns it on, updates at once only what has a fix.

• NewWordPress › Known vulnerabilities (administrators): enter the free Wordfence Intelligence API key and turn on the nightly check. The list is downloaded once a day; the key stays encrypted on the server.
• NewEvery WordPress site has the “Known vulnerabilities” card: for each affected plugin, theme or WordPress version it shows the vulnerability, the version that fixes it (or that there is no fix yet) and the button to update with the safe procedure.
• NewEmail to the account (and its reseller) when the nightly check finds new vulnerabilities, with the list and what to do.
• SecurityAutomatic fix (optional): when a vulnerability has a fix the panel updates at once only the affected plugin, theme or WordPress, with a backup first and an automatic rollback if the site does not answer.

0.45.0

.NET (ASP.NET Core) applications in sites

A site can be an ASP.NET Core application with .NET 8 or .NET 10, like Node.js and Python applications: a service within the account's limits, nginx in front, logs, Git deploy with a build. Databases are the server's MariaDB or PostgreSQL.

• NewSite › Node.js / Python / .NET: choose .NET 8 or 10, the folder and the entry point (the published .dll, found by itself in publish/), the environment variables. The panel assigns the port, sets ASPNETCORE_URLS and nginx's forwarded headers (ASPNETCORE_FORWARDEDHEADERS_ENABLED) and is the reverse proxy, WebSockets included.
• NewServer › .NET: install with one click the ASP.NET Core runtime and, if you build on the server, the SDK, from Microsoft's official builds with the checksum verified; several versions side by side. The runtime also installs itself on a site's first start.
• NewDeploy from Git: with the SDK the project is built with “dotnet publish” as the site user, then the application restarts and is checked; if the build fails the previous version keeps running.
• NewNo SQL Server: applications use MariaDB (Pomelo) or PostgreSQL (Npgsql) with Entity Framework Core; the hints show the connection string format.
• Improved“Move account” starts the sites' .NET, Node.js and Python applications again on the destination server, installing the runtime if missing. Migration from Plesk or cPanel points out the ASP.NET Core applications found in the sites.

0.44.0

Mail: an outgoing IP address for each domain

If the server has several IP addresses, each domain's mail can leave from a different address, like cPanel's /etc/mailips. The panel updates the SPF record and checks the reverse DNS of every address.

• NewServer › Mail › Outgoing IPs: the administrator chooses which server addresses (IPv4 and IPv6) mail may leave from, the default one and a HELO name per address. The reverse DNS of every address is checked, with the exact value to ask the provider for.
• NewMail › domain › Settings: each domain can use one of the allowed addresses for the mail of its mailboxes and PHP sites. If the panel manages the domain's DNS, the address is added to the SPF record without removing the other mechanisms; otherwise the record to set is shown.
• NewMigration from cPanel over SSH: domains keep the outgoing address of /etc/mailips (and the name of /etc/mailhelo) when this server has the same address; otherwise they use the default and the report says so. The same for “Move account” between KoaPanel servers.
• ImprovedSPF records updated by the panel (this server's DNS or connected providers): the mechanisms already there, such as includes of other services, stay.
• NewAPI: GET and PUT /api/v1/mailserver/outbound-ips and /api/v1/mailserver/domains/{domain}/outbound-ip.

0.43.1

The language follows whoever opens the panel

With the browser in a language the panel does not have (German, French, Spanish…) the panel opens in English instead of Italian. Links can pick the language with ?lang=it or ?lang=en, and in the public demo the language stays the visitor's own.

• ImprovedSign-in page and panel: when the browser language is neither Italian nor English, English is used. The language chosen in the profile or by the administrator still wins.
• NewA link to the panel with ?lang=it or ?lang=en opens the sign-in page in that language (kept for this browser).
• FixedPublic demo: the language no longer depends on the shared logins; the visitor's choice, the link (?lang=en, also with #entra=admin) or the browser decides.

0.43.0

Support: temporary access without a password, and your distributor's contacts

From a support request you can let our support into the panel for a limited time, without giving a password. If your licence comes from a distributor you see the distributor's contacts.

• NewIn an open support request the administrator can press “Authorise support access” (4, 24, 48 or 72 hours): support signs in with a temporary account that cannot change sign-in, passwords, the licence or security settings. It can be revoked at once and every sign-in stays in the activity log.
• ImprovedLicence bought from a distributor: the Support page shows the distributor's contacts (email, phone, support page) instead of a generic message.

0.42.0

A new panel stays idle until it is linked to the account

On new installs, until you link the free KoaPanel account (2 minutes) the panel shows only the link page. After the link everything works as before. Existing and already linked installs do not change.

• ImprovedNew installs not yet linked: after signing in only the page “Link this panel to your account” is shown; the rest of the panel opens right after the link. Existing installs, already linked or licensed ones and the sites already there do not change.

0.41.2

Connect the account before creating the first site

On new installs the panel asks you to connect the free account first (2 minutes), then you create sites. Existing and already connected installs do not change.

• ImprovedNew installs not yet connected: connect the free KoaPanel account first, then create the first site (before, one site could be created right away). The message and the notice explain how to do it in two minutes. No existing site is stopped, and installs that are already connected or older than 0.20 do not change.

0.41.1

More reliable staging copies of applications

Copying an application to a staging site also works when the database holds text that looks like SQL commands, and with configuration files the application made read-only. The catalog built into the panel is updated.

• FixedStaging copies and WordPress site copies: page and log text containing words like “from comment.module” or “create server” no longer blocks the database copy (the safety check looks at SQL commands only, not at the data).
• FixedStaging copy: configuration files the application makes read-only are updated anyway, then made read-only again.
• ImprovedApplications that run as a service can serve their own hidden folders (for example the web interface of Radicale, calendars and contacts): recipe engine 2.
• ImprovedThe catalog built into the panel is the one published today, with the new applications and staging copies for almost every PHP application.

0.41.0

Install app: 26 new applications

The “Install app” catalog grows from 8 to 34 applications: forums, wikis, CRM and ERP, e-learning, webmail, analytics, Git and more, all open source and downloaded from the official source with the fingerprint checked. Search and categories in the catalog; the catalog updates itself without waiting for a new panel version.

• NewNew applications in Site › Applications: phpBB, Flarum and MyBB (forums); MediaWiki, DokuWiki, BookStack and Wiki.js (wikis); Grav, Concrete CMS, TYPO3 and Backdrop CMS (sites); OpenCart (shop); EspoCRM, SuiteCRM and Dolibarr (CRM and ERP); Kanboard (projects); Mautic and YOURLS (marketing); Moodle (e-learning); Roundcube (the site's webmail); FreshRSS (feeds); Piwigo (photos); LimeSurvey (surveys); PrivateBin; Gitea (Git) and Uptime Kuma (monitoring).
• NewSearch and categories in the catalog, with an icon per category; demanding applications (at least 1 GB of RAM) and those that run as a service are flagged before installing, with useful notes (for example how to sign in to the webmail).
• NewWiki.js, Uptime Kuma and Gitea run as a service behind the site: the panel installs Node.js when needed, starts them with the site's memory limits, restarts them if they stop, and stops and restarts them during updates.
• ImprovedPHP extensions an application lacks (for example soap, imap, sqlite3) are installed by the panel during the installation; the site's max_input_vars and PHP memory are raised when the application asks for it.
• NewStaging copy for applications: “Copy to a staging site” creates a new site (for example staging.yoursite.com) with the application's files, data and database, and updates addresses, folders and credentials in the copy. Available for Joomla and Matomo, and for the applications that support it.
• NewNew Applications menu: the applications installed in every site, with updates, staging copy and uninstall in one place.
• ImprovedThe application catalog updates itself every 12 hours with its signature checked: new versions and new applications arrive without updating the panel (applications that need a newer panel are flagged). Every application updates with a backup of files and database and an automatic restore if the update fails or if the application no longer answers as before.
• ImprovedEach card of the catalog shows what the application needs (PHP and extensions, database, RAM) and explains what the server lacks, for example a PHP version or PostgreSQL to turn on.

0.40.12

More robust update downloads

If the connection drops while the panel downloads a new version, the download resumes where it stopped (up to 4 attempts) instead of failing.

• ImprovedUpdate downloads: an interrupted connection (for example "unexpected EOF") is retried up to 4 times, resuming from the bytes already received; if the server does not support resuming it starts again from the beginning. Signature and fingerprint are always checked at the end.

0.40.11

More visible updates, and automatic if you want

When a new version exists administrators see it on every page of the panel, with what's new in their language and “Update now”; one email and one chat message per version. In Server › Updates automatic updates can be turned on (important only or all), in a time window and on the chosen days, with checks and automatic rollback.

• NewBanner on every administrator page when a newer version exists: “KoaPanel X.Y.Z is available”, with what's new in the missing versions and “Update now”. It hides with the ×; if the missing versions include security or important fixes it becomes “Important update” and comes back the next day.
• NewInstall updates automatically: notify only, important updates only or all stable updates, with a time window and days. It first checks disk space and the state of the panel, never starts during backups, migrations or account moves, goes back to the previous version by itself if the new one does not start, and makes one attempt per version.
• ImprovedOne email to the administrators for every new version, whatever the choice (it says whether and when it will be installed by itself), and the result of every update also in the connected chats (Slack, Discord, Telegram) and in the Activity log.
• ImprovedWhat's new in the available version on the Updates page is in the panel's language, with the list of versions since yours.
• ImprovedNew installations install important updates by themselves (the installer says so and explains how to turn it off); panels already installed stay on “Notify only” until an administrator chooses.

0.40.10

One term: account

Resellers see "account" for the hosting accounts they manage, like administrators (the WHM convention), instead of "client"; the person who signs in to an account is a "user".

• ImprovedThe interface, the manual and error messages use "account" for the hosting account, for administrators and resellers: Accounts menu, "New account", "Your accounts", "Sign in to the account". The person who signs in to the panel is the "user".
• ImprovedEnglish: "account" and "user" instead of "client" and "customer"; "customer" stays only for the customer area and billing. The glossary and an automated check enforce it.
• ImprovedNo change to the API: fields and routes stay the same.

0.40.9

English interface reviewed for the international launch

A complete review of the English interface, on desktop and phone: no more Italian text with the panel in English (job logs included), US date and number formats, consistent terms and easier tap targets on phones.

• ImprovedWith the panel in English, the log lines of background operations (installations, updates, backups, migrations, WordPress, disks) are in English too.
• ImprovedEnglish: US date and number formats (Oct 10, 2026, 1,234.5 MB), one term per concept (sign in, site, mailbox, license) and more natural wording, in the interface, the manual, error messages and emails.
• FixedWith the panel in English, the release news on the home page could show in Italian; the activity log showed some details in Italian; job names shown as internal codes (for example malware.scan); the name of the built-in DNS connection and some terminal and Isolation and limits messages in Italian.
• ImprovedPhone: buttons, links and checkboxes of at least 40 pixels, easier to tap.
• FixedThe Limits & usage page opened without the module installed shows an explanation instead of errors.
• FixedSingular counts ("1 site", "1 WordPress site" instead of "1 sites"); on desktop the activity log columns were squeezed to the left instead of filling the table.
• FixedInterrupted jobs, cron commands, app health checks and refused SQL statements: the error messages are in English with the panel in English.
• NewAutomated check: a browser opens every page in English on desktop and phone, as administrator, reseller and user, and checks for Italian text, sideways scrolling and errors.

0.40.8

Required two-step sign-in, passkeys and the panel name

Administrators can require two-step sign-in for administrators, resellers or users (the authenticator app or a passkey is enough). Opened by IP address, the panel explains that passkeys work with its name.

• SecurityServer › Security, "Required two-step sign-in": per role (administrators, resellers, users), with the number of accounts that don't have a second step yet. Passkeys are never required: the authenticator app is enough.
• SecurityWhoever must turn it on and hasn't sees only the page to add a passkey or the app; the rest of the panel and of the API with their session answers "two-step sign-in required". API keys and tokens don't change. Changes go into the activity log.
• ImprovedSign-in page opened by IP address: instead of the passkey button, the panel's name (if set) where passkeys work.
• ImprovedThe messages of the access control (session expired, invalid token, too many requests) have their English version too.
• ImprovedManual "Passkeys and secure sign-in": required two-step sign-in, panel name and IP address.

0.40.7

Error reports: no false alarms from account moves and test servers

A refusal of the destination server during an account move (for example a database with the same name already there) is a condition to fix, not a panel error: it shows as before but is no longer reported. Test servers can turn reports off in the configuration.

• FixedAccount moves: refusals of the destination server (name already used, check not passed, item not found) no longer create an automatic error report; unexpected errors still do.
• ImprovedReports of account moves give the message type (for example mv.e.remote) instead of the internal name of the error type.
• Newerror_reports_off: true in agent.yaml (or PANEL_ERROR_REPORTS=0) turns reports off on a test server; Privacy shows it.
• NewAPI: failed jobs have errorKind (conflict, invalid, not_found, unavailable) when the error is a condition to fix.

0.40.6

Account moves: retry, stop, hold and removal

Moving an account to another server now enables mail on the destination server when needed, also carries SFTP keys, PHP settings and limits, shows a maintenance page during the final copy, can be stopped before the DNS step and, if a step fails, resumed from there. The data stays here for the days you choose until you remove it.

• New"Enable mail on the destination server": if the account has mailboxes and mail is off there, the move enables it before copying them.
• NewHold: after the move the data stays here, suspended, for the days you choose (usually 7); Accounts shows a "Moved to …" label and a notice at the top. Nothing is deleted by itself: "Remove from this server" asks for the account name (and to confirm the early removal before the end of the period).
• NewIf a step fails the sites work here again and the destination server keeps what it received: "Retry" starts again from the step that stopped, without duplicates.
• New"Stop" during the move, until the DNS step: the destination server deletes the copied data and the account is active here again.
• NewDuring the final copy the sites show "Maintenance in progress" (Italian and English) instead of "site suspended"; the page stays for visitors who still reach this server until the account is removed or the move undone.
• NewThe sites' SFTP keys and password, each site's PHP settings and the account's own limits move too.
• NewMove history in the account window; API: GET /api/v1/moves, move/retry, move/cancel, move/remove.
• ImprovedChecks, notes and the log of the move in the panel language; the API adds errorsEn, warningsEn, notesEn, logEn and the keyed messages (errorMsgs, warningMsgs, noteMsgs).
• FixedAn account already moved to a server, and later deleted there, could no longer move to that server ("the account is already arriving with another transfer").

0.40.5

Errors of background operations in English too

With the panel in English, the errors of operations running in the background (installations, migrations, account moves, disks, updates, WordPress, mail, licence) are in English too.

• ImprovedAnother 277 messages, the ones from background operations and internal checks, have their English version: operation results and migration details show them in the chosen language.
• NewAPI: failed jobs also have errorEn (the error in English); error stays in Italian.

0.40.4

Error messages in English too

With the panel in English, the error messages of operations (sites, DNS, mail, databases, SSL, backups, accounts, files, cron, firewall, updates, licence, login and the rest) are now in English. Before, the server always sent them in Italian.

• ImprovedAbout 870 error messages of the panel have their English version: the interface shows the one of the chosen language, in notifications and error boxes.
• NewAPI: every error also has key (a stable identifier), params and messageEn (the message in English); message stays in Italian, as before, for whoever already uses it.

0.40.3

Clearer Slack and Discord alerts, in English too

Server alerts on Slack, Discord and Telegram arrive in the language you choose, with the server name and a link to the panel page. New alert for an almost full disk; no more bursts of messages for a service that keeps stopping and starting.

• NewMessage language for each destination (Italian, English or the panel's default), in API keys › Webhooks.
• NewSlack gets messages with blocks and an "Open in the panel" button, Discord a coloured card with the link; every message shows the server and the event.
• NewNew server.disk_full event: the server disk is more than 90% full (at most once a day, even without email set up).
• ImprovedA service that keeps stopping and starting is reported at most once every half hour, and the same alert isn't repeated within 10 minutes.
• ImprovedDeliveries: only temporary errors are retried (network, 429 honouring Retry-After, 5xx); a 4xx error isn't repeated.

0.40.2

Migrations: warnings and notes in English too

The analysis warnings, summary notes and reasons for items not imported in migrations from cPanel, Plesk and over SSH now follow the panel's language. Before, they were always in Italian.

• ImprovedMigration from a backup file and over SSH: analysis warnings, summary notes, reasons for sites and databases not imported and final sync results are translated (Italian and English), on the migration details page too.
• ImprovedMigrations made before this version stay readable: their messages are shown as they were saved.

0.40.1

Update check works even with broken third-party sources

Fixed: a third-party package source that no longer exists (or lost its key, or can't be reached) made the whole Ubuntu update check fail. Now the check carries on, and Server › Updates shows which source isn't working, which file it's configured in and how to disable it.

• FixedServer › Updates: the package check no longer fails because of a third-party source with no Release file, no signing key or that can't be reached; updates from your other sources are listed. It only fails if the Ubuntu or panel sources themselves don't work.
• NewNew "Package sources that aren't working" box: the source address and suite, the file it comes from (/etc/apt/sources.list.d/…), the reason and what to do, with a "Disable this source" button (the line is commented out, or the deb822 source gets Enabled: no). Ubuntu and panel sources can't be disabled.
• ImprovedA broken source on the server is no longer sent as a panel error; if an apt error is still reported, the source's host name stays visible.

0.40.0

One-click mail activation and skipped mailboxes from migrations

When mail isn't enabled on the server, the Mail page says so and the administrator enables it with one click. Migrations from cPanel or Plesk offer to enable it before importing the mailboxes and, for migrations already done, import the skipped mailboxes afterwards.

• NewMail page with the service off: the administrator sees "Mail isn't enabled on this server" with an "Enable mail" button (installation with progress on the page); users and resellers are told to ask their administrator.
• NewMigration from a backup file or over SSH: if there are mailboxes and mail is off, the analysis says so and the administrator can choose "Enable mail and import the mailboxes".
• NewMigration details: mailboxes and forwarders skipped because mail was off can be imported later with "Import skipped mailboxes", from the same backup, without touching sites, files and databases.
• New"Mailboxes only" option in the migration: imports only mailboxes and forwarders into sites already migrated (for a backup uploaded again or a migration over SSH).
• ImprovedThe migration summary explains in the user's language how many mailboxes and forwarders were skipped and what to do.

0.39.2

Stable panel with browser translation

Fixed: with automatic page translation (Chrome, Edge) or some extensions the home page of the panel could stop with "Something went wrong".

• FixedAutomatic browser translation changed the texts of the page under the interface and the home page stopped (error "removeChild ... not a child of this node"). Now the page asks the browser not to translate it (the panel has its own languages) and the texts that appear and disappear are protected.
• ImprovedIf an extension changes the page anyway, the panel rebuilds it by itself instead of showing the error screen.
• ImprovedThe automatic error reports of the interface point to a precise place in the code (for whoever analyses them); the code maps stay private and are never served by the panel.

0.39.1

Migration from Plesk 18: mailboxes, forwarders and cron

Fixed: from Plesk Obsidian servers the migration brought only sites and databases. Mailboxes with their messages and password, forwarders and scheduled tasks now arrive too, both over SSH and from the backup file.

• FixedLive migration over SSH from Plesk: the subscription backup failed (pleskbackup option no longer existing) and the panel fell back to copying only files and databases.
• FixedPlesk Obsidian (18) backups: the panel reads the new format, with its compressed .tzst parts, and imports the site, databases, mailboxes with their messages and original password, forwarders and scheduled tasks (paused for review).
• ImprovedTested on a real Plesk Obsidian 18.0.81 server; the migration manual says so.

0.39.0

Migrating from cPanel: one account per customer

New: when migrating from cPanel, each cPanel account becomes a panel account with the same username, instead of everything landing under the administrator.

• NewMigration from a backup file: for administrators "Import into account" offers "New account (as on cPanel)". The panel creates the account with the same username and the cPanel contact email, with the package you choose, and imports the sites, databases and mailboxes into it. If the account already exists as a customer it is used.
• NewMigration over SSH from cPanel as root: with "Create a panel account for each cPanel account" (on by default) each chosen account lands in its own panel account. If one cannot be created (name already used by an administrator or a reseller) it is skipped and the others go on; with CloudLinux limits each account gets its own.
• ImprovedNo email goes to the customers during the migration: once the DNS points to the new server, the access is sent from the account page with "New password". The final report lists the accounts created or reused.

0.38.2

Installing WordPress in English

Fixed: installing WordPress in English failed ("download failed", error 404).

• FixedWordPress and Install apps: the English version was downloaded from a wordpress.org address that no longer exists and the install stopped with error 404. It now uses the correct official package, still checked against the published SHA-1. Other languages (Italian included) were not affected, except when the translation was missing and the install fell back to English.

0.38.1

Webmail in the demo and renewal of the IP certificate

Fixed: in the public demo "Webmail" opened a tab that stayed blank; the renewal of the IP address certificate is no longer postponed by a Let's Encrypt rate limit.

• FixedPublic demo: "Webmail" of a mailbox opened a blank tab (the demo has no webmail port). Now the tab closes and a message explains that on your own server the button opens Roundcube or SnappyMail already signed in to the mailbox; the settings for mail programs no longer show a webmail address that does not answer.
• FixedIP address certificate: an order refused for Let's Encrypt's rate limits (after a settings change) no longer postpones the scheduled renewal, which is exempt from the limits, by a day; a few changes in a row could push it back to the expiry, leaving the panel and the webmail with an expired certificate.

0.38.0

Moving an account to another server

New: an account moves with all its data to a linked server, with the same passwords and the DNS updated; if something goes wrong you can go back.

• NewAccounts › Move to another server: sites with their files, MariaDB and PostgreSQL databases, mailboxes with their messages, forwarders, cron jobs, HTTPS certificates and DNS records go to a linked server, with the same passwords (account, databases, mailboxes).
• NewChecks before starting: names already there, disk space, PHP versions, mail and PostgreSQL on the target server, and for each site who updates the DNS (this server, Cloudflare, 1PrimeCDN or by hand).
• NewTwo copies: the first with the sites running, then the account is suspended for the final copy of the changes only (deleted files and messages included) and the DNS records are pointed to the new server.
• SecurityThe move goes through the API of the two panels with the link's token; the files arrive as the site user, never written by root inside the user's folders, and the archive is checked (no paths out of place, no symbolic links followed).
• ImprovedIf something fails everything goes back as it was; until the account is deleted from the source server, "Undo the move" brings the DNS back, reactivates the account and removes it from the new server.
• ImprovedManual: new "Moving an account to another server" section.

0.37.0

Server alerts on Slack, Discord and Telegram

New: administrators receive the important alerts of the server in their chat: services down, failed backups, antimalware, expiring certificates, new versions and errors.

• NewAPI keys › Webhooks: besides the signed JSON webhook you can choose Slack, Discord or Telegram (bot token and chat ID); each administrator has their own destinations.
• NewNew server events, for administrators only: service down and back up, failed backup, suspicious files found by the antimalware, expiring HTTPS certificate, new panel version, internal error of the panel.
• ImprovedIn the chats each event arrives as a sentence with the server name; tokens and secret addresses are not shown again after saving.
• ImprovedPostgreSQL: a file to import with errors is no longer reported as an error of the panel.
• FixedPublic demo: passkeys and the authenticator app cannot be turned on for the trial accounts, whose logins are public.
• ImprovedManual: new "Notifications on Slack, Discord and Telegram" section.

0.36.0

Passkeys and two-step sign-in

New: sign in to the panel with a passkey, without a password, and protect the sign-in with a second step (passkey or authenticator app) and recovery codes.

• SecurityAccount › Secure sign-in: passkeys (Face ID, Touch ID, Windows Hello, phone, security keys), more than one per account, with a name. "Sign in with a passkey" signs in without a password and cannot be fooled by a fake page.
• SecurityAuthenticator app (6-digit codes) and 10 recovery codes: with a passkey or the app on, the password alone no longer signs in.
• NewAn administrator, or the reseller for its clients, resets the secure sign-in of an account that lost its devices; for administrators there is the "panel-agent user reset-mfa" command.
• FixedReal-time protection: the message after saving the settings showed the wrong text.
• ImprovedManual: new "Passkeys and secure sign-in" section.

0.35.0

Node.js and Python applications for the sites, with Git deploy

New: a site can be a Node.js or Python application, with the version of your choice, a service with the site's limits, nginx in front, logs, restart, Git deploy and health check.

• NewSite page, "Node.js / Python" tab: choose language and version (Node.js 20, 22, 24 from the official packages; Python 3.11, 3.12, 3.13 with uv), folder, start and build commands, environment variables.
• NewThe application runs as a service with the site user, with memory and CPU limits, and restarts by itself; nginx stays in front with the certificate, HTTP/2 and WebSocket.
• NewGit deploy with a deploy key per site: fetches the branch, installs the dependencies (npm, uv), runs the build, restarts and checks that the application answers.
• NewApplication log, restart, stop and health check from the panel and the API (OpenAPI).
• ImprovedManual: new "Node.js and Python applications" section.

0.34.0

PostgreSQL: databases for the sites, Adminer with direct access, backups and migrations

New: besides MySQL/MariaDB the panel manages PostgreSQL, installed only when needed, with databases per site, password-free Adminer, backups and import.

• NewDatabases page, "PostgreSQL" box: an administrator installs it with one click (internal address only, scram-sha-256 passwords); then accounts create their own databases, each with its own owner user and the password shown only once.
• New"Open Adminer" enters the database without a password, with a temporary user valid one hour and a link valid 60 seconds, like phpMyAdmin.
• NewImport of .sql and .sql.gz files and pg_dump archives, with the permissions of the database owner only.
• NewSite backups include their PostgreSQL databases and restoring imports them again; the migration from cPanel also imports the backup's PostgreSQL databases.
• ImprovedManual: new "PostgreSQL" section; the new functions are in the API (OpenAPI).

0.33.0

Apache/.htaccess compatibility for the sites that need it

New: a site can use its own .htaccess rules. nginx stays in front (certificate, static files, cache) and passes PHP to Apache, installed only when needed.

• NewSite page, "Web server" box: "Apache/.htaccess compatibility". Apache (mpm_event, internal address only) reads the .htaccess files and runs PHP with the site's same PHP-FPM pool: same user, same limits, compatible with the Isolation & limits module.
• NewApache is installed the first time a site turns it on; afterwards accounts turn it on for their own sites too. For WordPress the panel adds the standard block to .htaccess.
• NewMigration from cPanel, Plesk or over SSH: sites with .htaccess rules of their own are flagged and, if you choose, imported with the compatibility already on.
• ImprovedThe WordPress page cache also works with Apache, with the same exclusions; the visitor's address reaches PHP from nginx and cannot be forged.
• NewServer › Mail › Sending: "KoaMail" tab to connect the server to the KoaMail relay with an API key (monitored IPs, per-mailbox limits, automatic blocking of compromised accounts); one click disconnects it and returns to direct sending. Incoming mail can also be filtered by KoaMail, domain by domain (MX and mailboxes kept in sync).
• ImprovedManual: new "Apache/.htaccess compatibility" section.

0.32.0

Install apps: WordPress, WooCommerce, PrestaShop, Joomla, Drupal, Nextcloud, Matomo and Laravel

New: on every site page, the Applications tab installs the most used applications in one click, with verified downloads, database, nginx rules, updates with a safety copy and uninstall.

• NewSite "Applications" tab: WordPress, WooCommerce ready to sell, PrestaShop, Joomla, Drupal, Nextcloud, Matomo and Laravel (also from a Git repository). Accounts install in their own sites too.
• NewOfficial packages checked against the SHA-256 fingerprint of a catalog signed by KoaPanel and updated online without updating the panel; PHP version and extensions checked, with a switch of the site's version when needed.
• NewFor each application: its own database, installation with its official tool (wp-cli, the PrestaShop and Joomla installers, drush, occ, artisan) as the site user, dedicated nginx rules, cron, administrator password shown only once.
• NewUpdates with a copy of files and database and automatic restore if anything goes wrong; uninstall removing files, cron jobs and database.
• ImprovedAPI: new /apps/catalog and /sites/{domain}/app endpoints in the OpenAPI document. Manual: new "Install apps" section.

0.31.4

Manual updated

The manual explains the Free plan without an account on marketplace images, the licence terms and third-party licences, and the Blesta and FOSSBilling modules.

• ImprovedManual: "KoaPanel account" with the 14 days without an account on servers from the cloud marketplaces; "Plan and license" with licence terms and third-party licences; "WHMCS and API keys" with the Blesta and FOSSBilling modules.

0.31.3

SnappyMail webmail: original files

The panel no longer modifies SnappyMail's files: the login page uses the original word "Passphrase" again.

• ImprovedSnappyMail webmail: the panel only adds its theme and the one-click login page, without modifying the program's files; the password field label is the original one again ("Passphrase").

0.31.2

Licences of the files added to WordPress, phpMyAdmin and webmail

The PHP files the panel adds to WordPress, phpMyAdmin, Roundcube and SnappyMail for one-click login carry their free licence, like the programs they extend.

• ImprovedOne-click login: the WordPress plugin and the phpMyAdmin script are distributed under GPL 2.0 or later, the Roundcube sign-on page under GPL 3.0 or later, the SnappyMail one under AGPL 3.0 or later.
• ImprovedSnappyMail webmail theme: with the licence texts of the fonts.

0.31.1

Licences: terms and open source components

Plan and license links to the licence terms and to the list of the open source components included in the panel, with their licences.

• NewThird-party licences: the panel publishes at /third-party-notices.txt the list of the open source components it contains (Go and interface libraries, fonts) with the texts of their licences; the link is at the bottom of Plan and license, with the licence terms.
• ImprovedWebmail: the KoaPanel plugin for Roundcube is distributed under GPL 3.0 or later, the skin under CC BY-SA 3.0 like Elastic it derives from, with the licence texts of the fonts.
• ImprovedThe installer reminds that installing KoaPanel means accepting the licence terms.

0.31.0

Isolation & limits 1.3: X-Ray, mail limit and CloudLinux import

The Isolation & limits module moves to version 1.3.0: X-Ray shows what slows the sites down, the mail limit stops the accounts sending too many emails and the live migration over SSH brings the CloudLinux limits along.

• NewX-Ray for slow sites (optional): for every PHP page slower than the chosen seconds the panel records where it was; in Limits & usage, for each site, the culprit plugin, theme or file, the slowest functions and the latest examples (7 days).
• NewOutgoing mail limit (optional, needs the Mail module): the emails sent by each account, from the PHP of the sites and from the mailboxes together, are counted every minute; over the hourly limit (default 300, also in the packages) the account cannot send until its last hour is back under it.
• NewLive migration over SSH from cPanel on CloudLinux: the LVE limits of each account are shown in the analysis and an administrator can import them as the limits of the account.
• ImprovedWHMCS module 1.4.0: "Emails per hour" configurable option.
• ImprovedManual: "Isolation & limits" section updated.

0.30.1

ClamAV antivirus active again on servers installed before 0.24

Fixed: on servers installed with get.koapanel.app before 0.24 ClamAV did not check the files (only the built-in checks were active). The manual explains how much memory PHP uses.

• FixedAntivirus: on servers installed with get.koapanel.app before 0.24 the ClamAV signatures were readable only by the ClamAV service, and the site scans (which run as the site user) could not use them: the EICAR test file was not recognised. The update and every scan fix the permissions, and if the signatures are missing the reason is written in the scan result.
• ImprovedManual, PHP versions: new section "How much memory PHP uses", with measured values (PHP on demand, ondemand mode, Isolation & limits module).
• ImprovedMore reliable end-to-end tests on servers other than the test one.

0.30.0

Valid certificate for the panel

The panel now has a valid certificate also when you open it by its IP address, and you can give it a name of yours (e.g. panel.mydomain.com).

• NewLet's Encrypt certificate for the server's IP address (6-day profile, renewed automatically at half of its life or earlier when Let's Encrypt asks; validated on port 80 or, when it is closed, on 443): the panel, phpMyAdmin and webmail no longer show "Not secure". If the issuance fails the self-signed certificate stays.
• NewPanel name (e.g. panel.mydomain.com) with its own certificate, also used in the links of the emails; optional redirect from the IP to the name; DNS record created with one click when the domain is on this server's DNS.
• NewServer › Security: "Panel certificate" box with type, expiry, last and next renewal, errors and "Renew now"; it explains when the server is behind NAT.
• ImprovedServers linked with the fingerprint of the self-signed certificate keep working when the remote server switches to Let's Encrypt.
• ImprovedInstallation: the panel asks for the certificate at once and the final address says whether it is valid. Manual: new section "Panel certificate".

0.29.0

Isolation & limits 1.2: symbolic links, SFTP and ranking

The Isolation & limits module moves to version 1.2.0: it protects the sites from symbolic links to other sites (like CloudLinux's SecureLinks), puts the SFTP sessions within the limits of their account and adds a ranking of the accounts and a weekly email report.

• SecuritySymbolic links protection: the web server follows a symbolic link only if it belongs to the owner of the file it points to, so a site cannot publish another site's files (on by default with the module, can be turned off on its page).
• NewThe SFTP sessions of the sites have the same CPU, memory, process and disk limits as their account.
• NewLimits & usage › Ranking: the accounts that hit their limits most often and those that use the most over the last 7 or 30 days, with a bigger package suggested.
• NewWeekly limits report by email, every Monday, to the administrators and to each reseller for its customers; only if some account hit them (can be turned off).
• ImprovedManual: "Isolation & limits" section updated.

0.28.0

Isolation & limits 1.1: database, resellers and PHP on demand

The Isolation & limits module, now at version 1.1.0 (the module has its own numbering, shown on its page), gets even closer to CloudLinux: a limit on the concurrent PHP requests of each account (entry processes), on disk operations (IOPS) and on the number of files, overall limits for all the customers of a reseller an email to the account holder when it hits its limits PHP on demand for servers with hundreds of accounts and a database limiter.

• NewConcurrent PHP requests per account (entry processes): the extra pages wait their turn instead of taking the server's CPU and memory.
• NewDisk operations per second (IOPS) limit per account, besides the MB/s one.
• NewOverall limits per reseller: CPU, memory, processes and disk of all its customers together, from Limits & usage › Resellers. A reseller's customers that reach the cap slow down only themselves.
• NewEmail to the account holder when their sites hit the limits, with the reseller's brand (can be turned off on the module page).
• NewFiles limit (folders included) per account: a warning at 90% and no new sites over the limit, as for disk space.
• NewDatabase limiter (optional), like CloudLinux's MySQL Governor: database CPU per account (over it, its connections drop to 2 for 5 minutes) and longest query time. Database graph in Limits & usage.
• NewPHP on demand (optional): the PHP of an account starts at the first visit and stops after 15 minutes without requests, freeing about 10 MB per account. Useful with many rarely visited accounts.
• NewWHMCS module 1.3.0: Entry processes, IOPS, Files, DB CPU (%) and Query max (s) configurable options.
• ImprovedWith hundreds of accounts: creating a site, changing the default limits, installing and uninstalling the module are much faster (one reload of systemd for every account).
• SecurityThe PHP of the accounts sees /run read-only too, except the PHP sockets.
• ImprovedOn servers where the module was already installed the new limits stay off until you set them: the update changes nothing for the sites. A client that sends only some limits leaves the others as they are.
• ImprovedManual: "Isolation & limits" section updated.

0.27.1

Fix: shared PHP stopped after deleting sites

With many sites, deleting a few in a row could stop the shared PHP and give error 502 on every site. Fixed: update as soon as you can.

• FixedWith many sites, deleting a few in a row could stop the shared PHP (error 502 on every site).
• ImprovedPHP-FPM: reloads of a version no longer overlap, and the site user is removed only once PHP has finished reloading.
• ImprovedA PHP pool left without its user is moved aside (pool.quarantine) instead of stopping every site; if PHP-FPM is stopped, the panel starts it again instead of failing.

0.27.0

Monitoring with Prometheus and Grafana

The panel exposes the state of the server in the Prometheus format: CPU, memory, disks, services, sites, certificate expiry and last backup of every site. It connects to Grafana, Zabbix, Netdata, Datadog and Uptime Kuma with an API key.

• NewAddress /api/v1/metrics in the Prometheus format, with an administrator API key.
• NewMetrics for the server (CPU, memory, disks, services), sites (status, space, SSL expiry, last backup), users, licence and updates.
• ImprovedManual, section "API and webhooks": Prometheus configuration and ready-made alerts.

0.26.0

Trial without an account for cloud marketplace images

Panels installed from the cloud providers' marketplaces (Vultr first) work on the Free plan for 14 days without an account; then they ask to connect the free KoaPanel account, like every new install.

• NewInstaller: KOAPANEL_LINK_GRACE_DAYS (up to 30) for marketplace images, and the panel-agent license link-grace command.
• ImprovedDuring the trial the home page shows the days left and the invitation to connect the account; the reminder on every page appears only in the last 3 days.

0.25.0

Isolation and limits per account

New optional module, like CloudLinux but included: every account has its own CPU, memory, process, disk and database connection limits, and its PHP is isolated from the others. A site that uses too much slows down only its own account. Not installed by default: install it from Server › Isolation & limits.

• NewServer › Isolation & limits: install and uninstall with one click, with the sites online. Until you install it nothing changes on the server.
• NewCPU, memory, process, disk speed and database connection limits for every account: in the package, on the single account or server defaults.
• NewThe PHP and the cron jobs of each account see only their own sites, the system read-only and a private /tmp, as with CageFS.
• NewLimits & usage page: CPU, memory, process and disk graphs for the last 24 hours and 30 days, and the times an account hit its limits, with an email to the administrators and the reseller.
• NewWHMCS module 1.2.0: limits can be sold as configurable options (CPU, RAM, processes, I/O, DB connections).
• ImprovedManual: new section "Isolation & limits".

0.24.0

All servers and web terminal

One list with the sites of every linked server, with search, filters and actions, the Ctrl+K quick search and a terminal in the browser for administrators: root shell of the server or a shell as the site user.

• NewAll servers (server menu under the logo): the sites of this panel and of the linked servers with server, account, PHP, WordPress, SSL and expiry, disk, status and last backup; search, filters, sorting and pages. Servers that do not answer are flagged without blocking the list.
• NewFrom every row: site details and file manager directly on its server, visit, one-click wp-admin, phpMyAdmin, suspend and unsuspend.
• NewQuick search: Ctrl+K (Cmd+K on Mac) from any page to find a domain on every server.
• NewWeb terminal for administrators: Server › Terminal (root shell) and a Terminal tab in every site (site user, with the site's PHP, composer and wp-cli). Password asked every time, idle timeout, session limit, activity log and optional output recording; never without HTTPS or in the demo.
• NewServer › Security: who can open the root shell (default: the main administrator only), idle timeout and session recording.
• FixedFresh installs: error 500 on every WordPress site (cache folders created with 0700 permissions).
• ImprovedManual: new sections "All servers and quick search" and "Web terminal".

0.23.0

Automatic error reports

If something breaks the panel tells KoaPanel by itself, with technical data only, and tells you whether the problem is already known or fixed in a newer version. It can be turned off in Privacy.

• NewAutomatic reports to KoaPanel of crashes, failed operations, failed updates, interface errors and system services that stay down: no data about sites, users or visitors (domains, emails, IPs and paths are removed).
• NewNext to the error: "We already received this report" or "Fixed in version X: update the panel", with a link to Updates.
• NewNew Privacy page: turn the reports on or off and see exactly what is sent.
• ImprovedManual: new section "Privacy and error reports".

0.22.0

Public API and webhooks

A documented REST API (OpenAPI 3.1) to connect KoaPanel to any billing system, with signed webhooks to know at once when an account is created, suspended or goes over its disk space.

• NewPublic, versioned REST API: accounts, resellers, packages, sites, databases, mail, usage and one-click login, with the personal API keys. OpenAPI 3.1 document at /api/v1/openapi.json.
• NewAPI keys › API documentation: every operation with its fields and a curl example ready for this server.
• NewWebhooks: signed events (HMAC-SHA256) for accounts created, changed, suspended, reactivated, deleted or over their disk space, sites and resellers; test, delivery history and automatic retries.
• ImprovedPaginated lists (limit and cursor), Idempotency-Key on every POST request and X-RateLimit headers with the requests left.
• ImprovedManual: new section "API and webhooks".

0.21.1

Faster to open

The interface downloads about a tenth of the data it used to and opens much sooner, above all on slow connections.

• ImprovedThe interface is compressed (brotli and gzip) and split by page: the first visit downloads only what it needs, the rest when you open a section.
• ImprovedThe larger API answers are compressed, and the interface files stay in the browser cache until the next update.
• FixedAfter a panel update, a tab opened before reloads by itself instead of showing an error.

0.21.0

WHMCS integration

The official WHMCS module creates, suspends, upgrades and deletes panel accounts as customers order and pay, and logs them in with one click. New API keys for administrators and resellers.

• NewWHMCS module (8.x and 9.x): create, suspend, unsuspend, change package, change password and terminate hosting accounts and resellers; disk usage updated daily. Download it from console.koapanel.app/updates/integrations/.
• NewOne-click login from WHMCS, for the customer and the administrator, with one-time links valid 60 seconds; the client area also links straight to Files, WordPress, Email and Databases.
• NewPersonal API keys (API keys menu) for administrators and resellers: they act as their creator, a reseller's key reaches only its clients. Limited to 300 requests per minute, and every use shows in the Activity log.
• NewWHMCS module for partner providers who resell KoaPanel licences.
• ImprovedManual: new section "WHMCS and API keys".

0.20.0

Connect the panel to your KoaPanel account

From "Plan and license" you connect the panel to the KoaPanel customer area with a code or a QR, no password: you get the Free plan licence and find licences, orders and support in your account.

• NewPlan and license › Connect your KoaPanel account: short code, link and QR code; the panel waits for the confirmation in the customer area and activates the Free plan licence by itself.
• NewClear states: waiting, confirmed, refused ("It's not me"), expired; if the console does not answer the panel retries by itself.
• ImprovedNew installs: the Free plan needs the account. Before connecting you can set the panel up and create one site, with a notice and a box on the Overview. Existing installs do not change.

0.19.3

Fixes

This server's DNS listed only once, AI assistant in the interface language, correct dates on the What's new page.

• FixedDNS: the "This server" connection appeared twice in the list.
• FixedAI assistant: the diagnosis answers in the interface language of whoever asks for it (Italian or English), also in demo mode.
• FixedWhat's new: the dates of the versions from 0.17 on were in the future.
• ImprovedTidier panel start: background work starts only once every service is ready.

0.19.2

Connected to the KoaPanel console

The panel uses the KoaPanel console for licences, online activation, purchases and updates: the official stable channel is now the default.

• ImprovedDefault licence server and checkout: console.koapanel.app (online activation, periodic check, purchase page).
• ImprovedUpdates: the default channel is the console's signed stable channel (console.koapanel.app/updates/stable.json).
• ImprovedServers with the old placeholder addresses switch to the real ones by themselves; addresses set by hand stay as they are.

0.19.1

A bigger plan for the server

In Server › Resources you see the server's plan at Vultr or Hetzner Cloud and the bigger plans with their prices; on Vultr the change happens from the panel, with the file system grown by itself.

• NewServer › Resources: current plan and bigger plans in the same region with the monthly cost; never a smaller disk.
• NewPlan change on Vultr confirmed by typing the new cost, with the restart warning; after the restart the panel checks the new plan and grows the file system if the disk grew.
• NewHetzner Cloud: plans and prices with guided steps in the Cloud Console (the change needs the server off); the file system is grown by itself at the restart.

0.19.0

AI assistant

A diagnosis of your sites by Claude: it reads the site's logs, configuration and responses (without passwords or personal data), explains the problems and proposes safe fixes you apply and undo in one click.

• NewAI assistant: the administrator enters the Anthropic API key (encrypted, never shown nor logged) and picks the model; without a key the assistant is hidden from the other users.
• NewSite diagnosis and "After the migration": before sending you see exactly what leaves the server ("What we send to the AI"), with passwords, keys, cookies, emails and visitors' IPs already removed.
• NewFixes only from a list of safe settings (PHP version and limits, WP_DEBUG, WordPress protections): before/after preview, explicit "Apply", values saved first and "Undo".
• NewCheck of all sites (also nightly), monthly token budget and this month's usage with a cost estimate.

0.18.0

Real-time antimalware

Site files are checked as they are written: web shells and certain malware are quarantined straight away, the rest is reported to you by email.

• NewReal-time protection: every PHP, JavaScript, HTML or .htaccess file written or uploaded to a site is checked a few seconds later, with the heuristic rules and with ClamAV when it runs as a service.
• NewAutomatic quarantine of certain detections only (ClamAV signature, EICAR test file, several web shell traits together), alerts for the others; or alerts only. Email to the site owner and the administrators.
• NewRecent events and the "Real-time protection: on" state on the Antimalware page and on each site's page; switch for the whole server and per site, per-site exclusions.
• ImprovedWatching with fanotify across the whole file system (including files moved into place, like PHP uploads), inotify when the kernel does not allow it; checks one at a time at the lowest priority with a capped queue.

0.17.0

Your domains' DNS on this server

Like cPanel, the server can be the DNS of the domains it hosts: zones created by themselves for sites and mail, record editor, DNSSEC, your own nameservers (also per reseller) and a secondary server.

• NewDNS › This server's DNS: in one click the server becomes authoritative DNS (PowerDNS, only for its own zones, no recursion) and shows as "This server" next to Cloudflare and 1PrimeCDN.
• NewEvery site has its zone, created and updated by itself: site and www, mail (MX, SPF, DKIM, DMARC, autoconfig when the mail service is active), CAA for Let's Encrypt; the version number (SOA) updates at every change.
• NewYour own nameservers (ns1/ns2) with the instructions for the glue records at the registrar, and each zone's checks: delegation, nameserver addresses, version seen from the Internet and from every nameserver.
• NewPer-zone DNSSEC with the DS record to enter at the registrar; custom nameservers for each reseller; a second KoaPanel server as secondary (transfer signed with TSIG and notifications).
• SecurityEach user sees and edits only the zones of its own sites; a zone shared with other accounts' sites belongs to the administrator.

0.16.0

Additional disks and migrations that never fill the server

New Server › Disks page to add space (also creating the disk at the provider), a migration starts only if there is enough space, and choosing the accounts shows which ones are suspended on the old server.

• NewServer › Disks: the server's disks with partitions, space used and SMART health. A new disk is prepared from the panel (ext4 or xfs, confirmed by typing the disk name) as space for the sites or in a folder of your choice; the system disk and disks with data are never touched.
• NewSites can live on an additional disk: new sites are created there and each site moves between disks from its page, staying online; address, SFTP and backups do not change.
• NewWith a Vultr or Hetzner Cloud API key the panel creates a disk at the provider (with the monthly cost when the provider gives it and an explicit confirmation) and attaches it to the server; a disk enlarged at the provider is extended with one click.
• NewMigration: the space bar shows, disk by disk, what is needed and what is free while you choose what to import. If the space is not enough the migration does not start, with suggestions to fix it; the space is checked again at the start and during the transfer, and the same applies to migrations from a file and to the final sync.
• NewMigration over SSH: each cPanel account or Plesk subscription shows whether it is active, suspended or disabled on the old server. Suspended ones are not selected at first, "Show active only" hides them and "Import suspended as suspended" brings them already suspended.

0.15.8

The summary of every migration, always available

In Migration every migration (over SSH or from a backup file) opens a page with everything that happened: what was on the old server, the steps, the sites, databases, mailboxes and final syncs.

• NewDetail page for every migration: source server or file, who started it, start, end and duration, outcome, the steps with their times and the data transferred, and what was found on the old server.
• NewFor each site the source and new folder, files copied and their size, PHP and SSL; for each database size, tables and user; for each mailbox messages, space and whether the password was kept; with links to the sites, databases and mailboxes created.
• NewThe history of the final syncs (when, files changed, databases re-imported) and "Remove from the list". The summary stays saved across panel updates; new passwords are never kept.
• NewMail forwarders are imported from cPanel too; the DNS zones found are listed in the summary.
• ImprovedIf a database the old panel lists is missing from its backup, the summary says so instead of ignoring it.
• FixedThe fake sites created by the problem fixed in 0.15.7 were removed from the migrations list.

0.15.7

cPanel migration fixes

The summary of a migration without databases no longer leaves a blank page, and cPanel's technical files no longer become sites.

• FixedThe summary of an SSH migration without databases (or mailboxes) left the Migration page completely blank: it now shows correctly.
• FixedA cPanel migration no longer creates fake sites from the account's technical files (cache.json, <domain>.php-fpm.yaml, <domain>_SSL): only real domains are imported.
• ImprovedIf a panel page hits an unexpected error it shows a message with "Reload" instead of a blank page; the rest of the panel stays usable.

0.15.6

Updates and restarts that do not interrupt operations

A panel update or restart waits for migrations, backups and the other running operations; if an operation is interrupted anyway, the panel explains it clearly.

• FixedA migration (or a backup, a restore, a WordPress update) is no longer interrupted by a panel update or restart: the panel waits for it to finish (up to 25 minutes) and meanwhile starts no new ones.
• ImprovedThe panel update shows "Waiting for running operations" and starts as soon as they finish; the administrator can update without waiting. Automatic updates are postponed while operations run.
• FixedIf an operation is interrupted anyway (forced or server restart) the panel shows "Operation interrupted by a panel restart" instead of "context canceled", with the sites and databases a migration had already created, to delete or retry.
• ImprovedNetwork and SSH errors during migrations explained in plain words (connection dropped, server not answering, access denied...), in Italian and English.

0.15.5

Outgoing mail: direct delivery or relay, with diagnostics

In Server › Mail › Outgoing the administrator chooses how mail leaves (port 25 or relay), sees what blocks delivery and sends a test email.

• NewDirect delivery (port 25) with diagnostics: tests port 25 to Gmail and Outlook, checks the reverse DNS (PTR) of the IPv4 and IPv6 address and that it points to the mail hostname, detects the provider and explains what to do on Vultr, Hetzner, OVHcloud and others.
• NewOn Vultr and Hetzner Cloud the reverse DNS is set from the panel with the provider's API key (kept encrypted only if you ask, never shown) and checked at once.
• NewRelay (smarthost) with ready-made services: Brevo, Mailgun, Amazon SES, SMTP2GO, Postmark, SendGrid or any other; always encrypted, credentials readable by root only. The SPF record suggested for the domains follows the chosen mode.
• New"Send test email": shows what the recipient's server or the relay answers (delivered, deferred or rejected, with the reason).
• NewSRS for forwarding: mail forwarded to external addresses is no longer dropped because of the original sender's SPF.
• Improved"Send over IPv4 only" option for servers without IPv6 reverse DNS; the delivery mode and its state are shown on the Mail page; a mode change that fails restores the previous one, and the queue restarts at once.

0.15.4

Roundcube, the new webmail

The default webmail is now Roundcube, with the panel's look; SnappyMail stays available and is chosen in Server › Mail.

• NewRoundcube is the new default webmail: modern and complete (folders, contacts, search, password change), with the panel's logo, colours and fonts, in Italian and English. "Webmail" next to a mailbox opens it already signed in, without asking for the password.
• NewIn Server › Mail the administrator chooses the default webmail (Roundcube or SnappyMail); from a mailbox's "···" menu, "Open with" opens the other one. The address https://<server>:8445/ leads to the default webmail.
• NewFrom Roundcube mailbox users can change their own password (Settings › Password): the panel checks the current one and the security rules.
• ImprovedThe two webmails are kept apart: each has its own path (/roundcube/, /snappymail/), its own cookies and its own PHP process; the sign-in page is never cached by the browser.

0.15.3

Webmail: reliable access from the panel and new look

"Webmail" always opens the mailbox at the first click and the webmail sign-in page looks like the panel.

• FixedWebmail from the panel: the browser no longer shows "Access Denied. Disallowed Sec-Fetch" (the sign-in now happens on the server, without the step the browser considered suspicious) nor "Link expired" at the first click when the panel had just restarted; reloading the page right after opening no longer breaks the link, which stays single-use for any other browser.
• ImprovedThe webmail has the panel's brand and colours: logo and name, dark background, white card, green button, the panel fonts served by the server, icon and title "Webmail · name"; the password field is called "Password".

0.15.2

Icons on the home page

Tool groups on the home page now have their own icon.

• ImprovedOn the user home the tool groups (Sites and domains, WordPress, Mail, Files, Databases, Advanced) show an icon instead of an empty square.

0.15.1

Fix in the Antimalware page

The site detail in the Antimalware page now opens.

• FixedClicking a site in the Antimalware page did not open its detail: it now does, and so do other pages that only change the address parameters.

0.15.0

Email on your server

New optional mail service: mailboxes on your sites' domains, forwarders, autoresponder, antispam, DKIM signing, webmail with one-click access from the panel and mailbox import from cPanel and Plesk with the original passwords.

• NewServer › Mail: the administrator enables the mail service with one click. The checks explain plainly whether the provider blocks outbound port 25 (and suggest an SMTP relay), whether the reverse DNS (PTR) of the server address is right and whether the address is on a blacklist.
• NewMailboxes on your sites' domains (and their aliases): create mailboxes with a generated strong password (shown once) or your own, with their space, mailbox usage, temporary deactivation and password change.
• NewForwarders and aliases, mailbox forwarding to another address (with or without a copy), catch-all address (off by default), autoresponder with subject, text and start and end dates, simple filters that move messages to a folder.
• NewMail DNS: the panel shows the MX, SPF, DKIM and DMARC records with copy buttons and checks what the public DNS sees. If the domain is on a connected Cloudflare or 1PrimeCDN account, "Set up mail DNS" publishes them for you.
• NewWebmail: "Open webmail" logs into the mailbox with one click, without asking for the password. Mailbox users can also log into the webmail on their own with address and password. The panel shows the settings for Outlook, Thunderbird and phones (automatic setup for Thunderbird and Outlook).
• NewMigration: the mailboxes in cPanel backups (and cPanel over SSH as root) are imported with all their messages and their original password; from Plesk the mailboxes are created and, when the password cannot be imported, a new one is generated and shown in the summary.
• NewPackages: new limits for mail domains, number of mailboxes, default and maximum space per mailbox; resellers' quotas include the number of mailboxes.
• NewMail administration: service status and memory used, message queue with "Retry now" and "Delete waiting messages", delivery summary of the last 24 hours, SMTP relay (encrypted password), Let's Encrypt certificate for the mail server name.
• SecurityNo open relay: port 25 only accepts mail for the server's domains; sending (587 and 465) requires logging in, only over an encrypted connection, and only with your own addresses and aliases. Inbound and outbound antispam, per-mailbox sending limit, protection against repeated login attempts (fail2ban for mail and IMAP).

0.14.1

Safer database imports

SQL dumps imported with WordPress, restored from backups or from safety copies go through the same checks as the migration.

• SecurityWordPress import: the uploaded SQL dump is checked before the site is touched (no mysql client commands such as system, no DEFINER, GRANT, CREATE USER or access to other databases) and imported with the client in protected mode. A refused dump no longer changes the site's files.
• SecurityBackup restore, WordPress update safety copies and staging copies: dumps made by the panel are checked the same way before the import too, and database objects stay bound only to the database's own users.

0.14.0

Migration over SSH from cPanel, Plesk and Linux

Bring sites onto this server by connecting straight to the old server: the panel recognises cPanel, Plesk or a Linux server, prepares the backup, transfers it and imports everything by itself. With the final sync you copy the latest changes right before switching DNS.

• NewMigration over SSH: in Migration choose "From a server over SSH", enter the old server's address, user and password (or private key) and confirm the server fingerprint on the first connection. Credentials stay in memory only for the duration of the migration: they are never saved.
• New"Analyse server" recognises cPanel (as root or as the account user), Plesk, DirectAdmin or a Linux server, lists accounts, domains, sizes and databases and lets you choose what to bring.
• NewcPanel and Plesk as root: the panel creates the full account backup on the old server (pkgacct or pleskbackup), downloads it and imports it like a backup file, then deletes it from the old server. Without root, or on any Linux, it copies the site files and databases directly and finds the WordPress credentials by itself.
• NewStep-by-step progress with data transferred, speed and estimated time; optional bandwidth limit so the old server is not slowed down.
• NewFinal sync: for 7 days after the migration one click copies the changed files and the databases again, right before moving DNS. The final report lists the next steps (TTL, sync, DNS, "Point to server").
• SecurityThe confirmed server fingerprint is pinned for the whole migration (final sync included); commands on the old server use checked names, always quoted; database passwords travel only in a private temporary file, never on the command line. Every connection is recorded in the activity log, without secrets, and attempts are rate limited. An SQL dump can no longer run mysql client commands (such as system) during the import.
• FixedMigration from a file: Plesk backups were not recognised (the index was misread) and ended up in the generic import; a user or reseller could not see the progress of their own import; a domain renamed like an existing site of another account is no longer used; a database with the same name already on the server no longer blocks the import, and triggers are recreated in the new database.

0.13.1

Fix for the migration from cPanel and Plesk

Copying the files of migrated sites failed on real servers: the files are now handed to the site user before the copy.

• FixedMigration: the files of imported sites were not copied (permission denied), so the site stayed empty and wp-config.php was not updated. The panel now prepares a private copy of the files, hands it to the site user and copies from there.

0.13.0

Antimalware and migration from cPanel and Plesk

Scan your sites' files for malware and web shells, with reversible quarantine and WordPress repair. And bring a whole cPanel or Plesk account onto this server starting from the backup file, in a few clicks.

• NewAntimalware: scan your sites' files with ClamAV and a built-in scanner that recognises web shells and the most common techniques (eval of obfuscated code, commands taken from the web request, PHP hidden in images, PHP files in the uploads folder, suspicious .htaccess). Every finding has a severity, a plain explanation, a path and a line.
• NewAntimalware: WordPress integrity check (comparison with the official core and plugin files) and "Repair WordPress", which puts the original files back after a safety copy.
• NewAntimalware: quarantine a file (moved out of the site, reversible with "Restore"), delete it after quarantine, or mark it a false positive. Automatic nightly scans (incremental) and a full one weekly, email alerts and a badge in the panel.
• NewMigration from cPanel and Plesk: upload the account's backup file (cPanel "Full backup" or Plesk "Backup Manager") and the panel recognises domains, databases, cron and email; then it creates the sites, copies the files, imports the databases with new passwords and rewrites the configuration (wp-config.php and others).
• NewMigration: an analysis step ("What we found"), a choice of what to import and into which account, step-by-step progress and a final report with the status of each item, the new passwords shown once, and post-migration checks.
• ImprovedSecurity: backup archives are treated as untrusted (defences against paths escaping the folder, zip bombs, links and special files) and SQL dumps are sanitized before import (no DEFINER, GRANT or access to other databases).
• NewEmail accounts are not migrated (the server does not handle mail yet): they are listed clearly in the summary with a count.

0.12.0

DNS with Cloudflare and 1PrimeCDN, Cron section, code editor

Connect Cloudflare or 1PrimeCDN and manage the DNS of your sites from the panel, with one-click "Point to server". Every cron job on one page, with last run and alerts. The file manager gets a real code editor.

• NewDNS: connect your Cloudflare account (API token) or 1PrimeCDN (API key) and manage the records of your sites' zones: add, edit and delete A, AAAA, CNAME, MX, TXT, SRV, CAA and NS records, with CDN proxying where available.
• New"Point to server": one click sets the site and www records to the server address, and the check shows what the public DNS of Cloudflare and Google see.
• ImprovedHTTPS: before requesting the certificate the panel checks that the domain points to the server and, if the DNS is at a connected provider, fixes it for you ("Fix DNS and enable HTTPS").
• NewExport the zone in BIND format and import records from a zone file.
• NewCron section: every scheduled job of your sites on one page, with the schedule in words ("every day at 03:00"), the next run, and the outcome of the last one with duration and output.
• NewCron: "Run now", enable/disable, edit, time limit per run and email alert when a job fails. Guided schedule builder with a preview of the next runs.
• NewCode editor in the file manager: syntax highlighting (PHP, HTML, CSS, JavaScript, JSON, YAML, SQL, Markdown and more), several files open in tabs, search and replace, multiple cursors, light or dark theme.
• NewEditor: PHP syntax check on save, with errors marked on the line; protection against concurrent changes (if the file changed in the meantime you can compare, overwrite or reload).

0.11.0

The panel has a name: KoaPanel

The panel is now called KoaPanel. With this version WordPress was tested end to end on a real server: install, cache, Redis, protections, staging and safe updates.

• NewNew name: KoaPanel, in the panel, in emails and in the console.
• ImprovedWordPress verified on a real server in every part: install from the official package, page cache, private Redis, protections, one-click login, staging, updates with automatic rollback.

0.10.4

One-click wp-admin login, even without HTTPS

The button that opens wp-admin always leads to the right address.

• FixedOn a WordPress site without a certificate the one-click login sent you to an https address that did not answer: it now stays on the right address, and after the install the site addresses stay correct.

0.10.3

Complete, verified WordPress installs

WordPress is now downloaded from the official package checked against its fingerprint, and staging copies work on real servers.

• FixedWith WordPress 7 some files with very long names were extracted truncated and the official checksum check failed: the panel now uses the official zip package and verifies its fingerprint.
• FixedCreating a staging copy stopped with a WP-CLI error: fixed.

0.10.2

Localized WordPress even right after a new release

If the translation of the latest WordPress is not ready yet, the panel installs WordPress and adds the translation as soon as possible.

• FixedInstalling WordPress stopped with "locale not found" in the days after a WordPress release: it now installs the English package and then the translation.

0.10.1

Fix for WordPress and system updates

Installing WordPress and running commands as the site user now work on real servers.

• FixedInstalling WordPress stopped with "setresuid: Operation not permitted": the panel service can now run commands as the site user.

0.10.0

WordPress, at its best

New WordPress section: one-click installation, three cache levels, safe updates with automatic rollback, protections, staging copy and wp-admin access without a password.

• NewNew "WordPress" section: one-click installation (together with the site too) with a dedicated database, a strong password shown only once and everything already optimised.
• NewThree cache levels already configured: nginx page cache (cart, checkout, account and admin area stay dynamic), a private Redis for each site and OPcache, with the real share of pages served from the cache.
• NewSpeed measurement: home page response time with and without cache, with the history of the measurements.
• NewSafe updates: backup of files and database, update, check of the files against the official checksums and site check; if anything goes wrong the site goes back as it was by itself. Nightly automatic updates with an email of the outcome.
• NewStaging copy: a private copy of the site, password protected and invisible to search engines, to publish to production when it is ready. It does not count against the site limit of the package.
• NewTools: enter wp-admin without a password (link valid 60 seconds, once), search and replace with preview, WP-CLI in the browser, WP-Cron on the system cron, debug and maintenance mode.
• NewImport of an existing WordPress from a files archive and a database dump, with the old address rewritten.
• SecurityWordPress protections you can turn on one by one: limited login attempts, blocking of persistent attacks with fail2ban, XML-RPC closed, no PHP in uploads, file editor disabled, sensitive files hidden and a nightly integrity check of the files.
• SecurityEvery WordPress command runs as the system user of the site, never as root, and never through a shell; passwords never appear on a command line.

0.9.0

Online license activation and support from the panel

Your license now activates online in one click and stays bound to your server; you can open and follow support requests from the panel.

• NewOnline license activation: paste the code in "Plan and license" (or open the link you received after purchase) and the panel activates it on the license server. Each license is valid for one server only.
• NewAfter purchase one click on "Activate in your panel" is enough: the "Plan and license" page opens with the code already filled in and only asks for a confirmation.
• NewRenewals and plan changes arrive by themselves: the panel checks the license once a day and receives the new expiry without pasting anything.
• NewNew "Support" section for administrators: open a request with attachments and, if you want, the technical data of the server (version, system, number of sites, never passwords), follow the answers and reply from the panel.
• ImprovedIf the license server cannot be reached the panel keeps working normally: the license stays valid for 30 days after the last check plus 14 days of tolerance, and a notice explains what is happening.
• SecurityA license already active on another server cannot be used a second time: the panel says so clearly and suggests contacting support when you move to a new server. No site is ever deleted.

0.8.1

More reliable PHP version installs

PHP versions not shipped by Ubuntu now install even on servers that cannot reach the Launchpad service.

• FixedAdding the PHP versions archive could stop with "Connection timed out": the panel now configures it by itself, with the signing key already included.

0.8.0

Updates you can watch progressing

Panel and server updates now show live what they are doing, how long is left and how it went, even while the panel restarts.

• NewNew progress screen for panel and Ubuntu updates: percentage, current phase, what is happening right now, elapsed time and estimated time remaining.
• NewPanel update: watch the download with speed and megabytes, the signature check, the test of the new version, the restart and the final check. During the restart the page waits on its own for the panel to come back and shows you the result.
• NewSystem updates: the package list updates while packages are downloaded and installed, with the old and new version, a filter and the "12 of 37" count.
• NewBefore updating you see what will change: the news of the new panel version or the system packages, how many are security updates, how much will be downloaded, the estimated duration, the services that will be restarted and whether the server will need a reboot.
• NewHistory of panel and server updates, with duration and result of each.
• ImprovedWhile an update is running a small indicator in the menu shows its percentage from any page: one click reopens the progress screen.
• ImprovedIf something goes wrong the page explains in plain words what happened and confirms that the previous version is running again; the technical details stay available for whoever has to step in.
• ImprovedThe estimate of the time remaining learns from how long the previous updates of your server took.

0.7.0

More servers, more PHP versions, more languages

Switch from one server to another from the menu, choose which PHP versions to install and tune the PHP of every site. And the panel now speaks English too.

• NewLinked servers: add your other servers running the panel and switch between them from the menu under the logo, already logged in and without typing the password again. For every server you see whether it is reachable, its version and its address.
• NewPHP versions: on the new page choose which versions to install (from 7.4 to 8.5), which one new sites use and which ones clients can see. You also see how many sites use each version.
• NewPHP settings of every site: memory, maximum upload size, maximum execution time, number of form fields and error display, within safe limits.
• NewPackages: you can decide which PHP versions the clients of each package may use.
• NewThe panel is available in Italian and English: everyone chooses their language on the Account page or on the login page. System emails, News and the manual also come in the chosen language.
• ImprovedThe administrator can set the default language of the server; whoever has not chosen a language sees the panel in the language of their browser.
• SecuritySwitching servers uses a one-time code valid for 60 seconds, for administrators only, and is recorded in the log of both servers. The link checks the fingerprint of the remote server's certificate on every request.

0.6.2

Fix for server updates

The Ubuntu update check now works on real servers too.

• FixedThe Ubuntu update check failed because of a missing permission: it now correctly finds the pending updates.

0.6.1

Fix for phpMyAdmin

phpMyAdmin now installs correctly on servers running Ubuntu 24.04.

• FixedThe phpMyAdmin installation stopped with the Nginx version shipped with Ubuntu 24.04: it now starts without errors.

0.6.0

phpMyAdmin, updates and plans

Connecting to your databases now takes a moment, even with phpMyAdmin and no password to remember. The panel updates itself safely, keeps an eye on server updates and shows the plan in use.

• NewDatabase connection details always at hand: server, port, database name and user, with copy buttons and ready-made examples for WordPress (wp-config.php) and PHP.
• NewphpMyAdmin included: from the database press “Open phpMyAdmin” and you are in, without typing a password. Access is limited to that database and expires on its own after one hour.
• New“Reset password” for every database user: the new password is shown only once, together with the updated connection details.
• New“Updates” page for administrators: the panel checks whether a new version is out and installs it when you want, or on its own at night. Every update is signed and verified; if the new version does not start, the panel goes back to the previous one by itself.
• NewServer updates: see how many Ubuntu updates are pending (and how many are security updates), whether a reboot is needed, and install them with one click. You can turn on automatic installation of security updates.
• New“Plan and license” page: the plan in use, how many sites you can still create and the field for the license code. Without a license the panel is free for personal use up to 3 sites.
• NewFor resellers: a link to their own shop so clients can move to a bigger package, with a button that appears on the clients' home page.
• SecurityphpMyAdmin only accepts sessions opened from the panel: the username and password login form is disabled.

0.5.0

Resellers and separate accounts

The panel now has three levels, like the big hosting panels: administrator, reseller and user. Every client sees only their own sites, resellers manage their clients under their own brand.

• NewAccounts for clients: every account has its own sites, databases, files and backups and sees nothing of the others. Every site still runs as its own isolated system user.
• NewPackages: decide how many sites, how much space and how many databases each account gets, and which PHP versions it can use. When an account reaches a limit the panel tells it and does not create more sites or databases.
• NewResellers: an agency can create and manage its own clients with its own packages, within a quota set by the administrator.
• NewReseller brand: their clients see the reseller's name, logo and support contacts, in the emails too.
• New“Log in as”: the administrator and resellers can open a client's panel to help, with an always-visible notice and a button to go back to their own account. The log records who did what and on whose behalf.
• NewSuspension: a suspended account cannot log in and its sites show the “Site suspended” page; reactivating it brings everything back as before, without losing anything.
• NewNew clients without a password by email: they receive a link to choose their own password, valid for 48 hours and usable only once.
• NewSpace used by every account, measured every 15 minutes, with an email warning when it goes above 90% of the package.
• ImprovedDifferent home pages per role: an overview of the accounts for the administrator, client cards for the reseller and, for users, a home page with a tool search (“backup”, “php”, “database password”…).
• SecurityEvery request to the panel is checked in a single place: a user cannot see or touch the sites, databases, jobs or log of other accounts, and the server pages stay reserved to administrators.

0.4.0

News, manual and system emails

The panel now keeps you informed: it emails you when something is wrong and every time a new version arrives. You also get the News page and a user manual always at hand.

• New“News” page: the list of panel versions with the changes explained simply. A dot in the menu tells you when there is something new to read.
• NewUser manual inside the panel: sites, HTTPS, databases, files, backups, security and much more, explained step by step.
• NewSystem emails: the panel can send emails through Prime Mail or through your own SMTP server, with a configurable sender and a button to send a test email.
• NewEmail alerts to administrators: HTTPS certificate expiring, backup failed, disk almost full.
• NewWhen the panel is updated, administrators receive an email with the news of the new version.
• SecurityIf the password of your account is changed you receive an email with date, time and origin address, so you immediately notice a change you did not make.
• ImprovedOn the Account page you can enter your email address to receive the alerts that concern you.

0.3.0

Login with username and password

You no longer need the access code to enter the panel: username and password are enough, protected by new defences against intrusion attempts.

• NewLogin with username and password instead of pasting a code (token).
• NewAccount page to change your password by yourself.
• SecurityAfter too many wrong attempts login is blocked for a few minutes, to stop anyone trying to guess the password.
• SecurityProtected sessions: they expire on their own after a period of inactivity and, when you change the password, they are closed on every other device.

0.2.0

New look

The panel has a brand new look, clearer and tidier, and is comfortable to use on the phone too.

• NewNew graphic design, more readable and tidy.
• NewAutomatic dark theme, if your device uses it.
• ImprovedPhone version with the menu at the bottom, easy to use with one hand.
• ImprovedFonts are bundled with the panel: the look is always the same and works without connecting to external services.

0.1.1

Installation verified on a real server

The installation procedure has been tested on a real server and made more reliable.

• ImprovedInstallation tested from start to finish on a real server.
• FixedThe installation stopped if the panel file was not already marked as executable.

0.1.0

First version

The first version of the panel: everything you need to host websites on a server, in a single program that is easy to install.

• NewA single program to install on the server, with the panel already included.
• NewWebsites separated from each other: every site has its own user, so a problem on one site does not touch the others.
• NewPHP sites with the version you prefer (8.3 or 8.4), served by Nginx.
• NewFree HTTPS with Let's Encrypt, turned on with one click and renewed automatically.
• NewMariaDB databases with securely generated users and passwords.
• NewScheduled tasks (cron) for every site.
• NewLong operations, such as certificates and backups, work in the background and you can follow their progress.
• NewEncrypted backups of sites and databases, on S3-compatible storage or a server folder, with restore.
• NewSFTP access to upload files, locked inside the site folder.
• NewFile manager to view, edit, upload and download site files from the browser.
• SecurityFirewall and automatic blocking of addresses that attempt repeated logins (fail2ban).
• SecurityActivity log: who did what, when and from where.