What's new in Koapanel

0.15.3

Webmail: reliable access from the panel and new look

"Webmail" always opens the mailbox at the first click and the webmail sign-in page looks like the panel.

• FixedWebmail from the panel: the browser no longer shows "Access Denied. Disallowed Sec-Fetch" (the sign-in now happens on the server, without the step the browser considered suspicious) nor "Link expired" at the first click when the panel had just restarted; reloading the page right after opening no longer breaks the link, which stays single-use for any other browser.
• ImprovedThe webmail has the panel's brand and colours: logo and name, dark background, white card, green button, the panel fonts served by the server, icon and title "Webmail · name"; the password field is called "Password".

0.15.2

Icons on the home page

Tool groups on the home page now have their own icon.

• ImprovedOn the user home the tool groups (Sites and domains, WordPress, Mail, Files, Databases, Advanced) show an icon instead of an empty square.

0.15.1

Fix in the Antimalware page

The site detail in the Antimalware page now opens.

• FixedClicking a site in the Antimalware page did not open its detail: it now does, and so do other pages that only change the address parameters.

0.15.0

Email on your server

New optional mail service: mailboxes on your sites' domains, forwarders, autoresponder, antispam, DKIM signing, webmail with one-click access from the panel and mailbox import from cPanel and Plesk with the original passwords.

• NewServer › Mail: the administrator enables the mail service with one click. The checks explain plainly whether the provider blocks outbound port 25 (and suggest an SMTP relay), whether the reverse DNS (PTR) of the server address is right and whether the address is on a blacklist.
• NewMailboxes on your sites' domains (and their aliases): create mailboxes with a generated strong password (shown once) or your own, with their space, mailbox usage, temporary deactivation and password change.
• NewForwarders and aliases, mailbox forwarding to another address (with or without a copy), catch-all address (off by default), autoresponder with subject, text and start and end dates, simple filters that move messages to a folder.
• NewMail DNS: the panel shows the MX, SPF, DKIM and DMARC records with copy buttons and checks what the public DNS sees. If the domain is on a connected Cloudflare or 1PrimeCDN account, "Set up mail DNS" publishes them for you.
• NewWebmail: "Open webmail" logs into the mailbox with one click, without asking for the password. Mailbox users can also log into the webmail on their own with address and password. The panel shows the settings for Outlook, Thunderbird and phones (automatic setup for Thunderbird and Outlook).
• NewMigration: the mailboxes in cPanel backups (and cPanel over SSH as root) are imported with all their messages and their original password; from Plesk the mailboxes are created and, when the password cannot be imported, a new one is generated and shown in the summary.
• NewPackages: new limits for mail domains, number of mailboxes, default and maximum space per mailbox; resellers' quotas include the number of mailboxes.
• NewMail administration: service status and memory used, message queue with "Retry now" and "Delete waiting messages", delivery summary of the last 24 hours, SMTP relay (encrypted password), Let's Encrypt certificate for the mail server name.
• SecurityNo open relay: port 25 only accepts mail for the server's domains; sending (587 and 465) requires logging in, only over an encrypted connection, and only with your own addresses and aliases. Inbound and outbound antispam, per-mailbox sending limit, protection against repeated login attempts (fail2ban for mail and IMAP).

0.14.1

Safer database imports

SQL dumps imported with WordPress, restored from backups or from safety copies go through the same checks as the migration.

• SecurityWordPress import: the uploaded SQL dump is checked before the site is touched (no mysql client commands such as system, no DEFINER, GRANT, CREATE USER or access to other databases) and imported with the client in protected mode. A refused dump no longer changes the site's files.
• SecurityBackup restore, WordPress update safety copies and staging copies: dumps made by the panel are checked the same way before the import too, and database objects stay bound only to the database's own users.

0.14.0

Migration over SSH from cPanel, Plesk and Linux

Bring sites onto this server by connecting straight to the old server: the panel recognises cPanel, Plesk or a Linux server, prepares the backup, transfers it and imports everything by itself. With the final sync you copy the latest changes right before switching DNS.

• NewMigration over SSH: in Migration choose "From a server over SSH", enter the old server's address, user and password (or private key) and confirm the server fingerprint on the first connection. Credentials stay in memory only for the duration of the migration: they are never saved.
• New"Analyse server" recognises cPanel (as root or as the account user), Plesk, DirectAdmin or a Linux server, lists accounts, domains, sizes and databases and lets you choose what to bring.
• NewcPanel and Plesk as root: the panel creates the full account backup on the old server (pkgacct or pleskbackup), downloads it and imports it like a backup file, then deletes it from the old server. Without root, or on any Linux, it copies the site files and databases directly and finds the WordPress credentials by itself.
• NewStep-by-step progress with data transferred, speed and estimated time; optional bandwidth limit so the old server is not slowed down.
• NewFinal sync: for 7 days after the migration one click copies the changed files and the databases again, right before moving DNS. The final report lists the next steps (TTL, sync, DNS, "Point to server").
• SecurityThe confirmed server fingerprint is pinned for the whole migration (final sync included); commands on the old server use checked names, always quoted; database passwords travel only in a private temporary file, never on the command line. Every connection is recorded in the activity log, without secrets, and attempts are rate limited. An SQL dump can no longer run mysql client commands (such as system) during the import.
• FixedMigration from a file: Plesk backups were not recognised (the index was misread) and ended up in the generic import; a user or reseller could not see the progress of their own import; a domain renamed like an existing site of another account is no longer used; a database with the same name already on the server no longer blocks the import, and triggers are recreated in the new database.

0.13.1

Fix for the migration from cPanel and Plesk

Copying the files of migrated sites failed on real servers: the files are now handed to the site user before the copy.

• FixedMigration: the files of imported sites were not copied (permission denied), so the site stayed empty and wp-config.php was not updated. The panel now prepares a private copy of the files, hands it to the site user and copies from there.

0.13.0

Antimalware and migration from cPanel and Plesk

Scan your sites' files for malware and web shells, with reversible quarantine and WordPress repair. And bring a whole cPanel or Plesk account onto this server starting from the backup file, in a few clicks.

• NewAntimalware: scan your sites' files with ClamAV and a built-in scanner that recognises web shells and the most common techniques (eval of obfuscated code, commands taken from the web request, PHP hidden in images, PHP files in the uploads folder, suspicious .htaccess). Every finding has a severity, a plain explanation, a path and a line.
• NewAntimalware: WordPress integrity check (comparison with the official core and plugin files) and "Repair WordPress", which puts the original files back after a safety copy.
• NewAntimalware: quarantine a file (moved out of the site, reversible with "Restore"), delete it after quarantine, or mark it a false positive. Automatic nightly scans (incremental) and a full one weekly, email alerts and a badge in the panel.
• NewMigration from cPanel and Plesk: upload the account's backup file (cPanel "Full backup" or Plesk "Backup Manager") and the panel recognises domains, databases, cron and email; then it creates the sites, copies the files, imports the databases with new passwords and rewrites the configuration (wp-config.php and others).
• NewMigration: an analysis step ("What we found"), a choice of what to import and into which account, step-by-step progress and a final report with the status of each item, the new passwords shown once, and post-migration checks.
• ImprovedSecurity: backup archives are treated as untrusted (defences against paths escaping the folder, zip bombs, links and special files) and SQL dumps are sanitized before import (no DEFINER, GRANT or access to other databases).
• NewEmail accounts are not migrated (the server does not handle mail yet): they are listed clearly in the summary with a count.

0.12.0

DNS with Cloudflare and 1PrimeCDN, Cron section, code editor

Connect Cloudflare or 1PrimeCDN and manage the DNS of your sites from the panel, with one-click "Point to server". Every cron job on one page, with last run and alerts. The file manager gets a real code editor.

• NewDNS: connect your Cloudflare account (API token) or 1PrimeCDN (API key) and manage the records of your sites' zones: add, edit and delete A, AAAA, CNAME, MX, TXT, SRV, CAA and NS records, with CDN proxying where available.
• New"Point to server": one click sets the site and www records to the server address, and the check shows what the public DNS of Cloudflare and Google see.
• ImprovedHTTPS: before requesting the certificate the panel checks that the domain points to the server and, if the DNS is at a connected provider, fixes it for you ("Fix DNS and enable HTTPS").
• NewExport the zone in BIND format and import records from a zone file.
• NewCron section: every scheduled job of your sites on one page, with the schedule in words ("every day at 03:00"), the next run, and the outcome of the last one with duration and output.
• NewCron: "Run now", enable/disable, edit, time limit per run and email alert when a job fails. Guided schedule builder with a preview of the next runs.
• NewCode editor in the file manager: syntax highlighting (PHP, HTML, CSS, JavaScript, JSON, YAML, SQL, Markdown and more), several files open in tabs, search and replace, multiple cursors, light or dark theme.
• NewEditor: PHP syntax check on save, with errors marked on the line; protection against concurrent changes (if the file changed in the meantime you can compare, overwrite or reload).

0.11.0

The panel has a name: Koapanel

The panel is now called Koapanel. With this version WordPress was tested end to end on a real server: install, cache, Redis, protections, staging and safe updates.

• NewNew name: Koapanel, in the panel, in emails and in the console.
• ImprovedWordPress verified on a real server in every part: install from the official package, page cache, private Redis, protections, one-click login, staging, updates with automatic rollback.

0.10.4

One-click wp-admin login, even without HTTPS

The button that opens wp-admin always leads to the right address.

• FixedOn a WordPress site without a certificate the one-click login sent you to an https address that did not answer: it now stays on the right address, and after the install the site addresses stay correct.

0.10.3

Complete, verified WordPress installs

WordPress is now downloaded from the official package checked against its fingerprint, and staging copies work on real servers.

• FixedWith WordPress 7 some files with very long names were extracted truncated and the official checksum check failed: the panel now uses the official zip package and verifies its fingerprint.
• FixedCreating a staging copy stopped with a WP-CLI error: fixed.

0.10.2

Localized WordPress even right after a new release

If the translation of the latest WordPress is not ready yet, the panel installs WordPress and adds the translation as soon as possible.

• FixedInstalling WordPress stopped with "locale not found" in the days after a WordPress release: it now installs the English package and then the translation.

0.10.1

Fix for WordPress and system updates

Installing WordPress and running commands as the site user now work on real servers.

• FixedInstalling WordPress stopped with "setresuid: Operation not permitted": the panel service can now run commands as the site user.

0.10.0

WordPress, at its best

New WordPress section: one-click installation, three cache levels, safe updates with automatic rollback, protections, staging copy and wp-admin access without a password.

• NewNew "WordPress" section: one-click installation (together with the site too) with a dedicated database, a strong password shown only once and everything already optimised.
• NewThree cache levels already configured: nginx page cache (cart, checkout, account and admin area stay dynamic), a private Redis for each site and OPcache, with the real share of pages served from the cache.
• NewSpeed measurement: home page response time with and without cache, with the history of the measurements.
• NewSafe updates: backup of files and database, update, check of the files against the official checksums and site check; if anything goes wrong the site goes back as it was by itself. Nightly automatic updates with an email of the outcome.
• NewStaging copy: a private copy of the site, password protected and invisible to search engines, to publish to production when it is ready. It does not count against the site limit of the package.
• NewTools: enter wp-admin without a password (link valid 60 seconds, once), search and replace with preview, WP-CLI in the browser, WP-Cron on the system cron, debug and maintenance mode.
• NewImport of an existing WordPress from a files archive and a database dump, with the old address rewritten.
• SecurityWordPress protections you can turn on one by one: limited login attempts, blocking of persistent attacks with fail2ban, XML-RPC closed, no PHP in uploads, file editor disabled, sensitive files hidden and a nightly integrity check of the files.
• SecurityEvery WordPress command runs as the system user of the site, never as root, and never through a shell; passwords never appear on a command line.

0.9.0

Online license activation and support from the panel

Your license now activates online in one click and stays bound to your server; you can open and follow support requests from the panel.

• NewOnline license activation: paste the code in "Plan and license" (or open the link you received after purchase) and the panel activates it on the license server. Each license is valid for one server only.
• NewAfter purchase one click on "Activate in your panel" is enough: the "Plan and license" page opens with the code already filled in and only asks for a confirmation.
• NewRenewals and plan changes arrive by themselves: the panel checks the license once a day and receives the new expiry without pasting anything.
• NewNew "Support" section for administrators: open a request with attachments and, if you want, the technical data of the server (version, system, number of sites, never passwords), follow the answers and reply from the panel.
• ImprovedIf the license server cannot be reached the panel keeps working normally: the license stays valid for 30 days after the last check plus 14 days of tolerance, and a notice explains what is happening.
• SecurityA license already active on another server cannot be used a second time: the panel says so clearly and suggests contacting support when you move to a new server. No site is ever deleted.

0.8.1

More reliable PHP version installs

PHP versions not shipped by Ubuntu now install even on servers that cannot reach the Launchpad service.

• FixedAdding the PHP versions archive could stop with "Connection timed out": the panel now configures it by itself, with the signing key already included.

0.8.0

Updates you can watch progressing

Panel and server updates now show live what they are doing, how long is left and how it went, even while the panel restarts.

• NewNew progress screen for panel and Ubuntu updates: percentage, current phase, what is happening right now, elapsed time and estimated time remaining.
• NewPanel update: watch the download with speed and megabytes, the signature check, the test of the new version, the restart and the final check. During the restart the page waits on its own for the panel to come back and shows you the result.
• NewSystem updates: the package list updates while packages are downloaded and installed, with the old and new version, a filter and the "12 of 37" count.
• NewBefore updating you see what will change: the news of the new panel version or the system packages, how many are security updates, how much will be downloaded, the estimated duration, the services that will be restarted and whether the server will need a reboot.
• NewHistory of panel and server updates, with duration and result of each.
• ImprovedWhile an update is running a small indicator in the menu shows its percentage from any page: one click reopens the progress screen.
• ImprovedIf something goes wrong the page explains in plain words what happened and confirms that the previous version is running again; the technical details stay available for whoever has to step in.
• ImprovedThe estimate of the time remaining learns from how long the previous updates of your server took.

0.7.0

More servers, more PHP versions, more languages

Switch from one server to another from the menu, choose which PHP versions to install and tune the PHP of every site. And the panel now speaks English too.

• NewLinked servers: add your other servers running the panel and switch between them from the menu under the logo, already logged in and without typing the password again. For every server you see whether it is reachable, its version and its address.
• NewPHP versions: on the new page choose which versions to install (from 7.4 to 8.5), which one new sites use and which ones clients can see. You also see how many sites use each version.
• NewPHP settings of every site: memory, maximum upload size, maximum execution time, number of form fields and error display, within safe limits.
• NewPackages: you can decide which PHP versions the clients of each package may use.
• NewThe panel is available in Italian and English: everyone chooses their language on the Account page or on the login page. System emails, News and the manual also come in the chosen language.
• ImprovedThe administrator can set the default language of the server; whoever has not chosen a language sees the panel in the language of their browser.
• SecuritySwitching servers uses a one-time code valid for 60 seconds, for administrators only, and is recorded in the log of both servers. The link checks the fingerprint of the remote server's certificate on every request.

0.6.2

Fix for server updates

The Ubuntu update check now works on real servers too.

• FixedThe Ubuntu update check failed because of a missing permission: it now correctly finds the pending updates.

0.6.1

Fix for phpMyAdmin

phpMyAdmin now installs correctly on servers running Ubuntu 24.04.

• FixedThe phpMyAdmin installation stopped with the Nginx version shipped with Ubuntu 24.04: it now starts without errors.

0.6.0

phpMyAdmin, updates and plans

Connecting to your databases now takes a moment, even with phpMyAdmin and no password to remember. The panel updates itself safely, keeps an eye on server updates and shows the plan in use.

• NewDatabase connection details always at hand: server, port, database name and user, with copy buttons and ready-made examples for WordPress (wp-config.php) and PHP.
• NewphpMyAdmin included: from the database press “Open phpMyAdmin” and you are in, without typing a password. Access is limited to that database and expires on its own after one hour.
• New“Reset password” for every database user: the new password is shown only once, together with the updated connection details.
• New“Updates” page for administrators: the panel checks whether a new version is out and installs it when you want, or on its own at night. Every update is signed and verified; if the new version does not start, the panel goes back to the previous one by itself.
• NewServer updates: see how many Ubuntu updates are pending (and how many are security updates), whether a reboot is needed, and install them with one click. You can turn on automatic installation of security updates.
• New“Plan and license” page: the plan in use, how many sites you can still create and the field for the license code. Without a license the panel is free for personal use up to 3 sites.
• NewFor resellers: a link to their own shop so clients can move to a bigger package, with a button that appears on the clients' home page.
• SecurityphpMyAdmin only accepts sessions opened from the panel: the username and password login form is disabled.

0.5.0

Resellers and separate accounts

The panel now has three levels, like the big hosting panels: administrator, reseller and user. Every client sees only their own sites, resellers manage their clients under their own brand.

• NewAccounts for clients: every account has its own sites, databases, files and backups and sees nothing of the others. Every site still runs as its own isolated system user.
• NewPackages: decide how many sites, how much space and how many databases each account gets, and which PHP versions it can use. When an account reaches a limit the panel tells it and does not create more sites or databases.
• NewResellers: an agency can create and manage its own clients with its own packages, within a quota set by the administrator.
• NewReseller brand: their clients see the reseller's name, logo and support contacts, in the emails too.
• New“Log in as”: the administrator and resellers can open a client's panel to help, with an always-visible notice and a button to go back to their own account. The log records who did what and on whose behalf.
• NewSuspension: a suspended account cannot log in and its sites show the “Site suspended” page; reactivating it brings everything back as before, without losing anything.
• NewNew clients without a password by email: they receive a link to choose their own password, valid for 48 hours and usable only once.
• NewSpace used by every account, measured every 15 minutes, with an email warning when it goes above 90% of the package.
• ImprovedDifferent home pages per role: an overview of the accounts for the administrator, client cards for the reseller and, for users, a home page with a tool search (“backup”, “php”, “database password”…).
• SecurityEvery request to the panel is checked in a single place: a user cannot see or touch the sites, databases, jobs or log of other accounts, and the server pages stay reserved to administrators.

0.4.0

News, manual and system emails

The panel now keeps you informed: it emails you when something is wrong and every time a new version arrives. You also get the News page and a user manual always at hand.

• New“News” page: the list of panel versions with the changes explained simply. A dot in the menu tells you when there is something new to read.
• NewUser manual inside the panel: sites, HTTPS, databases, files, backups, security and much more, explained step by step.
• NewSystem emails: the panel can send emails through Prime Mail or through your own SMTP server, with a configurable sender and a button to send a test email.
• NewEmail alerts to administrators: HTTPS certificate expiring, backup failed, disk almost full.
• NewWhen the panel is updated, administrators receive an email with the news of the new version.
• SecurityIf the password of your account is changed you receive an email with date, time and origin address, so you immediately notice a change you did not make.
• ImprovedOn the Account page you can enter your email address to receive the alerts that concern you.

0.3.0

Login with username and password

You no longer need the access code to enter the panel: username and password are enough, protected by new defences against intrusion attempts.

• NewLogin with username and password instead of pasting a code (token).
• NewAccount page to change your password by yourself.
• SecurityAfter too many wrong attempts login is blocked for a few minutes, to stop anyone trying to guess the password.
• SecurityProtected sessions: they expire on their own after a period of inactivity and, when you change the password, they are closed on every other device.

0.2.0

New look

The panel has a brand new look, clearer and tidier, and is comfortable to use on the phone too.

• NewNew graphic design, more readable and tidy.
• NewAutomatic dark theme, if your device uses it.
• ImprovedPhone version with the menu at the bottom, easy to use with one hand.
• ImprovedFonts are bundled with the panel: the look is always the same and works without connecting to external services.

0.1.1

Installation verified on a real server

The installation procedure has been tested on a real server and made more reliable.

• ImprovedInstallation tested from start to finish on a real server.
• FixedThe installation stopped if the panel file was not already marked as executable.

0.1.0

First version

The first version of the panel: everything you need to host websites on a server, in a single program that is easy to install.

• NewA single program to install on the server, with the panel already included.
• NewWebsites separated from each other: every site has its own user, so a problem on one site does not touch the others.
• NewPHP sites with the version you prefer (8.3 or 8.4), served by Nginx.
• NewFree HTTPS with Let's Encrypt, turned on with one click and renewed automatically.
• NewMariaDB databases with securely generated users and passwords.
• NewScheduled tasks (cron) for every site.
• NewLong operations, such as certificates and backups, work in the background and you can follow their progress.
• NewEncrypted backups of sites and databases, on S3-compatible storage or a server folder, with restore.
• NewSFTP access to upload files, locked inside the site folder.
• NewFile manager to view, edit, upload and download site files from the browser.
• SecurityFirewall and automatic blocking of addresses that attempt repeated logins (fail2ban).
• SecurityActivity log: who did what, when and from where.