Latest updates, most recent first

A refreshed look

A dark header and sidebar, a Server overview banner on the Dashboard that puts accounts, packages, resellers and server health in one glance, and clearer small text throughout.

A support desk, built in

A new Ticket System section under General with a dashboard (open and waiting tickets, tickets per month, how quickly tickets are answered and resolved, optional response targets), a queue, a history and its own settings. Staff can reply, keep private notes, use saved replies, change topic and priority and assign work, and are told about new tickets by a banner, email, a chat message or a daily summary. Each server owner can set up a support mailbox with one click so replies and new tickets can arrive by email, resellers get their own desk and mailbox for their own customers and can hand a ticket up, and a redacted bug report can be prepared for the developers. Part of v0.21.0.

Documentation brought fully up to date

A complete check of every guide against the real product found and fixed a handful of inaccuracies (File Manager uploads and opening folders, where quarantined files go, what the panel-login ban blocks, backup timeouts) and added the three guides that were missing: KNJ Webmail, Signing In and Server Link. The same check turned up a real bug: deleting a subscriber did not remove them from the linked mailing list, so they kept receiving list mail until someone clicked Sync now. Fixed in v0.20.21; KNJ Webmail (v0.7.4) no longer silently drops an attachment over 20 MB and now says so instead (v0.20.22).

Security audit #26

Ten findings, every one fixed or accepted on purpose, none open. The most serious was an older one about how much reach the panel's everyday account had over the server's privileged steps; those steps now take their instructions only from places that account cannot change. Releases are now signed with a key that never leaves our own workstation, and updates and installs refuse anything that does not verify; only the web server may vouch for a visitor's address; and smaller fixes landed in Deploy from Git's branch lookup, the database tool's one-time sign-in and push deploys for suspended accounts. The Security Audits page has the plain-language write-up (v0.20.20).

phpMyAdmin is no longer visible to strangers

The last open finding from our penetration test. Everything under the phpMyAdmin address now answers a plain "not found" unless the browser holds a signed-in database session, the same as any address that does not exist, so the tool can no longer be found or probed from the internet. Customers still open it with one click from their account panel. The session cookie is now secure and HTTP-only, and two yellow warnings people saw on its front page are gone (v0.20.18, v0.20.19).

An upgrade now applies everything in one run

The upgrade script replaces its own file while it runs and kept executing the old copy, so a release's new steps only took effect on a second run, which the panel's Update button never offers. Once the new files are in place the upgrade now hands over to the new script, and the web server rules for phpMyAdmin are never written before the file they depend on exists. Found upgrading our own production server (v0.20.19).

Hosted domains keep their own /account and /controller

The shared web server snippet every customer site includes used to answer those paths with the panel, so a customer's own page at one of them never reached their site. The panel has its own ports for this, so they are gone from customer domains. domain.com/webmail stays and now matches only that path and what is under it (v0.20.16, v0.20.17).

Deploy from Git, rebuilt

Every link has its own SSH key (a repository host accepts a key on only one repository), the linked repositories are a Current links table with each link's settings in a window, a repository can be deployed onto an existing domain or subdomain, and each repository now records the site it serves so a deploy or removal can never touch the wrong one. Links made before this keep working (v0.20.13, v0.20.14, v0.20.15).

Penetration-test hardening, then a retest

An external test of a fresh install found no way in and six small things to tighten: the web server version is no longer printed, panel pages send the standard browser safety headers, the forgot-password form answers unknown and known emails alike, the API no longer reveals which paths exist, and five wrong panel logins now ban an address from the panel's own ports only instead of the whole server. Every finding and its fix is on the Penetration Testing page (v0.20.10 to v0.20.12).

Long jobs no longer hold up the rest of the panel

Found when a backup server became unreachable and every off-site upload sat waiting for minutes, which left SSL issuance and Deploy from Git queued behind them. Backup uploads, account and cPanel imports, malware scans, subscriber emails and system installs and upgrades now each run on a worker of their own, so one slow job can only ever delay its own kind. Uploads are also queued once per backup instead of piling up, give up quickly on a destination that cannot be reached, and are not retried again for two hours after a failure. Backup History's Stored column also shows tidy single-line labels instead of tall wrapped ones.

File Manager, the upload problem actually fixed

Files and folders made by your own tools (SFTP, git, a backup restore) were still refusing uploads, edits and renames when the page ran on a real server, even after the earlier fix. The panel asks a small helper for write access to just that one file or folder, and inside the web server's own sandbox that helper was being blocked from starting. It now starts itself outside that sandbox, so uploading into a subfolder, replacing a file, renaming, saving an edit, compressing and extracting all work on files you created yourself. Checked end to end on a development server with a real account, and any future refusal is now written to the log with the reason. Also from the same round of testing: Tidy source in the HTML Editor now produces clean indentation, the Trash window keeps its buttons in step, and the layout holds together at tablet width.

File Manager, rebuilt

The browser-based file manager now works like the one you know from cPanel: a toolbar across the top, a folder tree on the left, a detail list with size, date, type and permissions, a right-click menu, and keyboard shortcuts. Upload by dragging files or whole folders in, copy, cut, paste and move (or drag items onto a folder), search by name, change permissions, and compress or extract zip and tar.gz archives safely as your own user. A real Trash for each account keeps deleted items for 30 days and can restore them; the delete window has a checkbox to skip the Trash and remove something permanently. Viewing is always safe: your own pages and images open without ever being able to run script on the panel. New alongside it is a dedicated HTML Editor with a visual Design view, a Source view, Split and a device-width Preview, links, pictures, tables, find and replace, and draft recovery.

File Manager uploads, edits and folders that failed on a customer's own files, fixed

Files and folders made by an account's own tools (SFTP, git, a restore) are not writable by the panel by default, so uploading into those folders, saving an edit or renaming gave "Could not open the file". The panel now asks for write access to just that one file or folder and carries on, never following a symlink and never touching anything the account does not own. Uploading a file with a name that already exists now replaces it, and every failure gives a plain message. Separately, when the account panel was reached through a customer's own domain, the code editor stayed blank because the browser refused to run its script from the panel's own address; the panel now allows that, and existing servers pick it up on their next update.

Traffic & Visitors showing nothing, fixed

The page reads each domain's web server log, and on servers where the log files had been set to belong to a group the panel was not part of (nightly log rotation does this, and the recent security hardening closed it further), every read was refused and the page quietly showed zeros. The log folder and every log in it now belong to a group the panel is in, new logs inherit it, and if a log ever does exist but cannot be read the page now says so instead of showing an empty month. Upgrading also puts the panel into that group on servers where an earlier upgrade missed it.

Subscribers to mailing list, in one click

A subscriber list can now be linked to a mailing list from its own page: the panel creates the list address, fills it with your current subscribers and keeps it in step automatically as people sign up, confirm, are imported or unsubscribe, so sending an update to everyone is just an email to that address. A Sync now button re-checks it on demand, and unlinking leaves the mailing list itself untouched. The work is queued in the background so signing up never waits on it.

Security audits #22 to #25

Four more deep audits, every finding fixed. File access for customer accounts is now confined so a symlink can never lead into another account's files, links the panel builds are checked against trusted hostnames, flagged malware is held in a root-owned quarantine, and the host itself is tighter: the panel directory is closed to customers, web server logs are protected, process lists are hidden between users, FTP configuration is removed along with a deleted account, team invitation tokens are stored hashed, logins take the same time whether or not the account exists, and AWStats pages gained a strict content policy alongside HSTS. Full write-ups are on the Security Audits page.

Scheduled backups now re-arm properly when you change the schedule

If you moved the start time to later the same day after a run had already happened that day, the panel still thought today was done and quietly waited until tomorrow. Saving a schedule now lines today up with it: a start time that has already passed waits for the next one (no surprise backup), and one still ahead runs at the new time. Confirmed on a live server: backups complete, upload and verify on the backup server, and the copy on the web server is removed automatically.

Restoring a backup of an account with a Node project could never succeed

Found by running a real full restore end to end: the safety check that inspects a backup archive before it is unpacked refused any shortcut (symbolic link) that pointed up a folder, including the completely ordinary ones inside every node_modules/.bin. It now works out where a link actually lands and refuses only links that climb out of the account, with extra rules so the loosened check cannot be abused (with extra rules so it cannot be abused, and a related gap in how one kind of link was checked closed at the same time).

Backups were failing the moment you clicked Backup Now

Found live on the first real backup after the rebuild: the panel names each backup folder with a short random suffix (so two backups started in the same second can never collide) but the privileged script that actually builds the backup only accepted the older plain-timestamp name and rejected every one with "invalid backup path". The script now accepts both, and a new test reads the script's own rules and checks that every folder name, base path and temp file the panel generates for a backup or restore would be accepted, so the two can never drift apart silently again.

One clock, everywhere

The timezone you choose under Server Setup is now genuinely the server's time across the whole panel. A backup scheduled for 02:00 starts at 02:00 on your server (it used to be read in UTC, so 02:00 became 03:00 in British summer time); the nightly update check, malware scans and subscriber reports follow it too, and dates and times shown across the panel — backup history, the admin action log, certificate expiry, deploy history, mail delivery — are displayed in it. Also: saving a backup schedule after today's start time has passed no longer fires a backup straight away.

Backups, rebuilt around keeping them off your web server

The panel used to build every backup on the web server's disk and merely copy it elsewhere, keeping both. Now you choose: keep it locally for a while, or move it off the server as soon as every backup destination has a verified copy (each upload is checked against the destination first, and a local copy is never deleted on an assumption). A backup that lives only off the server stays in your history and can be fetched back with one click to restore or download it — your customers get a matching "Bring back" button. Each destination has its own retention, scheduled backups can start at a time, weekday or month-day you choose, a free-space safety stop refuses to start a backup that would fill the disk, failed uploads are retried automatically and alert you, and the Backups pages show where every backup is stored.

A backup-destination fix

Adding an S3-compatible backup destination without a path prefix failed its connection test with a confusing empty-key error, and typing a prefix in didn't help because the add-destination form was silently submitting the empty fields of its hidden SFTP and FTP sections over the top of it. Both fixed: S3 destinations work with or without a prefix, and the form only sends the fields for the type you chose.

A long-running self-repair bug, found and fixed

The background process that brings an older hosting account's webmail./account. subdomain routing up to the current version could fail safely (making no change, rather than risking anything breaking) on an account whose configuration predated this panel's own self-repair mechanism, then retry on an endless loop instead of ever giving up. Fixed at the root, so every account's webmail./account. routing now upgrades itself automatically, the way it was always meant to.

Roundcube's own background maintenance

Clearing out deleted messages and purging expired sessions — was silently failing every single day on every mail-enabled server, caused by a Roundcube software update that introduced its own scheduled jobs running as the wrong system user. Fixed with a change designed to survive future Roundcube updates instead of needing to be reapplied each time one lands.

Initial Setup

Delegating your domain to KNJ Panel now also sets up your first real hosting account in the same guided flow, instead of leaving that as a separate later step. A new step-by-step wizard walks through your first package, your first domain and account, and your server's own hostname & certificate, all in one pass, with a real check confirming your domain's nameservers are actually pointed here before anything is created. Keeping your current DNS provider instead remains a fully-supported, equally first-class choice — nothing about account creation applies to that path at all.

Setting up your server's own domain, properly guided for the first time

The temporary-hostname banner's "Set your domain" button now opens a real step-by-step wizard explaining exactly what DNS needs to look like before you submit anything, covering both letting KNJ Panel manage your DNS and keeping your current provider, with a live, non-blocking check at the end confirming whether it's already propagated. A new standalone Propagation Checker page lets you re-check any domain later without going back through the wizard. The OS Hostname and Panel Hostname & SSL Certificate cards, which used to ask for the exact same value twice, are now one card that sets both.

A self-update reliability fix, found live on two real production servers

A database migration during a routine update could fail partway through on a server with a lot of existing data, and a second attempt then failed differently, because the first attempt had already partially applied before it stopped. Every step of that migration now checks the server's own actual state before acting, so an update reaches the same correct result no matter which step an earlier attempt stopped on.

A Reset Password fix

Choosing auto-generate when resetting an account owner's password could fail with a false "password confirmation does not match" error, caused by a browser autofilling a hidden, unrelated field left behind from the manual-password option. Fixed.

Clicking now clearly does something

Check System Updates now shows a spinner and "Checking…" text the moment it's clicked instead of giving no visible response until the result lands well afterward, and copying a generated password (Reset Password, account creation, anywhere one's shown to you) now displays "Copied" right next to the button until the page next reloads. Separately, every sidebar section in the Controller area can now be collapsed and expanded individually, the same way DNS and Email already could, with a new Expand all/Collapse all link at the top of the sidebar to do it for everything at once.

System Updates: the local server now joins the same Servers table as every linked server (View Packages, Update Server, Reboot Server, all in one place) instead of keeping its own separate card. A server with real pending updates now shows a distinct "Updates Available" status instead of just its last completed run's status, and the page refreshes that count on its own the moment an update or reboot finishes

No page reload needed to see it change.

System Updates can now check and apply OS package updates across every linked DNS-only or Mail-only server from one screen, the same way Panel Updates already pushes a panel software update out to all of them

A table listing every server, how many updates each has pending, whether a reboot is needed, and buttons to update or reboot each one individually. Found and fixed the same week: a linked server that had just finished updating could still show a stale "update available" badge for up to an hour, since the cached comparison it read from was never told a new release existed until the next scheduled check.

Malware scanning now shows real progress instead of just "a scan is running"

A live bar and a time-remaining estimate, computed from how the scan is actually going rather than a fixed guess. The admin Overview page also gained a card listing every account currently being scanned, each with its own bar, so you can check on one without hunting down its individual page first.

Scan for Malware, now bulk

The Malware Scan Overview page gained a "Scan Now" button that opens a checklist of every eligible account instead of only ever being reachable one account at a time from the full accounts list. Select as many as you want, or all of them, and start every scan with one click.

Two real gaps closed after a live incident

A new automated protection now watches every hosted site (not just this panel's own login page) for the classic WordPress abuse pattern, repeated hammering of xmlrpc.php or wp-login.php, and bans the source automatically. IP Blocker also gained a real admin-side page of its own for the first time, plus the ability to scope a block to one specific site on an account instead of it always applying account-wide.

A clearer status view for malware scanning

The settings and account-selection pages now live together under one "Malware Scan" menu item with tabs instead of two separate entries, and a new overview page shows your server's current status at a glance (a shield that's green when everything's clean, amber when something needs a look, red when an account's been suspended for it) plus recent findings across every account.

Scheduled malware scanning now emails you

The automatic nightly scan itself shipped last night; today it gained the notifications it was always meant to have. A nightly summary report; an immediate alert the moment an account is actually auto-suspended, separate from the nightly summary since that's urgent enough not to wait for; a reminder if a suspended account sits unresolved for longer than you're comfortable with (you choose the number of days); and the account owner is told directly whenever a scan finds anything on their own account, not just when it's serious enough to suspend.

A faster-loading Dashboard

The page always worked, but there was a small, noticeable delay every time it loaded, caused by a handful of status checks running one after another instead of all at once. They now all run together, so the page appears noticeably quicker with no change in what it shows.

A webmail fix

Toggling your inbox between oldest-first and newest-first had no actual effect on the order shown; both directions displayed the same order. Found live from a real inbox screenshot. Now fixed.

A malware-scan reliability fix

Testing this feature end to end against a real account (not just a controlled test) found two real issues: a scan could quietly stop partway through a large account without saying so, reporting clean rather than "didn't finish"; and a confirmed threat wasn't always being fully set aside the way it should have been. Both fixed, with real regression tests added. An account also now has anything it's actively running stopped the instant a confirmed threat suspends it, not just its website — closing the exact gap (a resource-draining process left running after a hack, before anyone noticed) that this whole feature was originally built to catch.

A second security fix, found double-checking the first one

Two-factor setup, password changes, and profile updates are no longer offered while support is viewing your account on your behalf (impersonation). A real issue was found where clicking these could silently affect the wrong login instead of yours. These settings can now only ever be changed by logging in directly as the account owner, keeping your two-factor codes tied to your own device the way they should be.

A two-factor authentication setup fix

Turning on two-factor authentication from your own account panel, reached through your own domain's address, could return a generic page-not-found error instead of the setup screen. The same underlying routing issue already fixed once for signing in directly, now also fixed for security settings (two-factor setup, password changes) reached the same way. Already-live accounts pick this up automatically, no action needed.

A second signup form fix, the same day

The fix just below solved a customized embed submitting via JavaScript, but a real customer's retest afterward still failed, with the same generic error. A live investigation found a genuinely separate cause hiding behind the same symptom: a signup form submitted through your domain's own account-area address (rather than the panel's direct server address) was being mistakenly redirected somewhere that address doesn't exist, so it never reached the signup endpoint at all — the exact same shortcut-routing issue already fixed once for login further down this list, just for a newer kind of address that didn't exist yet when that fix was written. Already-live domains fix themselves automatically the next time anything routine touches their setup — no action needed.

A signup form fix

The newsletter/subscriber embed already worked as a plain form, but a version customized to submit via JavaScript instead (for a smoother, no-reload experience) could be silently blocked by the browser's own cross-site security rules, showing a generic connection error with nothing to explain why. That one signup endpoint now explicitly allows it, whichever way your own page submits it.

A real production incident, fixed the same day it happened

Moving a mailbox onto this server (restoring from an old host, or shifting between two of this server's own machines) used to bring along a few of the mail software's own private internal files alongside the real messages and filter rules. One of those files, built in a shape a different mail system uses, sat harmless until a filter rule actually tried to read it — at which point the entire mailbox's folders became briefly unreachable, though the messages themselves were never at risk. Fixed on the live account within minutes of being reported, and fixed for good so it can't happen on any future move: only real content — messages and filter rules — ever comes along now.

KNJ Webmail v0.7.2

A long inbox used to grow the whole page instead of scrolling inside the message list itself, pushing Contacts, Settings, and Log out off the bottom of the screen; the message list now scrolls on its own, with the sidebar always in view. Separately, the folder list disappeared entirely on the Contacts page, leaving no way back to Inbox except through Compose — it now stays visible everywhere. Also fixed the same day: on a server where mail runs on its own separate machine, the contacts sync between KNJ Webmail and Roundcube could silently fail to actually reach it, so a contact could exist in one and never appear in the other — already-affected accounts fix themselves automatically, no action needed.

A routing bug fixed on your own domain, your own ports

Visiting your account area on port 2083 or the admin area on port 2087 directly on your own domain could return a generic browser error instead of your login page, and the memorable webmail.yourdomain.com shortcut could be affected the same way. Found live on a real customer domain. Already-live domains fix themselves automatically the next time anything routine touches their setup — no action needed.

Your site never goes dark waiting on a certificate

If a domain's free SSL certificate genuinely can't be issued yet (most commonly a brand-new domain's DNS still spreading to the wider internet), it now automatically gets a temporary certificate instead of running with no HTTPS coverage at all. Found live on a real customer restore: a domain with no certificate at all could briefly fall through to a completely unrelated site's content instead of its own. The temporary certificate is honest about not being fully trusted yet — visitors see a browser warning — but it's always for the correct site. It upgrades itself to the real, trusted certificate automatically within minutes once DNS catches up, no action needed, or it can be retried manually right away.

Your webmail shortcut now opens the right client

Visiting webmail.yourdomain.com or yourdomain.com/webmail previously always opened the built-in client, even for an account whose Email Accounts page has Roundcube set as its default; it now respects that setting, the same way the account panel's own "Launch Webmail" link already did. Found investigating a real restored account whose owner uses Roundcube day to day but never saw contacts that had genuinely restored correctly — just to the other client. Also added the same day: KNJ Webmail and Roundcube now keep contacts in sync automatically, both directions, continuously — add, edit, or delete a contact in either one and it's reflected in the other, with nothing to configure.

A same-day fix for the restore-time backdoor scan added earlier today

A real false positive found running it against the actual archive it was built to catch: a genuine WordPress core file every restored site depends on could have been wrongly flagged and left out of a restore. Fixed by checking that the suspicious pieces genuinely appear close together, not just somewhere in the same (sometimes very large) file. The same fix also turned up three more real hidden backdoors on that original customer restore that the first manual check had missed.

Restore from cPanel Backup now screens every incoming file for known malicious-code patterns before any of it reaches a live account

Found necessary on a real customer restore, where the archive turned out to carry hidden backdoor files that a standard antivirus scan never caught, since they were custom-written with no recognizable signature. A flagged file is simply left out of the restore entirely; a flagged database is still restored, but clearly flagged in the run's log for a manual check, since safely editing a single row out of a real database isn't something worth guessing at automatically.

A second, deeper cause found for the dashboard hang reported on a satellite server

The first fix (a stuck status check) was real, but a separate issue also had to go: a prior fix for the webmail/account address-bar shortcuts had accidentally forced every page on a server to look for its design files in the wrong place, which on a Mail Only/DNS Only server pointed at a port that doesn't exist there and is correctly firewalled off — turning it into a silent, permanent wait instead of a quick error. Already-live servers fix themselves automatically, no admin action needed.

Restore from cPanel Backup now also brings across email forwarders, FTP accounts, and cron jobs

The same restore that already recreated your files, databases, mailboxes (with original passwords), and contacts now covers three more real categories found doing a full pass through an actual cPanel archive: mail forwarding rules, extra FTP logins (original password carried over the same way a mailbox's is), and scheduled cron jobs.

Two real production issues found and fixed the same day

A single unresponsive service check could hang the entire dashboard indefinitely on a satellite server, wiping out every other service's already-correct status along with it; each check now times out independently. Separately, a server where hosting files live on their own dedicated disk (rather than sharing the operating system's disk) was never having its disk usage or quota enforcement tracked there at all — already-live servers now fix this automatically, no admin action needed.

Restoring from a cPanel backup now brings your saved contacts too

Previously your mail, files, and subdomains all came back, but your saved address book didn't. Every contact, contact group, and group membership from the old host is now restored automatically, including for a mailbox that had never opened webmail before.

A real, whole-account malware scanner

Previously the only virus scanning in the panel covered mail content passing through the mail server, nothing else. A new "Scan for Malware" action on each account now scans that account's entire website files on demand, with live progress and a clear list of anything actually found, rather than leaving website-level threats invisible until they're noticed some other way.

Your domain, your own certificate, on your own ports

Connecting to your account area (port 2083) or the admin area (port 2087) using your own domain directly previously always showed the panel's own certificate and a mismatch warning. Both now present your domain's own already-issued certificate the moment it exists, no new certificate needed.

Two more real issues found testing that same cPanel restore further: a generated password containing certain characters could silently corrupt the site's own configuration file during restore, now fixed; and a restored account with more than one subdomain was only getting a working address for the first one, now every subdomain resolves correctly. Also fixed: the account dashboard's disk and bandwidth usage figures could read "Unlimited" instead of a real number immediately after a restore.

A real cPanel restore, fixed against a real customer account

A live restore surfaced three issues no earlier testing had: generated usernames are now a full 8 characters instead of 7, so every restored database lines up correctly, restored databases now carry over their original password directly instead of a fresh one that no longer matched the site's own already-copied configuration, and a File Manager error on a restored account's files is fixed.

Security Scan gets "Fix Now" buttons

A failing check can now be resolved with one click where it's genuinely safe to do so (re-enabling the firewall's default-deny policy, restarting brute-force protection, turning on automatic security updates), a direct link to the right page where a separate feature already owns the fix, or clear step-by-step instructions where auto-fixing would be the wrong call — like SSH configuration, since an admin could be connected over the exact setting being changed.

A real, editable Firewall page

Previously just a read-only status dump of the server's own firewall. Now a structured rule table for arbitrary port/protocol/action/source rules, separate from the existing per-service allow/deny lists (Panel Login, SSH, FTP, Mail, DNS), which are untouched and still shown read-only alongside it. Every baseline server rule and every rule from another feature stays firmly read-only here too — nothing on this page can accidentally lock an admin out of their own server, including a new port-collision guard that refuses a rule anywhere near a port the server or another feature already relies on before it's ever applied.

A genuinely temporary admin-issued password

Reset Password for an account owner now offers a third mode alongside auto-generate and set-explicitly: email a one-time password that expires in 24 hours (or the instant it's used, whichever comes first) and forces a real password to be set immediately on the next login, before anything else in the account is reachable. Both of the existing modes also gained an option to email the new password straight to the account owner rather than only ever showing it once in the admin UI.

Restore a cPanel Account, now a real full restore

Subdomains, mailboxes, and their actual mail content are now genuinely recreated from a real cPanel backup, not just listed for you to redo by hand. Original mailbox passwords carry over unchanged. Only SSL certificates and cron jobs still need manual recreation. Also fixed while testing against a real ~975MB archive: uploads were silently capped well below the advertised 4GB limit, a validation failure could come back as a blank page with no error shown, and there was no feedback during a large upload beyond the browser's own spinner — a real progress bar now shows instead.

Quota enforcement, actually enforced again

Every quota change made through the panel (account creation, package change) was silently failing to reach the filesystem, invisible unless you went looking. A systemd sandboxing setting was the cause; fixed, and quota changes made through the UI now correctly take effect immediately.

Manage Servers gets a real heartbeat

Every linked DNS-only or Mail-only server now reports its own panel version back on every connection test and health check, shown right on Manage Servers with a 'Latest' pill once it's current. Panel Updates gained an 'Update all linked servers' button that updates every satellite from one click instead of logging into each one separately, with live progress tracked from the main server. Improved a few days later so the Linked Servers table there shows each server's real current version and an Update available pill on page load, not just the status of whatever update was last run from that page.

Your domain stays your domain

/webmail, /account, and /controller (plus the webmail. and account. shortcuts) previously redirected a visitor's browser straight to the panel's own hostname on login. All three now proxy through instead, so the address bar never leaves the customer's own domain, with a real SSL certificate issued automatically for the webmail./account. subdomain shortcuts. The admin/Controller entry point itself deliberately keeps its own separate hostname — the same boundary real cPanel/WHM draws by never putting its own admin login on a customer's certificate.

Create Account no longer leaves a surprise database behind

Every new account used to get a starter MySQL database and user automatically, whether the owner asked for one or not, matching what real cPanel/WHM does by default. Removed from both Create Account and Convert Addon Domain to Account; adding a database is opt-in from the account's own MySQL Databases page instead, exactly as it always was for every database beyond the first.

Account deletion now fully cleans up a linked Mail Only server

Deleting an account previously left its domain and mailboxes still active in the Mail Server's own routing tables indefinitely, found live during a pre-launch audit of the real production stack. Account removal now tells a linked mail server to drop everything for that account the moment it's gone, the same way it already does for DNS.

Create Account's "attach to an existing login" mode, actually fixed

It shipped 2026-08-28 alongside a morning bug sweep, but the email-uniqueness check on that form still ran even when reusing an existing login's email was the entire point of the mode, so every single submission in that mode failed. Fixed to only check uniqueness when actually creating a brand-new login, and added the first real test coverage for that path — nothing had ever exercised it end to end, which is exactly how it shipped broken.

SMTP submission authentication, self-healing

Dovecot ships its Postfix authentication socket commented out by default, and while a fresh install already uncomments it correctly, an already-provisioned mail server had no way to pick that fix up short of a full reinstall. Found live on a real Mail Only satellite: outbound mail from both webmail clients failed with a generic authentication error, while incoming mail worked fine the whole time. Now self-heals on a routine hostname/certificate re-confirm, no admin action beyond that needed — including catching and fixing a bug in the self-heal's own detection logic the same day, which was quietly matching Dovecot's commented-out default and skipping the repair entirely.

A Dovecot plugin dependency fix

Webmail logins were intermittently throwing "Internal error" banners on both Roundcube and KNJ Webmail, traced to a mailbox-quota plugin loaded without the base plugin it depends on. Every plugin combination is now loaded correctly together.

The real cause of Roundcube's webmail 500 errors, found and fixed

After several rounds of platform-level troubleshooting, the actual root cause turned out to be a PHP 8.5 language change: PHP 8.5 ships its own native version of a helper function Roundcube's own startup code was already defining independently, and the two collided fatally on every single request. The fix guards Roundcube's own definition so it only applies on PHP versions that don't already have the native one, self-healing automatically even after a routine package update silently reintroduces the unguarded original.

Roundcube webmail routing fixed on Mail Only satellites

A shared nginx configuration block needed to serve Roundcube was accidentally limited to the main server role, so a linked Mail Only satellite (which also runs a real Roundcube instance) returned a bare 403 on its own webmail. Also fixed the same day: a session-encryption key that was landing several characters short of the minimum Roundcube requires on some installs, and a logs directory with the wrong permissions for Roundcube to write to.

DNS now follows the active mail server

Outbound mail authentication (the MX record) previously always pointed at the web server's own IP address regardless of where mail actually ran, and the deliverability checker's reverse-DNS lookup had the same blind spot. Both now correctly track whichever server — the main one or a linked Mail Only satellite — is actually handling mail for a domain, with a one-click repair button for any account still pointing at the old target.

Nameservers, now real multi-nameserver management

Previously every DNS zone this server generates pointed at a single hardcoded nameserver name. A new Nameservers page lets an admin configure as many as are actually in use, every new zone gets one NS record per configured nameserver, and Restore Default Records repairs each one individually rather than assuming just the one.

Mail Only servers get their own real dashboard

A linked satellite mail server used to fall through to the same dashboard the main server uses, including a licence banner that made no sense on a mail-only box. It now shows what actually matters there: total mailboxes, live mail queue depth, and recent delivery activity, alongside a Service Status view filtered to just the mail daemons that box actually runs. The initial setup wizard's server-linking step, previously written only for a DNS-only satellite, now covers a Mail Only one too.

Mailbox data migration

Move a mailbox's actual mail (not just its metadata) between the main server and a linked Mail Only satellite in either direction, queued and tracked with a live progress view rather than a manual file copy.

A morning bug sweep

Nine fixes in one pass: the server stats bar now reports disk usage separately for the root filesystem and a separate `/home` mount instead of conflating the two; the Database Browser and Database Maintenance tools both now refuse to run arbitrary queries or kill connections against the panel's own internal databases; System Updates moved its live progress log above the update list and now flags any pending update that needs a reboot; a misaligned status pill on the Security Scan page was corrected; Create Account gained the "attach to an existing login" mode mentioned above; and a certificate-issuance timeout that could leave a hostname change stuck partway through was both extended and made idempotent, so re-confirming an already-correct hostname no longer re-runs the full mail-and-DNS setup it only ever needed to do once.

Notifications, one page for every alert

The old Server Contacts card and the standalone Webhooks page are gone, replaced by a single Notifications page under Servers: who gets alerted (defaults to the first admin account if nobody's set an email), every alert type grouped by severity (Critical/Warning/Info) with its own on/off switch, and the same Slack/Discord/generic webhook connections right alongside it. Found and fixed a real gap while consolidating: SSL-issuance-failure alerts had drifted from every other alert type, with no secondary-recipient support and no admin-email fallback — unified onto the same path as everything else.

Real admin alerting, plus two notification toggles that had never actually worked

A new alert service is now the one place every server/panel health signal in the codebase funnels through to someone: WAF degradation, a failed scheduled backup, a licence about to expire, a linked satellite server going unreachable (and recovering), and a new panel update becoming available were all being detected and stored already, just never pushed to anyone. Also closed out two customer-side notification checkboxes (disk usage warnings, SSL expiry warnings) that had sat on the account panel doing nothing since the day they shipped.

A Web Application Firewall

Real ModSecurity plus the OWASP Core Rule Set, not a lightweight regex substitute, built from source since Ubuntu doesn't ship a ModSecurity nginx module. Server-wide default-on, with a per-site Enabled/Detection Only/Disabled override and an admin-configurable paranoia level. A scheduled health check sends a real synthetic attack every 5 minutes and confirms it's actually blocked, not just that the module loaded.

Email Archiving

Every message can now be silently copied to a private archive mailbox for compliance, incoming, outgoing, or both independently, with a configurable retention window (or kept forever) and admin browse/download of the original raw copies.

Virus & malware scanning

ClamAV now sits in the mail chain the same way spam filtering already did, rejecting or discarding infected mail right at delivery, whichever you'd rather have happen.

Off-site backup destinations

Mirror every completed backup to a remote SFTP, FTP, or S3-compatible destination automatically, on top of the local copy that's always kept and stays authoritative for every restore.

Per-mailbox quota & suspension

Set a real, enforced size limit on any single mailbox and suspend one independently of the whole account, taking effect immediately rather than only at the next restart.

Mail client autoconfiguration

Point Thunderbird, Outlook, or a phone mail app at an account and it finds the right IMAP/SMTP hostnames, ports, and encryption on its own, no manual typing required.

DNS zone file import/export

Download any zone as a standard BIND file, or upload one to populate a zone from scratch.

Mail Only, fully finished

The last three pieces of a satellite mail server now behave exactly like a locally-run one: forwarding an address, generating a DKIM signing key, and viewing mail statistics all correctly reach wherever mail actually runs, instead of quietly acting against the main server regardless of where a linked satellite handles delivery.

The Mail Only server role, closed out, plus cross-server admin login

A linked satellite mail server now behaves as a first-class part of the panel rather than a bolt-on: every remaining mail feature (filters, greylisting, relay, spam settings, mail queue, delivery logs, catch-alls, mailing lists) routes to wherever mail actually runs instead of always assuming the main server, KNJ Webmail follows it there too, and Service Status shows the satellite's real Postfix/Dovecot state instead of the main server's own irrelevant one. And a new "Log in" button on Manage Servers takes you straight into a linked satellite's own dashboard (Mail Only or DNS Only), already signed in — no second password to remember or type, using the same trusted connection already set up when the two servers were linked.

Database Search & Replace

Find and swap a value across every table in a database, right from the account panel. Built for the gap Restore from cPanel Backup surfaces: a migrated site's database can still have its old domain baked into a settings table (a WordPress siteurl, for example). Runs as your own database user, never as root. Values stored in PHP's own serialized format are unpacked, changed, and repacked correctly rather than string-replaced in place, which would otherwise silently corrupt them.

Restore from cPanel Backup, now in the client panel too

An account owner can import a real cPanel backup straight into their own existing account: files are only ever added (nothing already on the site gets overwritten), and a fresh database is created alongside whatever they already have. The controller-side version still creates a whole new account instead. Either way, email accounts, SSL certificates, and cron jobs found in the archive are listed for manual recreation rather than guessed at.

Restore a cPanel Account

Upload a real cPanel backup and it becomes a working account here: website files and MySQL databases are restored automatically, with fresh database credentials rather than reused old ones. The domain comes from the archive itself and gets a fresh DNS zone on this server, not the archive's own DNS records. Email accounts, SSL certificates, and cron jobs found in the archive are listed for manual recreation instead of guessed at.

BoxTrapper

Approving a held sender now releases everything of theirs already sitting in Pending straight into your Inbox, instead of only affecting mail from that point forward. Replying to someone via KNJ Webmail also approves them automatically, so a conversation you've already started never gets held again.

PHP Extension toggling moved to the same background-job pattern as Perl Modules and PHP PEAR Packages

Closes out the same rare edge case for extensions that install their own command-line tools or documentation the first time they're enabled on a given server.

File and Directory Restoration

Browse a completed backup's file tree and restore any single file or folder in place, without touching anything else on disk. A full account restore was already real; this closes the gap for "I just need this one file back."

Update reliability

Self-updating a real install now keeps every system-level config file it manages in sync, not just the update mechanism itself. Perl Modules and PHP PEAR Packages installs also moved to the same background-job pattern already used elsewhere in the panel, closing out a rare edge case for modules that install their own command-line tools.

Backup User Selection

A new admin page under Backups listing every account with a checkbox controlling whether it's included in the automated scheduled backup run. On-demand backup of any single account, for either admin or owner, was never affected either way and still works exactly as before.

PHP PEAR Packages

A curated set of real, verified PEAR packages (Mail, DB, Auth_SASL, and more) an account can install for their own PHP scripts, one click, no admin needed. Same self-service pattern as Perl Modules.

Self-service Perl Modules

The same curated set of common CGI modules the Controller side already installs from, now reachable directly from the account panel's Software group, no admin needed.

MariaDB version upgrades

A guided major-version database upgrade, offering only real, currently-supported LTS releases as targets, never a rolling or release-candidate build and never a downgrade. A mandatory pre-upgrade snapshot (a crash-consistent copy of the database directory plus a full logical dump) gives a real way back before any upgrade runs, with a live terminal-style log the whole way through.

Statistics Software Configuration

Real AWStats, not a reimplementation. A global toggle turns it on server-wide, then every account gets a new AWStats page under Metrics with a month picker and an Update Now button. Full browser, OS, search-engine, and referrer breakdowns on top of what Traffic & Visitors already shows.

Server-level Cron Jobs

Schedule one-off sysadmin tasks (log rotation tweaks, cleanup scripts) that don't belong to any single hosting account, from a new page under System. Same real-crontab approach as the existing per-account Cron Jobs feature, so nothing here ever needs a terminal to set up.

A Feature Manager page, plus a real Perl module installer

Feature Manager edits which of 26 account-side capabilities each hosting package grants, all from one screen instead of opening every package individually; the same setting is also still editable from a single package's own edit form, both write to the same place. Twenty of those capabilities (things like Directory Privacy, Deploy from Git, IP Blocker, and Error Pages) were only cosmetically toggleable until now — the underlying page was still reachable directly even with the feature switched off for a package, so every one of them now genuinely blocks the page itself, not just its sidebar link. The Perl module installer sits alongside the existing PHP extension manager: a curated set of commonly needed modules (database drivers, HTTP clients, JSON/XML parsing) with live installed-state detection and one-click install.

Database Access Hosts

A server-wide view of every database user across every account and the remote hosts each is allowed to connect from, with a direct grant/revoke control, without needing to go through the account owner.

SSL Storage Manager

A full repository of every certificate this server actually has on disk, independent of which site (if any) is currently using it, so a certificate left behind after a domain was removed or a replacement never gets cleaned up is now visible and removable. Distinct from the existing SSL/TLS page, which only shows a site's current certificate.

A real web page template editor for the default and suspended-account placeholder pages, with a live preview and one-click restore to the built-in default

Previously only editable by hand on the server. An outbound port-25 lockdown, off by default: every process on the server except the mail server's own delivery agent can be blocked from opening a direct connection to a remote mail server, closing the exact path a compromised account's script would use to send spam straight out, bypassing this server's own queue and DKIM signing entirely. And Security Questions — an unfamiliar-IP Controller login can now be interrupted with an extra security question, on top of any two-factor authentication already set up, with each admin or reseller choosing their own question and answer.

A quick-filter search box now sits above General at the very top of the sidebar in both the Controller and My Account areas

Type and the nav narrows in place as you go, no page reload, with non-matching items and empty sections simply disappearing rather than greying out. Press / from anywhere on the page to jump straight into it, Enter goes to the first match, Escape clears it.

A full re-audit of the admin feature set against our own running code rather than trusted from notes

Found two items that had been filed away as "not needed" months ago on the mistaken assumption they were still blocked by something that had since shipped. Both fixed, plus four real gaps built: Parked Domains gets an admin-side list across every account's addon domains; Spam Scanner Tuning controls the spam scanner's own process limits; Database Configuration exposes a deliberately small, safe slice of server-wide database tuning, not everything; and a new Security Policies page rolls up every login-protection feature in one place, plus a genuinely new one — requiring two-factor authentication for every Administrator and Reseller, not just leaving it optional. One item was deliberately redesigned rather than built as originally scoped: a full command-line terminal would mean opening root access directly from the browser, which runs against the unprivileged-app design this panel has held to since day one. Built Diagnostics instead — real-time server status checks (uptime, disk, memory, open ports, service health) through the same tightly-controlled path every other admin action already uses, with no new door opened.

Webhooks, closing out Everything else

Subscribe an endpoint to real account events (created, suspended, unsuspended, terminated) or SSL issuance failure, and every delivery is a signed POST you can verify. Also found and fixed a real gap while wiring the SSL event: the existing "notify on SSL issues" setting was being saved but never actually triggered an email — it does now, and DNS resolver configuration, admin notification routing, and remote reboot all turned out to already be shipped and just weren't marked Live.

Traffic & visitor statistics

A new Traffic page for any account, reachable from its row on List Accounts: requests, unique visitors, bandwidth, and a response-status breakdown for a chosen month, plus top pages and top referrers. Built on the same access-log parsing already powering bandwidth tracking. Also found and corrected while going through this section: Server-wide settings and Timezone configuration were already fully shipped on the Server Settings page and just hadn't been marked Live on the roadmap.

Live resource monitoring, closing out Backup & Server Status

A real server-wide process list, sorted by CPU usage, with a per-process Kill button for a genuinely runaway script, plus a full disk usage breakdown across every real filesystem on the box. Killing anything the panel or hosted sites depend on (nginx, PHP-FPM, MariaDB, SSH, BIND) is refused outright, live-verified by actually trying it against the running server and confirming it stayed up.

The Packages & Resellers section, closed out

A reseller now gets a real detail page (usage totals across their accounts, their own login independently suspendable without touching accounts they manage), per-package feature control (toggle FTP, WebDAV, App Installer, Cron, Backups, and API Tokens per hosting package), bulk account reassignment between resellers, and an 8-permission checklist governing exactly what a reseller can do. Account migration/transfer rounds it out — one-click export of a completed backup to a portable archive, and an admin-only import that creates and restores a fresh account from one, verified end to end with a real disposable account: files and its database round-tripped byte-for-byte through a full export → delete → import cycle.

OS package management

Search the server's apt package index right from the panel and install a package on demand, the same access as a terminal but without needing one. Runs queued with a live terminal-style log, and closes out the last item in the Software & PHP section.

The Databases section, closed out

A visual database browser lists every database on the server, not just ones the panel created, and lets an admin drill into a table's rows or run arbitrary SQL directly (the same root-equivalent access a real WHM operator already gets from phpMyAdmin). Database Maintenance Tools adds a live server status view, the real process list with a per-process Kill button, a slow query log toggle, and one-click repair/optimize for any database.

The SSL/TLS section, closed out

CSR generation lets an admin generate a fresh private key and CSR for any hosted site, entirely in-process via openssl, never touching disk outside the request. Certificate inventory turns the existing per-site SSL list into a genuine one: every certificate now flags itself once inside 30 days of expiry, and the panel's own certificate appears alongside every hosted site's rather than living only on its own separate page. And TLS policy configuration adds a server-wide choice between Modern (TLS 1.3 only) and Intermediate (TLS 1.2+1.3, matching Mozilla's own well-known presets exactly) — one setting, applied to every certificate on the server at once, verified live with real TLS handshakes on both settings before shipping.

API Tokens, closing out the Security section

Token abilities now match what WHMCS's own cPanel integration calls for hosting automation (create, suspend, unsuspend, terminate, change package, reset password), each independently scoped rather than one broad read/write pair, so a billing integration token minted only to suspend on non-payment can never also terminate or create accounts. Account-level tokens (DNS read/write) ship alongside it, and both now have a real API for a token to actually call — this is also the foundation a future billing system will automate against.

Access Control and a central Password Policy, two items in the Security section

Per-service IP allow/deny lists let Panel Login, SSH, FTP, Mail, and DNS each be switched from open-to-everyone to allow-listed at the firewall level, independent of and in addition to the existing fail2ban brute-force protection. Password strength policy replaces the fixed minimum length enforced per-form with one central, admin-configurable policy (length, mixed case, numbers, symbols, and an opt-in check against known data breaches) that now governs every password set anywhere on the server.

The Accounts section, closed out

The four genuinely new items shipped together, alongside marking two already-built ones (Edit Account, Package upgrade/downgrade) correctly on the roadmap for the first time. Bulk account removal adds select-all/per-row checkboxes to List Accounts, mirroring KNJ Webmail's own bulk-select pattern — each account is still deprovisioned through its own background job, just triggered together. Admin password reset gives an admin the same auto-generate-or-set-explicitly choice already offered at account creation, for resetting an existing owner's login. Access log downloads brings the account panel's own Raw Logs page to the admin side — the same privileged log-read action, just reachable per-account from List Accounts. And broadcast messaging sends one email to every account owner on the server, queued rather than sent inline so a large account list can't hold up the request that triggers it.

Service Configuration, closed out

The five remaining items in that section all shipped together: mail relay & filtering configuration now covers both sender and recipient blocklists, wired into the same restriction chain the rest of mail security already builds so nothing can independently reopen the server as a relay. WebDAV access mounts a hosting account's files over real nginx WebDAV, not a separate daemon, scoped to a whole site or a single subdirectory. Log rotation is now admin-configurable (frequency, retention, compression), with a 32-day retention floor enforced server-side since bandwidth reporting rebuilds each month from the same rotated logs. Service certificates gets a read-only page making explicit what was already true — the panel issues one certificate and every TLS-speaking service reuses it. And the Service Manager can now start, stop, and restart individual services from the UI, with every control running as a background job rather than inline with the request that triggered it, and stopping a service the panel itself depends on blocked outright.

Panel Updates

A real one-click Update Now button, with the same live terminal-style log as System Updates so you can watch the process happen. The SSH command is still shown alongside it for anyone who'd rather run it themselves. Backed by a new dedicated release pipeline that builds and ships every version.

Licensing

A fresh install now requests a 30-day trial automatically from our own separate licence server, tied to the server itself so wiping and reinstalling can't grant a second one. A persistent banner counts down the days remaining; once a trial or licence lapses, the Controller and My Account areas lock to a new Licence page (under Servers) until a real key is activated — existing sites, mail, and DNS are never touched, only the panel's own management UI.

Panel login security

A new fail2ban jail bans an IP after 5 failed panel logins in 10 minutes, the same real network-level protection SSH already had. Opt-in Two-Factor Authentication for every role, from a new My Profile page: an authenticator app (QR code setup), recovery codes, or a one-time code emailed on request as a third fallback if both of those are unavailable.

A real backup engine

Full account backups (files, every database, all mailboxes, plus a DNS zone and FTP config snapshot) written locally, scheduled per the existing daily/weekly/monthly settings or triggered on demand. Restore is real, not a stub — available to both the admin and the account owner, and regenerates the account's files, databases, and mail from exactly what was captured at backup time. Live-verified against a real disposable test account: files and a database deliberately corrupted after backup, then restored, confirmed byte-for-byte back to the original with correct ownership.

FTP Settings

Server-wide vsftpd tuning (connection limits, idle session timeout, upload umask, passive port range, welcome banner). Service Status now also reports vsftpd's live state alongside the other daemons.

FTP account support

Vsftpd, with SQL-backed authentication using the same architecture as mail (a read-only MySQL user queried directly by PAM, no separate virtual-user database to keep in sync). Every FTP session runs as the account's own real system user, so uploads are ownership- and quota-consistent automatically. Live-verified over real TLS: upload, chroot containment, and a scoped sub-account correctly jailed to just its own subdirectory.

Security Scan

A new self-service server health check at the top of the Security nav group. Checks the server's own firewall, SSH's effective configuration (not just what a config file says), fail2ban, unexpected public ports, database exposure, and automatic security updates, with a plain-language recommendation for anything that isn't a clean pass and an overall 0-100 score. Read-only, and distinct from our own internal code security audits.

Disk quota is now a real, kernel-enforced ext4 quota

A write past an account's limit fails at the filesystem level, not something the app polices after the fact. Bandwidth has no OS equivalent, so it's tracked by parsing Nginx access logs (self-correcting, re-derived from scratch every refresh rather than a running total) and an account over its limit is auto-suspended. Both refresh every 15 minutes via the app's first scheduled job. List Accounts and the account-side Disk & Bandwidth page both show live usage against the package limit.

Branded default and suspended-account placeholder pages

Self-contained static pages with the real KNJ logo, shown on a freshly created domain and on a suspended one. Live-verified end to end on real DNS/SSL, including catching and fixing a bug in the provisioning script that was silently breaking every action.

Modify an Account (edit owner, package, reseller after creation) and Suspend/Unsuspend Account

Websites go down to a suspended page while mail and DNS keep working, ready for a future billing system to trigger automatically. Server Settings: upstream DNS resolver configuration, server contacts (update/SSL-failure notification emails), and a graceful reboot button. Account SSL page can now generate a certificate signing request and private key in-browser. KNJ Webmail v0.7.1 — bulk CSV contact import.

Track DNS (live dig lookup in the panel), Server Settings (timezone via timedatectl + OS hostname via hostnamectl, linked from the post-install Server Setup flow), Raw Log Download (per-domain nginx access and error logs on the account side).

KNJ Webmail v0.7.0

Contacts, with autocomplete on compose and one-click save from any message. Verified against the same real external Gmail inbox.

KNJ Webmail v0.6.0

Rich (HTML) compose with a sanitized editor and real multipart/alternative sending. Verified against the same real external Gmail inbox.

KNJ Webmail v0.5.0

Multi-select bulk move/delete. Verified against the same real external Gmail inbox.

KNJ Webmail v0.4.0

A Settings page for autoresponder and Outlook-style mail filing rules, sortable columns. Verified against the same real external Gmail inbox.

KNJ Webmail v0.3.0

Create your own folders and drag messages onto them to file. Verified against the same real external Gmail inbox.

KNJ Webmail v0.2.0

Real folders (Inbox/Sent/Drafts/Trash/Spam) with unread counts, delete-to-Trash, attachments, in-folder search, pagination, and drafts. Verified against the same real external Gmail inbox, both directions.

KNJ Webmail v0.1.0

Our own from-scratch webmail client, built into the panel and styled to match it, selectable alongside Roundcube. Verified against the same real external Gmail inbox, both directions.

Webmail

Real Roundcube, wired to the existing Dovecot/Postfix, own DB and PHP-FPM pool, verified against a real external inbox. Create Account can now set a password explicitly instead of only auto-generating one.

Server info & stats bar (hostname, load, RAM/disk) on every Controller page; panel version tracking with an update-available ticker; a System Updates page for pending OS packages with a live terminal-style log.

Fixed orphaned mail storage left behind when an account or domain is removed.

Addon domains, per-zone DNSSEC, DNS clustering (master-side), inline bulk-save zone editing, restore-default-records recovery, outbound mail relay, editable mail server config, mail queue/delivery/statistics tooling, filter incoming email by domain/country, greylisting, spam filtering, autoresponders, email deliverability checker.

MultiPHP Manager (install/switch versions, per-account INI overrides, extensions, ionCube), SPF/DKIM/DMARC automation, DNS zone templates, nameserver diagnostic report, DNS cleanup tool, domain forwarding.