NovaPanel
Features Pricing NovaPanel VPS · soon Alternatives Docs Changelog Customer portal Discord GitHub
Get Pro

Changelog

Every panel release in chronological order. Updates land continuously — your panel picks them up on its next heartbeat. This page auto-refreshes from the release server, so you'll see new entries the moment they ship.

v1.9.7

Security fixes

Security1

  • Access tokens in Git repository addresses are no longer written to deploy logs

Features9

  • Automatic updates: choose off, security fixes only, or all releases. New default is all releases, so panels stay on the latest version
  • Server SSH page: manage root's SSH keys, allow root to log in with a key only, and turn password logins off server-wide
  • Customers can choose how they log in over SSH: key only, password only, or key or password
  • Command-line PHP version per account, used by SSH, the Terminal, cron jobs and background workers
  • Mail certificates: the mail hostname and mail.<domain> of every mail domain get trusted certificates automatically, served per name to IMAP, POP3 and SMTP
  • Mail Server page shows which certificate mail uses and why; customers see the exact settings for their email apps
  • Panel addresses: open the admin and customer panels on a hostname of their own, without a port number
  • SSH deploy keys for Git Deploy: generate one or use your own, for private repositories over SSH
  • Unlimited option for package limits (sites, domains, subdomains, databases, emails, FTP, cron jobs)

Fixes7

  • Deploys now use the site's PHP version for composer and the custom deploy command
  • A failed composer install now fails the deploy and leaves the live site untouched; .env and storage/ survive deploys
  • Deployment statuses read Live, Building, Queued or Failed, and update on their own
  • Mail kept a self-signed certificate after the panel hostname changed; it now follows the mail hostname
  • The customer SSH page showed the server's internal name instead of an address that works from outside
  • Web templates: the list shows what uses each one, saving re-applies it, and a rejected template is no longer shown as active
  • The old Generate deploy key button produced an unusable key; it now works

v1.9.6

Security fixes

Security1

  • Customer home folders are now private to their owner, readable only by the web server and the panel

Features8

  • SSH access is now a package setting: customers on a package that allows SSH can log in with their keys (OpenSSH and PuTTY formats); others are refused cleanly
  • Per-customer resource limits: set CPU, memory and process caps on a package; they apply to apps, workers, the Terminal, builds, SSH and cron jobs
  • Website Pages: edit and preview the server address page, new site and subdomain placeholders, error pages, maintenance and suspended pages, all using your branding
  • Node and Python apps: set the port your app listens on, or detect it with one click, so the proxy reaches the right process
  • Subdomains can use a web template
  • Real logos for app templates, the app installer and web templates
  • Emails use the new design
  • Live preview in the customer Error Pages editor

Fixes5

  • SSH keys added in the customer panel were refused by the server (PuTTY: Server refused our key)
  • Web templates lost their name and description, and saving one could fail with Failed to save template
  • A Node site behind the Node.js Proxy template could serve the wrong process and return HTML instead of JSON
  • Modals in the new design were off-centre
  • Web server installs no longer fail because of a broken third-party apt source or an interrupted package install; the broken source is set aside and the admin is told

Infrastructure2

  • Hiding the Powered by credit on website pages requires Pro or Developer
  • Behaviour change: SSH keys a customer added themselves stop working unless their package allows SSH. Cron jobs now run inside the customer's resource limits

v1.9.5

Security fixes

Security1

  • Server-level tools - the root terminal, the server file manager, process and service control, and PHP and database engine installs - are now limited to full administrators. Reseller accounts could reach them before.

Features8

  • A new design for both panels. A slim icon rail with a sub-menu replaces the long sidebar, the dashboards show live server state (services, CPU, memory, disk, load) instead of static boxes, and every page was rebuilt on one consistent look with self-hosted fonts. Built for phones as well as desktops.
  • Keep the design you know: Settings -> Interface lets every admin and customer switch between the new design and Classic (the 1.9.4 look). Admins set the server default; each person's choice follows them to any browser. Both designs get every feature - nothing is lost by choosing Classic.
  • Email templates. Edit the wording of every alert email, switch alert levels on or off, send a test, and see a live preview. A new Emails tab in Branding sets the header style, accent colour, footer and logo used in those emails.
  • Firewall Activity page for admins: blocked and detected attacks across every site over the last 24 hours, by category and by site, with a live feed.
  • DNS propagation check: see whether a record has reached the major public resolvers (Google, Cloudflare, Quad9 and others) straight from the DNS Zones page.
  • Branding is now five tabs with a live panel preview, a login page preview and a colour contrast check.
  • File Manager rebuilt: your sites as shortcuts, keyboard control, per-file upload progress, and batch copy, move, zip, permissions and delete. Emptying the trash now asks first.
  • Domains and SSL rebuilt: open any domain to see its certificate on a timeline (issued, renewal window, expiry), filter domains that need attention or are still on HTTP, and issue, reissue, add a wildcard or custom certificate, or revert to HTTP from one place.

Fixes6

  • Logos and login background images hosted on another site (a CDN, for example) were blocked by the panel's security policy and never showed. Any https:// image now loads, in both panels and in the Branding previews.
  • The SSL page now shows a custom certificate's real dates instead of an old Let's Encrypt record, and a domain reverted to HTTP is shown as not secured.
  • Reset to default in Branding no longer switches off alert emails or clears the admin email address.
  • Fixed a crash on DNS zones with no records, the Email Tools page re-rendering endlessly while loading, dialogs sitting 24px too low, and pages failing when a list came back empty.
  • About 250 customer panel texts that were still in English are now translated into all 11 languages, and more places show your own panel name instead of NovaPanel.
  • The login pages no longer show figures that were never measured (uptime, response time). They list features every server really has, and the encryption notice appears only when the page is actually served over HTTPS.

v1.9.4

Features4

  • Select all in the File Manager. A checkbox in the list header (and a Select all toggle in grid view) selects everything in the current folder at once, so you can copy, compress, download or delete a whole folder without ticking each file one by one. It respects the new filter, so you can also select just the files that match.
  • Copy files and folders. Alongside Move, you can now copy a single item from its menu, or copy your whole selection into another folder. Copies keep the correct owner, so copied files stay editable by your site and over FTP.
  • Filter the current folder by name. A search box in the File Manager toolbar narrows the list as you type - handy in folders that hold thousands of files.
  • Download several items as one zip. Select any mix of files and folders and download them together as a single zip; a single selected file downloads as-is.

v1.9.3

Fixes2

  • Switching a site to OpenLiteSpeed now serves it with the right PHP version straight away. The switch used a graceful reload, which left the old PHP worker running - so a site could keep being served by the previous interpreter until the next restart. An app pinned to a newer PHP (Laravel's Composer check, for example) could report a PHP-too-old error even though the site was set to the correct version. The engine is now fully restarted on a real change.
  • A framework whose front controller lives in public/ - Laravel, Symfony and similar - now works the same on every engine. When a site was deployed by hand (so its document root was never recorded), switching it from Caddy to OpenLiteSpeed or OpenResty could 404 because those engines served the site's top folder instead of public/. NovaPanel now detects the public/ layout automatically, so all engines agree and no manual fix is needed.

v1.9.2

Fixes1

  • PHP extensions are now kept complete automatically. On update, NovaPanel checks every installed PHP version across all web engines (Caddy/PHP-FPM, OpenLiteSpeed and OpenResty) and installs any that are missing. Apps migrated from another host - Laravel, or anything using a SQLite database - no longer break with a cryptic 500 because a PHP extension the app needs was absent. Only missing extensions are installed, so updates stay fast.

v1.9.1

Fixes2

  • OpenLiteSpeed's PHP (lsphp) now installs the full extension set, matching PHP-FPM (sqlite3, mbstring, xml, gd, bcmath, intl, zip, pgsql, redis and more). Apps that assume an ordinary PHP - Laravel/Symfony, or anything using a SQLite database - no longer break with a cryptic 500 when a site is switched to OpenLiteSpeed.
  • PHP versions installed from the panel (7.4/8.0/8.1/8.2/8.4) now include the redis and imagick extensions too, matching the set the default 8.3 install ships with.

v1.9.0

Features2

  • File Manager: Fix Permissions - one click resets ownership and standard web permissions (folders 755, files 644) on a folder, repairing files uploaded or extracted with the wrong owner, a common cause of 500 errors.
  • Domains: revert SSL to HTTP - remove an issued certificate and serve a site over plain HTTP again, for sites you deliberately want on HTTP.

Fixes4

  • Fixed a crash when opening the File Manager trash or the API Tokens page.
  • Mail now self-repairs on servers whose image shipped Postfix and Dovecot preinstalled but unconfigured (some Proxmox/LXC templates), where creating a mailbox or logging in over IMAP previously failed.
  • Installer now fully configures mail and other services on server images that ship them preinstalled.
  • The SSH login banner now shows the correct panel version after an automatic update.

v1.8.9

Features6

  • The customer panel is translated into ten languages: German, French, Spanish, Italian, Dutch, Portuguese, Turkish, Russian, Polish and Romanian
  • Restore a single site from a backup instead of the whole account, leaving your other sites at their current state
  • Publish a staging site to live - files only, or files and database - with a backup of production taken first
  • Notification titles and messages are translated too, including notifications already in your list
  • Dates, times and counts follow the language you chose rather than your browser's, with correct plural forms per language
  • Your language choice is stored on your account, so it follows you to another device

Fixes3

  • Two-factor authentication could never be enabled: the recovery-codes table was referenced by every setup since 1.6.0 but created by no migration, so a valid code was reported as invalid
  • The notification dropdown could not be scrolled and its View all link did nothing; marking a notification read now updates immediately
  • A rejected two-factor code now says whether the two clocks disagree, and by how much, instead of only 'invalid code'

Infrastructure1

  • New tests catch a whole class of shipped bugs: SQL naming a table no migration creates, the language list's two halves drifting apart, plural forms a language is missing, and untranslated text in the interface

v1.8.8

Features2

  • Migrate an account in from HestiaCP. Upload a Hestia backup and the panel recreates the account: sites, files, databases, mailboxes, forwarders, DNS records and cron jobs. Hestia packs each site, mail domain and database as a separate compressed archive inside the backup, and NovaPanel unpacks both layers for you.
  • Account archives are read in whatever compression they arrive in: .tar.gz, .tar.zst (DirectAdmin's current default), .tar.xz, .tar.bz2 and plain .tar. Nothing has to be converted by hand before uploading any more.

Fixes3

  • DirectAdmin import now works against real DirectAdmin backups. It had been built from DirectAdmin's published layout, which differs from what DirectAdmin actually writes in six ways. Two of them stopped an import outright, and one quietly made an addon domain the account's main site.
  • Mail filed into folders is no longer missed. A mailbox with an empty inbox whose messages sat in folders was reported as having no stored mail, and those messages would not have been brought across.
  • The migration plan no longer says a mailbox has no stored mail when what it means is that the amount is not yet known. The two look the same and only one of them is safe to decommission a server on.

v1.8.7

Features3

  • Migrate an account in from cPanel or DirectAdmin. Upload a backup archive in the panel and it recreates the account: sites, addon domains and subdomains, files, databases with their data, mailboxes including their stored messages, forwarders, DNS records and cron jobs. It reads a backup file rather than logging in to the old server, so it works even when that server is already gone, and needs no shell access on either machine. Pro and Developer.
  • The importer reads before it writes. It reports what the archive actually contains - domains, database sizes, how much mail each mailbox holds, DNS records - then runs a dry run showing every resource it would create, and only then offers the real migration. Nothing that already exists is overwritten, so re-running after a partial migration is safe.
  • It also says what it cannot bring across. Mailbox passwords are regenerated, because no panel can convert another panel's password hashes. Cron jobs arrive disabled for review. SPF, DKIM and DMARC records are deliberately not copied, since this server publishes its own and two SPF records on one name is a permanent error. DirectAdmin backups contain no DNS at all, which is their format rather than a limitation here, so MX records for mail hosted elsewhere must be copied by hand before switching nameservers.

Fixes4

  • novapanel user delete now actually removes the account. It was a bare database delete: the Linux user, the PHP-FPM pools, the FTP credentials, the MySQL databases and roles, the DNS zones, the caddy vhosts and the mailboxes all survived it, and those mailboxes kept authenticating. The admin panel always did this correctly; the CLI could not reach the same code. Both now share one implementation.
  • Deleting an account can no longer leave PHP down for every site. A PHP-FPM pool belonging to a deleted user stops the whole FPM service from starting, which takes PHP down for every site on that version. Removing the pool ended with a reload, which does nothing to a service that is already stopped, so the deletion that removed the cause declined to fix the effect. It now restarts when a reload cannot work.
  • DNS errors from PowerDNS now say what was wrong. Every failed record write reported only an HTTP status code and discarded the server's own explanation, such as a conflict with a pre-existing RRset. That affected every DNS operation in the panel, not only migration.
  • Free-space checks read the correct column when a device name is long enough to wrap onto its own line, which is what LVM volume names do. /var/lib/mysql is exactly where an LVM volume tends to live.

v1.8.6

Security fixes

Security1

  • The log written during installation is removed on start. It was readable by every user on the server and recorded the database password on the command line. See novapanel.dev/security, NP-2026-002.

Features1

  • The License page now shows which email address your licence is registered to, and links to the customer portal. That is the address the portal emails a sign-in link to, and nothing previously said which one it was.

Fixes1

  • Refresh on the License page now re-fetches the licence from the licence server. It previously only re-read the copy already on the server, so it could never show anything new.

v1.8.5

Features2

  • NovaPanel can now install a security release by itself. Until now every update waited for someone to press a button, which meant servers stayed on versions with published vulnerabilities for months. This applies ONLY when the panel is older than the release that fixed a published security issue - an ordinary release still waits for you, as before. It can be turned off under Updates, and the setting is administrator-only, since leaving a server on a vulnerable version affects everyone hosted on it.
  • Important notices from NovaPanel now appear in the panel itself, rather than depending on the email address given at install. Used for security advisories and similar - anything you need to know about the software running your server.

Fixes1

  • An update that fails to start is now undone automatically. The swap used to be one-way: a binary that would not boot left the service stopped with a working copy of the previous version sitting unused beside it. The panel now waits for the new version to come up and restores the previous one if it does not.

v1.8.4

Fixes1

  • Renaming a server no longer costs it its licence. The panel identified a machine partly by its hostname, so changing the name looked to the licence server like a different machine entirely - which is a routine thing to do, since a new server usually arrives called something like localhost and gets named properly soon after. On a paid licence that consumed the single server slot and the panel began reporting that the maximum number of servers had been reached, for a machine it was already licensed to. Existing servers are recognised and carried across automatically on the first check-in after updating; nothing needs to be re-entered.

v1.8.3

Features4

  • New hosting accounts get their SSL certificate during provisioning, rather than waiting for someone to press Issue SSL afterwards. It is requested only when the domain already points at the server - including through a Cloudflare proxy - because turning SSL on for a domain aimed elsewhere would take the site offline. When it cannot be issued, the account is created as normal and says why, so nothing is left half-done.
  • An administrator can set a customer's password. Until now the only way to help a customer who had lost theirs was editing the database by hand. Signed-in sessions end with the change, since a password is reset exactly when somebody else may know the old one.
  • Account usage now reports the limits it is measured against - websites, domains, databases and mailboxes each with the package's maximum, and traffic with its monthly allowance. A count on its own cannot answer the question a customer asks of it, which is whether they can add another one.
  • A billing system can now run a hosting account end to end through the API: create it with its website, DNS, FTP and SSL, sign the customer straight into their panel, change the password, suspend, unsuspend, move between packages, and terminate. Every one of those was tested against a real FOSSBilling installation, and the module for it is published separately.

Fixes2

  • The FTP login created with a new account now uses the account's own password, the way cPanel does. It used to get a separate generated password shown once and stored only as a hash - so an account created through an API or a billing system ended up with an FTP login whose password nobody could recover. Changing the account password now changes the FTP password with it.
  • The Create Account page no longer tells you to point the DNS and issue SSL afterwards when it has already been issued. The advice now follows what actually happened, and still appears when the domain does not point here yet.

v1.8.2

Features4

  • Sites on OpenLiteSpeed now get the full PHP toolkit. OpenLiteSpeed runs PHP itself rather than through the pool every other web server uses, so PHP settings, the extension list, installing an extension and switching PHP version all silently applied to something else. They now apply to the PHP that actually serves the site, and the page says which one that is.
  • The PHP Manager can install, configure and remove OpenLiteSpeed's PHP builds. They are separate from the standard PHP versions, so installing PHP 8.4 for the server did not make it available to sites on OpenLiteSpeed. Installing one now brings its extensions with it, and removing one is refused while sites still use it.
  • The customer dashboard shows which web server the hosting runs on.
  • New API endpoints for billing integrations: look an account up by username, read one account's disk and bandwidth, and create a single-use link that signs a customer straight into their panel. Groundwork for the WHMCS and FOSSBilling modules.

Fixes7

  • The PHP Settings page could not read a site's saved php.ini settings. It showed an empty form on every server since it shipped - the values were real and in force, the page simply could not see them - and saving that empty form replaced a customer's tuned limits with the defaults. It now reads and shows what is actually configured.
  • A site set to a PHP version OpenLiteSpeed has no build of was quietly served by a different version instead. Those versions can no longer be chosen for such a site, and the page says why and where to add them.
  • PHP settings are now checked before they are saved. A memory limit of 333 was accepted and means 333 BYTES to PHP, which takes every page on the site down with no indication why. Sizes now have to carry a unit, and the message says what you probably meant.
  • The file manager's row menu was cut off when a folder held only one file - which is exactly when you have uploaded a single archive and want Extract, and Extract was below the cut. The menu is no longer clipped.
  • The notifications panel was painted over by the page behind it on some pages, including Packages and the PHP Manager.
  • A site whose application returns a temporary 503 is no longer moved off its web server. WordPress does that while it updates itself, which the panel does nightly, so a routine update could move a healthy site and notify its owner about an outage that had already ended.
  • Package operations started by the panel now wait for the package manager instead of failing when another one is already running.

v1.8.1

Features2

  • Subdomains now follow their site onto its web server. Move a site to Apache and its subdomains move with it, so .htaccess rules and caching apply to a subdomain exactly as they do to the site. They share the site's connection rather than taking one of their own, so there is no limit on how many a site can have, and each keeps its own SSL certificate and settings.
  • Sites using a web template can now change web server too. The template's PHP handler is pointed at the chosen web server and the rest of the template is left exactly as written. Only a template with no PHP handler at all is refused, and it now says so instead of giving a blanket reason.

Fixes4

  • A single unreachable software source no longer blocks every system update. Applying updates stopped entirely if any repository failed to refresh - a third-party repository that has gone away, or has no release for this version of Ubuntu yet, was enough to hold back every security update on the server. The upgrade now proceeds and names the source it skipped.
  • The system update log is no longer left showing an earlier successful run after a failure. It was only written at the second of two steps, so a failure at the first left the previous run's log in place - a log ending in success next to a notification reporting failure.
  • A failed system upgrade can no longer be reported as successful. The result was read from the logging step rather than from the upgrade itself.
  • A static subdomain of a PHP site continues to be served directly, and is never handed to a web server that would execute its files.

v1.8.0

Security fixes

Security2

  • A customer editing DNS for a hostname inside a zone belonging to another account can no longer see or change that zone's other records.
  • Licence keys are no longer written to the server log in full. The key activates the licence on a machine, and logs are routinely copied into support requests.

Features4

  • Choose the web server that runs a site: OpenLiteSpeed, Nginx/OpenResty or Apache, set per site or as the default for new ones. Caddy stays in front for SSL, the firewall, logs and bandwidth, so a site keeps its certificate, its firewall rules and its PHP version when it moves - and can be moved back at any time.
  • Apache and Nginx/OpenResty serve PHP through the site's existing pool, so file ownership and PHP version are unchanged. Apache brings the .htaccess behaviour of a cPanel server, which is usually what a migrated site is missing.
  • A site is only moved once its new web server is proven to be serving it, and is moved back automatically if that web server later stops responding, with the owner notified. A switch that cannot complete leaves the site exactly where it was.
  • Installed web servers now appear on the Services page with their status, memory and start, stop and restart controls, alongside Caddy.

Fixes6

  • Installing an app reported failure on every server while actually succeeding. The install script ran without the variables telling it where the site was, because sudo removes them, so it stopped on its first line - after the panel had already put the application in place. WordPress, Laravel and every other one-click install were affected.
  • WordPress staging never worked. Creating, refreshing or deleting a staging copy failed against a database column that was never created, and the errors read as 'site not found' rather than pointing at the cause. Staging now works, and a staging copy runs on the same web server as the site it was cloned from.
  • DNS records for a hostname are now shown and edited in the zone they actually live in. A subdomain used to open an empty record list with an invitation to add records to a zone that does not exist, while its real records sat in the parent zone, out of sight.
  • A staging site is no longer listed as a mail domain, and no longer claims to be a primary domain of its own.
  • Paid features now become available within the hour of an upgrade rather than at the panel's next scheduled licence refresh.
  • A panel keeps honouring paid features for seven days without reaching the licence server, up from two, so a licence-server outage does not disable features on a valid licence.

v1.7.5

Security fixes

Security3

  • Resellers and API keys can no longer read the server's mail settings, which include the outgoing relay password in readable form. Reading it allowed sending mail as the whole server.
  • Changing the server's mail configuration or its nameservers is now restricted to full administrators, and to a signed-in session rather than an API key. Both reconfigure the server for every account on it.
  • Listing mail domains and running deliverability checks are administrator-only. They span every account on the server, so a reseller could previously enumerate other customers' mail domains.

Features1

  • A Web server card in Settings shows which engine serves new sites, with OpenLiteSpeed, Nginx/OpenResty and Apache listed as what is coming. Every site continues to be served exactly as before - this release adds the choice, not a change.

Fixes2

  • The Mail Server page could show invented settings as though they were live when the panel briefly failed to read them - and saving that page would then have overwritten the real relay details and stopped outgoing mail.
  • Database updates are now verified to be present in the released build before it is published. A panel could previously report its database as up to date while a change it needed had never been applied.

v1.7.4

Security fixes

Security1

  • A site could be shown firewall events belonging to another account when a hostname was claimed by both. Hostnames are now single-owner: creating a domain or subdomain that clashes with an existing one is refused, and any pre-existing clash is reported to the administrator

Features3

  • Firewall rules you have switched off are now listed in plain language - each shows what it protects against, and one click puts it back. Previously this was a row of bare numbers with no way to tell what you had disabled
  • Firewall events can be filtered by IP address, path or rule, with a one-click Only my IP button - useful when a busy site's event list is full of traffic that isn't yours
  • Firewall events are now kept for 30 days. They were previously read live from the server log, so history vanished within about two days - and much sooner on a site under attack, which is exactly when you need it

Fixes3

  • Sites that redirect to the www version of their domain showed no firewall events at all - the sites most likely to be attacked were the ones the panel was silent about
  • The firewall page no longer reports settings it could not read as though the firewall were switched off, which risked those settings being overwritten
  • Saving firewall settings now tells you when the web server could not be reloaded, instead of reporting success while the change was not yet in force

v1.7.3

Features4

  • Email apps can now send through the server: authenticated submission on ports 587 and 465, which previously had nothing listening at all
  • IMAP and SMTP serve your server's real HTTPS certificate instead of a self-signed one when panel HTTPS is enabled
  • Autoresponders and spam-to-Junk filing now actually run - delivery is routed through Dovecot so filters execute, including on Ubuntu 26.04
  • The deliverability check now catches a missing IPv6 PTR record - the exact reason Gmail rejects mail from otherwise healthy servers

Fixes8

  • Incoming mail was stored where the mailbox service never looked, so it never appeared in inboxes - fixed on every OS, and previously received messages are moved into the inbox automatically
  • On Ubuntu 26.04 the system mail config silently overrode NovaPanel's - repaired with a validated config, rolled back automatically if anything looks wrong
  • Webmail sending works again on Roundcube 1.6 - the bundled config used a setting the new version ignores
  • Enabling DMARC no longer delays all mail on servers where Postfix lacked permission to reach the DMARC service - fixed automatically
  • Mail virus scanning is properly wired into Postfix, with the scanner config Ubuntu requires
  • Saving mail settings no longer times out with a false error - changes apply in the background, the page reports when they finish, and a hiccup can no longer switch a working spam filter off
  • Re-adding a domain now registers secondary DNS transfer targets for its existing zone
  • A database blip during token refresh no longer signs users out

v1.7.2

Features3

  • Active sessions: see every device your account is signed in on, sign any of them out, or sign out everywhere else - on both panels
  • File manager trash: deletes are now recoverable for 14 days, with restore and empty-trash, swept automatically
  • DNSSEC DS records are shown per zone, so your registrar can finally be given what it needs

Fixes7

  • Logging out now revokes the session server-side instead of only clearing the browser
  • Secondary DNS: every zone-creation path now registers AXFR transfer targets, not just two of four
  • Backup test connection proves a real write on S3 and SFTP; write-only hardened buckets pass with a warning instead of failing
  • White-label brand colours now actually apply across both panels and in notification emails
  • Admin impersonation works behind Cloudflare tunnels and shows up in the customer's session list
  • Site and staging deletion frees disk immediately instead of silently counting against the quota
  • WAF page on Community shows the upgrade state up front and points at the correct log for rule IDs

v1.7.1

Security fixes

Security3

  • Fixed DKIM signing being switched off by the mail settings page. If a server had DKIM running but the saved setting said otherwise, simply opening Mail Server and pressing Save stopped the signing service and sent every message afterwards unsigned, with nothing reported. The page now reads the server's real state, and affected servers repair themselves on update.
  • Fixed restoring a backup of a single site. It unpacked to the wrong place, so the site was never restored even though the panel said it was - and because site names can match account names, it could overwrite another account's files. Restores are now atomic: a failed restore leaves your site exactly as it was.
  • Offsite backups over SFTP now verify the destination's identity. Every connection previously accepted any host key, including a changed one, while sending a password over it.

Features4

  • Spam filtering now actually filters. SpamAssassin has shipped for years behind a toggle that only started a background service Postfix had no way to talk to, so not one message was ever scored. Inbound mail is now scored and flagged spam is filed into a Junk folder. Your own outgoing mail is never scored. Off by default - turn it on under Mail Server.
  • Virus scanning for email attachments. Infected mail is refused at delivery so the sender is told, rather than disappearing silently. Off by default.
  • Greylisting now works. It briefly asks unknown senders to try again, which real mail servers do and most spam software does not. Your own customers and authenticated senders are never delayed. Off by default.
  • Customers can restore their own files from a backup, including backups kept only at an offsite destination, which NovaPanel fetches back automatically. Files only - databases are not restored.

Fixes5

  • Ten one-click apps installed nothing at all and showed an Installed badge anyway. They are hidden until they have a working installer, and an app with nothing to install is now refused rather than reported as done.
  • File Manager Move silently did nothing when a file of the same name already existed, and reported Moved. It now tells you about the conflict.
  • Setting a disk, memory or CPU alert threshold to 0 to switch that alert off now works. It previously went back to the default and kept alerting.
  • Four webhook events could be subscribed to but were never sent: SSL issued, backup completed, account updated and failed login. All four now fire.
  • Corrected the documentation across 19 pages after checking every claim against the code. One page told you to run a command that does not exist and would have started a second panel on your server.

v1.7.0

Security fixes

Security2

  • Fixed DKIM signatures silently switching off. Saving the Mail Configuration page pointed the mail server at the wrong address for the signing service, so outgoing mail was sent unsigned - which sends mail to spam far more often - with nothing reported. Affected servers are repaired automatically on update.
  • Blocked .git and .env from being served on deployed sites. A site deployed from Git could expose its full repository history, including any password or key ever committed to it.

Features3

  • Push-to-deploy now works. The Git Deploy page has always shown a webhook URL to paste into GitHub, but nothing was listening, so automatic deploys never happened. Every push to your branch now rebuilds the site.
  • Deploy rollback. Restore the previous version of a site in one click, with no rebuild and no network needed. The version you replace is kept, so a rollback can itself be undone.
  • Resource history and graphs. CPU, memory and disk are now recorded over time and charted from one hour to thirty days. Previously the panel only ever showed the current instant.

Fixes6

  • Background workers and Node/Python apps no longer die when NovaPanel updates. The process manager was being started by the panel itself, so it belonged to the panel's own service - and every panel update took every customer's workers and apps down with it. It now runs independently and survives updates.
  • Node and Python apps are now told which port to listen on. They previously fell back to their own default, which only worked because the web server happened to use the same one. Slow-starting apps are also no longer mistaken for failed ones, which could leave a working site returning 502.
  • Two deployments of the same site running at once could permanently empty it. Deployments and rollbacks are now processed one at a time per site.
  • The Anti-Spam and Security settings now say which options actually do something. SpamAssassin, SPF verification and Greylisting were switches that changed nothing, and ClamAV scans uploaded files rather than email attachments.
  • Creating an account no longer fails with a misleading 'package limit reached (0/0)' when the database is briefly unavailable.
  • Backups no longer include NovaPanel's own temporary build and rollback folders, which could double the size of an archive.

v1.6.7.9

Fixes2

  • Background workers and Node/Python apps now survive a server reboot. NovaPanel never installed the startup service that brings them back, so after any reboot a customer's workers stayed stopped and their Node or Python site returned 502 until someone restarted it by hand - with nothing reported. Existing servers are repaired automatically on update, and the admin is told how many accounts were affected.
  • The startup service is removed when an account is deleted, so servers no longer accumulate leftover services for accounts that no longer exist.

v1.6.7.8

Security fixes

Security2

  • Fixed FTP logins not actually being revoked. Removing the last FTP account - by deleting it or by suspending the account - left its credentials valid on the server, because the FTP password database was not rebuilt when the account list became empty. Those logins kept working. The database is now rebuilt correctly, and every server is repaired automatically on update, which revokes any FTP login that should already have been removed.
  • Suspending an account now also disconnects any FTP session that was already open, instead of only blocking new logins.

Features1

  • New Create Account page. Provisions a hosting customer in one step - the account, its website, DNS zone and FTP login - and finishes with a summary of every credential and setting, with a Copy all button for the handover. The username fills in from the domain and the password can be generated for you. Adding a staff user from the Users page is unchanged.

v1.6.7.7

Security fixes

Security12

  • Fixed a repository address that could cause the server to run a command as root during deployment. Addresses are now validated when saved and again at deploy time, and the transport is restricted.
  • Fixed mail interception: one hosting account could redirect all inbound mail for a domain belonging to another account.
  • Fixed mailbox creation on a domain owned by another account, which could also damage the domain owner's SPF and DMARC records.
  • Fixed an FTP directory escape that transferred ownership of another account's files and served them over the wrong account's FTP login.
  • Fixed a site rename that could aim privileged file operations outside the account's own folder.
  • Fixed site and domain deletion being able to take another account's websites offline.
  • Fixed redirect injection onto a domain owned by another account.
  • Fixed visitor statistics being readable for any domain hosted on the server.
  • Fixed a PHP extension toggle that applied to every account on the server.
  • Fixed rare account and site name collisions that could run PHP as another account's system user or remove another account's database.
  • Fixed private keys and passwords being written to the panel log when certain file writes failed.
  • Fixed the FTP password file being readable by any local user. Permissions are corrected automatically on update.

Features2

  • Suspending an account now takes the hosting offline: websites serve a suspended page, and mail logins, FTP logins, scheduled tasks and background processes stop. Unsuspending restores all of it. Previously suspension only blocked the control panel.
  • Deleting an account now removes its databases, mail logins and FTP logins. Previously those kept working after the account was gone.

Fixes8

  • Fixed Postfix refusing to deliver mail after saving the mail settings page. The page applied a maximum message size without raising the mailbox size limits to match, and its own default value already exceeded them. Affected servers are repaired automatically on update.
  • The custom deploy command now runs after file ownership is set, so commands that write into the site directory work.
  • Background workers and app processes are now stopped when a site or account is deleted, instead of being left running.
  • The domains list no longer performs a slow lookup for every domain on each load.
  • Custom certificates are removed from disk when their domain is deleted.
  • Accounts already marked suspended are brought fully offline on the first start after this update. Reactivate any that should be live.
  • Sites configured with a non standard repository address will report a validation error instead of deploying.
  • Disabling a PHP extension is refused on servers with more than one account, because it applies to every site on that PHP version. Enabling is unchanged.

v1.6.7.6

Features6

  • Developer tier: background workers. Run always-on processes for a site - a queue worker, a websocket server, a custom daemon - kept alive and restarted if they crash, with start/stop/restart and live logs. Cron handles scheduled jobs; this handles the always-on ones.
  • Developer tier: custom deploy command. Set a command to run after each Git deploy - database migrations, a custom build step, a cache clear - executed as your site user once the build finishes.
  • Developer tier: config import. Apply an exported site config (YAML) to another site to replicate its runtime, domains and security settings, with a preview of exactly what will change before anything is applied.
  • Install your own SSL certificate for a domain - for example a free Cloudflare Origin certificate, or a paid/wildcard cert - instead of Let's Encrypt. The panel validates it, serves HTTPS from it, and stops auto-issuing.
  • Cloudflare-proxied domains are now detected on the SSL and Domains pages, with a clear explanation of why Let's Encrypt can't be issued and how to fix it (install a Cloudflare Origin certificate, or set the record to DNS-only) - instead of retrying forever in the background.
  • The panel's own hostname gets the same SSL tools: real certificate status, Cloudflare-proxy detection, and the option to install a custom certificate - useful when the panel is served behind Cloudflare.

v1.6.7.5

Fixes1

  • Fixed disk-quota enforcement not taking effect from the admin panel. Because the panel runs in a security sandbox, it couldn't see the quota state on the server's real filesystem, so it kept showing 'advisory only' and never applied per-account limits (enabling over SSH worked, but the panel didn't). Enabling and enforcing quotas now works directly from Admin > Disk Quotas.

v1.6.7.4

Features4

  • Developer tier: per-site environment variables. Set KEY=VALUE pairs (database passwords, API keys, APP_ENV) for a site in the panel and NovaPanel injects them into your app's runtime - no SSH or hand-editing config files. Scoped to your own site.
  • Developer tier: application log viewer. Browse and tail your app's own log files (Laravel storage/logs, WordPress debug.log, and any .log in your site), separate from the web-server access and error logs.
  • Developer tier: export a site's configuration as YAML - a version-control-friendly snapshot of its runtime, domains and security settings.
  • Package disk quotas can now be enforced at the filesystem level, not just shown. Turn it on from Admin > Disk Quotas or with 'novapanel quota enable' over SSH; accounts with no package stay uncapped, and new installs enable it automatically where the filesystem supports it.

Fixes2

  • Firewall: when a request is blocked you can now paste the request's log ID into 'Disable specific rules' and the panel resolves it to the exact rule that fired, instead of the ID silently failing to save. The Firewall events panel is still the one-click way to do it.
  • Creating a user in the admin panel now applies the Role and Package you choose - previously both were ignored and every account was created as a plain user with no package. Staff-admin creation is also capped by your license's admin-user limit.

v1.6.7.3

Features1

  • API tokens now work on the Pro and Developer plans - create personal access tokens to use the panel's REST API. Existing Pro and Developer licenses unlock this automatically on their next license refresh.

Fixes1

  • Your license's staff-admin limit is now enforced consistently across the panel, and the admin usage counter no longer counts disabled accounts - so it won't show more admins than you actually have.

v1.6.7.2

Features1

  • Alert emails are redesigned to match the NovaPanel dark theme, with the NovaPanel logo, so they look consistent and on-brand across email apps.

Fixes1

  • Installing the firewall engine from the panel no longer shows a false failure. It now runs in the background and the page shows progress, then confirms when it is installed - the download just took longer than the request timeout before.

v1.6.7.1

Features2

  • Email alerts are now proper branded HTML messages with severity, an Open-panel button, and a plain-text fallback, plus a one-click Send-test button and a live deliverability check that shows whether SPF, DKIM, DMARC and reverse DNS are set up correctly.
  • Alert emails can now use a custom From address and are rate-limited so a flapping service can't flood your inbox. Clear guidance is shown for sending correctly when your server is behind Cloudflare (dedicated mail hostname or an SMTP relay).

Fixes2

  • Fixed outbound mail not being DKIM-signed. Postfix couldn't reach the DKIM service because of a group-permission gap, so all outgoing mail went unsigned and was far more likely to hit spam. Every server repairs itself on this update, and new installs are correct from the start.
  • Fixed the 'Install firewall engine' button and its automatic repair, which failed with a read-only-filesystem error because of the panel's security sandbox. Installing the WAF-enabled Caddy now works from the panel.

v1.6.7

Security fixes

Security1

  • Warn when the only admin still uses the default password, so it never goes unnoticed.

Features7

  • Catch-all addresses: choose where mail to any non-existent address at your domain should go, right next to your forwarders.
  • Email notifications: get important alerts (updates available, disk full, SSL expiring, service down, security events) sent to your admin email. A Settings toggle turns it on and shows the exact DNS records to make the emails land in the inbox.
  • Firewall events viewer: see exactly what the WAF blocked on each of your sites, with the rule IDs, and disable a rule that is blocking you with one click.
  • Firewall engine self-repair: if a server was set up without the WAF module (the build service was briefly down at install), the panel now reinstalls it automatically, or you can do it with one click in admin Settings.
  • Hotlink protection: stop other websites embedding your images and files to steal your bandwidth, with a per-site on/off and an allowed-sites list.
  • Domain aliases can now 301-redirect to your main domain instead of serving duplicate content, which is better for SEO.
  • Expanded command-line tools over SSH: report, update, repair, service control, and full backup create/list/restore.

Fixes1

  • Fixed email forwarders, which never actually forwarded mail: Postfix was missing the alias configuration, so forwarder rules were saved but ignored. Forwarding now works, and existing servers repair themselves on this update with nothing to do.

v1.6.6

Fixes2

  • The WooCommerce / WordPress compatibility toggle now also lets logged-in admins save posts, products and widgets containing HTML or JavaScript without the firewall returning a 403. The public-facing site stays fully protected.
  • PowerDNS now self-heals the port 53 conflict with systemd-resolved. If a reboot or automatic update let systemd-resolved reclaim port 53 and crash-loop DNS, the panel masks it and restarts PowerDNS automatically on startup.

Infrastructure1

  • Installer: modern dynamic SSH login banner (MOTD) with live system stats, panel URLs and service health; plus Debian 13 fixes (jq, cron/service start) and systemd-resolved masking so PowerDNS keeps port 53.

v1.6.5.1

Fixes1

  • Fixed false 'too many requests' errors when refreshing or moving quickly through the panel. The dashboard is no longer rate-limited; login stays protected against brute force.

Infrastructure1

  • Installer reliability on Debian 13: fixed a crash from a missing jq dependency, a service start failure from a missing cron spool directory, and admin credentials falling back to the default when the panel was slow to start.

v1.6.5

Security fixes

Security1

  • Remove default admin backdoor: disable admin@novapanel.local automatically when another admin exists

Features1

  • Settings shows an HTTPS-active shield and pre-fills the admin email from install

Fixes5

  • Panel HTTPS: bare hostname now opens the customer panel (fixes Cloudflare 521 after enabling HTTPS on an IP-only install)
  • Server page no longer goes blank on servers set to a non-UTC timezone
  • App-wide error boundary so a single bad value can no longer blank the whole panel
  • Higher dashboard rate limit and correct client IP behind Cloudflare (rate limiting and fail2ban)
  • Enable HTTPS for the panel button now works (base Caddyfile ownership fix)

Infrastructure2

  • License activation registers the operator email as a real customer
  • Installer: Ubuntu 26.04 support (Dovecot 2.4 config, sury.org PHP repo, PostgreSQL 17, Node 22)

v1.6.4.1

Fixes1

  • Fixed the 1.6.4 update so the new phpMyAdmin/webmail ports and the panel HTTP-by-IP ports are applied automatically on existing servers. An internal validation step was incorrectly reverting the change, so phpMyAdmin and Roundcube could stay unreachable after updating; they now migrate on the next update with no manual steps.

v1.6.4

Features4

  • phpMyAdmin and Roundcube webmail now use Cloudflare-supported ports, so they open correctly when your panel domain is proxied through Cloudflare (the old ports were not proxied). The phpMyAdmin button also logs you straight into the selected database, with no separate login page.
  • Each panel now has a matching HTTP port for access by IP. You can reach the panel over plain HTTP at http://your-ip:2082 (customer) or :2086 (admin) even without a domain, or before a certificate is ready, so you are never locked out.
  • New Enable HTTPS for the panel button in Admin, Settings, General. Point a hostname at the server and the panel is served over HTTPS with a Let's Encrypt certificate issued automatically, so you can move an IP-only install onto a real domain without reinstalling.
  • The panel now warns you if your server's mail or FTP hostname is proxied through Cloudflare (which only carries web traffic), so email and FTP delivery do not silently break.

Fixes1

  • Database sizes on the Databases page now show the real on-disk size instead of always reading 0 MB.

v1.6.3

Features5

  • New WooCommerce / WordPress compatibility toggle in the firewall. One switch excludes the exact security rules that mistakenly block add-to-cart and checkout on a WooCommerce store, so you can run the firewall in full Blocking mode without breaking your shop.
  • You can now switch off individual firewall rules by ID, not just whole categories, so a single false positive can be cleared without weakening a whole class of protection.
  • New per-site option to block xmlrpc.php, a common WordPress attack surface used for brute-force and pingback abuse. Blocking it hardens the site and cuts bot traffic.
  • The SSL Certificates page now lists your subdomain certificates alongside your domains, and the Domains list shows a clear HTTPS badge once a certificate is active instead of a plain Issue-SSL link. Subdomains also show when they were added.
  • Many more actions now appear in your notifications: security and account changes (firewall settings, two-factor, password and email changes, API tokens), WordPress and staging operations, and admin configuration changes. Failed offsite backups, scheduled backups, and WordPress auto-updates now alert you instead of failing silently.

Fixes1

  • WordPress staging sites now get an SSL certificate automatically when created, so a new staging site loads over HTTPS right away instead of needing a manual step.

v1.6.2

Security fixes

Security1

  • Hardened subdomain creation so a subdomain can only ever be created on a domain you own.

Features2

  • Subdomains can now get their own SSL certificate. A new 'Issue SSL' button on each subdomain provisions a free Let's Encrypt certificate, so subdomains serve over HTTPS instead of failing the SSL handshake.
  • Install apps directly onto a subdomain. The App Installer now lets you pick a subdomain as the target, so you can run WordPress (or any app) on something like blog.example.com and it works out of the box on its own PHP pool.

Fixes2

  • Subdomains now inherit their parent site's settings (PHP version, protected directories, error pages, maintenance mode) and are served correctly for every runtime, including static content for Node and Python sites.
  • Backup storage totals are now accurate and clearer: the admin Backup Manager shows separate On server, Offsite, and Total figures instead of one number that mixed them, and the customer Backups page now shows the same storage summary.

v1.6.1

Features1

  • Offsite backups can now skip keeping a copy on the server. A new 'keep a copy on this server' option (on both the admin and per-customer offsite settings) lets you store backups only at your offsite destination to save disk space. Backups still appear in the panel (tagged on-server / offsite / both) and restore and download normally. The local copy is only removed after the offsite upload is confirmed successful, so you are never left without a backup.

Fixes1

  • The Resource Usage bandwidth bar on the customer dashboard is back, and now fills against your package's monthly bandwidth allowance (for example 6.1 / 100 GB) instead of always appearing full.

v1.6.0

Security fixes

Security2

  • Background jobs now recover from unexpected errors instead of being able to take the panel down, and raise an alert if a job keeps failing.
  • Admins are now alerted on unusual failed-login activity and when offsite backups start failing.

Features6

  • Two-factor recovery codes: single-use backup codes let you sign in if you lose your authenticator app. They are shown once during setup, and the login screen now has a 'use a recovery code' option.
  • Edit email accounts: change a mailbox password or storage quota in place, without deleting and recreating it, so existing mail is preserved.
  • Edit FTP accounts: change an FTP account's password without removing and recreating the account.
  • Customer API tokens (Pro): create tokens to access the NovaPanel API programmatically. The secret is shown once and can be revoked anytime.
  • Mailbox autoresponders: set a vacation auto-reply per mailbox, with optional start and end dates.
  • WordPress staging: clone a WordPress site into a separate staging copy to test changes safely, then refresh or delete it. Your live site is never touched.

Fixes3

  • Added confirmation prompts before destructive actions: deleting subdomains, redirects, FTP accounts, DNS records, mailboxes, forwarders and protected directories, importing over a database, and regenerating a deploy key.
  • The web terminal no longer shows simulated command output when the live shell is unavailable; it now says so clearly.
  • Fixed several dashboard display issues: the disk usage details panel, the bandwidth meter, and the metrics page.

v1.5.4

Features1

  • Tunable Web Application Firewall

Fixes1

  • Backup downloads now stream reliably in every browser

v1.5.3

Fixes1

  • Fixed offsite backups (Amazon S3, Backblaze B2, Wasabi, and other S3-compatible storage) silently failing to upload for accounts with larger backups. Any backup big enough to need a multipart upload was never reaching your remote storage, even though it was created correctly on the server. All backups now upload offsite reliably regardless of size.

v1.5.2

Fixes2

  • Fixed www redirects (and other Caddy changes) failing on servers where a redirect had been pasted into the Caddy config by hand before this feature existed. The duplicate quietly blocked every reload, so redirects worked on one site but failed on the rest. The panel now detects and clears that conflict automatically on startup, and no single site can jam the others.
  • Fixed scheduled and manual backups creating a tiny empty archive for accounts that have no websites or databases (such as the admin account). These accounts are now correctly reported as skipped instead of showing a 0 MB or failed backup.

v1.5.1

Features2

  • WordPress Manager: a new 'Update all' button updates core, plugins, and themes in one click. Updates now also get more time to finish on sites with many plugins, and no longer stop halfway if you close the tab.
  • WordPress Manager: turn on nightly automatic updates per site and choose whether to auto-update core, plugins, themes, or any combination. Set it once and leave it.

Fixes1

  • Fixed applying a www to non-www (or non-www to www) redirect across several sites at once, where the first site worked but the others failed. All sites now apply correctly, and one problem site no longer blocks the rest.

v1.5.0

Features4

  • File Manager gains multi-select delete, sortable columns (name, size, date modified), and a built-in text editor so you can edit files directly in the panel without downloading them.
  • New Server Info card on the customer dashboard shows your server IP, hostname, OS, uptime, installed PHP versions, and a simple health indicator.
  • Per-customer offsite backups (Pro): send your backups to your own Amazon S3, Backblaze B2, Wasabi, MinIO, or SFTP destination on your own daily schedule, with a Test Connection button.
  • WWW redirect: enable a www to non-www (or non-www to www) canonical redirect per domain from the Domains page, applied automatically with no Cloudflare required.

Fixes2

  • Fixed File Manager uploads failing with 'no files in upload' when choosing a file; uploads now work reliably.
  • Fixed a false 'Backup failed' notification that appeared even when the backup had actually completed successfully.

v1.4.8

Fixes6

  • Fixed WordPress pretty permalinks returning 404 on sites created with the WordPress Optimized template. Post-name links such as /sample-post/ now work, and affected sites are repaired automatically on update with no action needed.
  • Fixed creating a site with the WordPress Optimized template (or any PHP template) failing when the runtime was left on its default. The template's runtime is now applied automatically, so PHP sites always get their own dedicated PHP pool and work on the first try.
  • Fixed the web server restart reporting a 'restart failed' error even when it restarted successfully. The panel now confirms the service is running before reporting a problem.
  • Fixed the WordPress Manager page hanging on accounts with several WordPress sites. The list now loads quickly and a single broken install no longer freezes the whole page.
  • Fixed SSL certificate reissue showing false 'network error' and 'failed to start' messages even though the certificate was issued successfully. Reissue now reports its status cleanly.
  • Fixed the File Manager action menu opening off-screen for the last items in a folder. It now opens upward when near the bottom so every option stays reachable.

v1.4.7

Fixes3

  • Fixed multi-site accounts hosting more than one site with a built-in template. Creating a 2nd or later site with WordPress Optimized, Laravel, Nextcloud, or any other built-in template previously made it serve the first site's content. Each site now correctly serves its own folder, and sites already affected are repaired automatically on update with no action needed.
  • The App Installer now works reliably on every site: it creates the site's folder if it was missing, installs into the site you actually selected, and always shows a log when something fails (a failed install could previously show nothing at all).
  • Login as (admin impersonation) now opens the customer panel on the correct public port instead of the internal one.