Everything NovaPanel does

Caddy 2 reverse proxy with auto-TLS for every hostname

• Add a domain → Caddy provisions a Let's Encrypt cert within seconds. No config files, no certbot cron jobs.
• Choose the web server per site — OpenLiteSpeed, Nginx/OpenResty or Apache — with Caddy still handling SSL, the firewall and logs. Apache brings the .htaccess behaviour a site migrated from cPanel expects. Pro and Developer.
• Per-site PHP-FPM pools — each site gets isolated memory limits, time limits, opcache settings.
• Custom error pages per site (404 / 500 / etc) editable from the UI, with a live preview.
• Branded default pages: the page on your server's IP address, new-site and subdomain placeholders, error, maintenance and suspended pages, each with editable text and a live desktop and mobile preview.
• Node and Python apps: set the port your app listens on, or detect it with one click, so the proxy always reaches the right process. Subdomains can use a web template too.
• Per-site access + error log tail in the browser. No SSH-and-grep dance.

20 applications installed onto any site in a single click

• WordPress, Ghost, Joomla, Drupal, Laravel, Next.js, Django, Nextcloud, PrestaShop, Shopware, Matomo, n8n, Moodle, MediaWiki, Mattermost, Directus, Strapi, PocketBase, Bagisto and Plausible, installed straight onto a site.
• Framework apps get the right document root automatically (Laravel / Shopware / Bagisto serve from public/).
• Installs land in that specific site's own docroot, so you can run a different app on every site you host.
• Every install captures a log you can read if something fails; uninstall cleans the files back to a welcome page and leaves your database untouched.

Update and auto-update every WordPress site from one place — free on every tier

• Update core, plugins, and themes individually or all at once; partial failures are reported per target, not swallowed.
• Updates run detached with a 15-minute budget, so they finish on plugin-heavy sites even if you close the tab.
• Nightly automatic updates per site — pick core, plugins, themes, or any combination; runs once a night at 4am server time, at most once a day.
• Flush cache, toggle maintenance mode, and jump straight into wp-admin without hunting for the login URL.

PostgreSQL 17 + MariaDB, both first-class

• Per-customer database isolation: each customer gets their own postgres roles + databases, no cross-tenant access.
• phpMyAdmin bundled, available per-customer.
• One-click logical backups (mysqldump / pg_dump) → optional remote upload (S3 / Backblaze B2).
• Import / export from the UI — drag a .sql file, restore in place.

Postfix + Dovecot + DKIM + Roundcube webmail

• SPF / DKIM / DMARC records auto-generated for every domain — copy-paste into your DNS.
• Per-domain catch-all routing, alias management, autoresponders, vacation messages.
• Spam scoring via SpamAssassin; ClamAV scanning on inbound (Pro tier).
• Outbound SMTP relay support — point at SES / Postmark / Mailgun if your VPS has port 25 blocked (most do).

PowerDNS authoritative, optional DNSSEC

• Manage A / AAAA / MX / TXT / SRV / CNAME records per domain in the UI.
• DNSSEC: a single toggle signs every zone with PowerDNS, and the DNS Zones page shows each zone's DS record with a copy button, ready to paste at your registrar.
• Slave / master modes: run NovaPanel as your authoritative or as a hidden master behind a public secondary.
• API-driven for automation — every UI action has a corresponding REST endpoint.

Browser-based file ops, no SSH needed for most tasks

• Multi-file upload, an in-panel text editor (2 MB guard, refuses binaries), chmod permissions grid, and compress / extract archives (.zip, .tar.gz).
• Sortable columns (name / size / modified), multi-select with batch delete and compress, rename, and move without silent overwrite.
• In-browser shell — full xterm.js terminal scoped to the customer's home directory (or full root for admin).
• Real SSH access, set per package: customers add OpenSSH or PuTTY keys in their panel and log in as their own account. Packages without SSH refuse the login cleanly.
• Integrates with the file manager: select files → 'open in terminal here' jumps you to that path.

Local + remote, scheduled or on-demand

• Per-site, per-database, or full-account backup targets.
• Local destinations work in Community; offsite S3 / Backblaze B2 / Wasabi / MinIO / SFTP destinations are Pro-only.
• Per-customer offsite: each hosting customer can point their own backups at their own remote storage, on their own schedule — not just one server-wide destination.
• Streamed signed download links — pull any backup straight from the browser without exposing your session token, and multi-gigabyte archives download without choking.
• Schedules with retention policies, and offsite uploads use multipart so archives larger than 5 GB upload reliably.
• One-click restore — pick a snapshot, confirm, the panel handles the database drop / re-create / file-overwrite. Restores transparently pull from the offsite copy if the local one has been pruned.

OWASP Core Rule Set enforced in Caddy via Coraza — no extra proxy hop

• Three modes per site: Off, Detection-only (inspect + log, never block), and Blocking (403 on match).
• Detection-only is the WooCommerce-safe answer — run it on a live store to see exactly which rules fire on real orders before you ever block anything, so add-to-cart never 403s by surprise.
• Per-category toggles — SQL injection, XSS, RCE, remote/local file inclusion, scanner detection, protocol enforcement, session fixation. Switch off just the class that false-positives on your app and keep the rest protecting you.
• Blocked requests return 403 and are logged with the exact CRS rule ID that fired, so tuning is a two-minute job, not guesswork.

ClamAV attachment scanning + on-demand file sweeps

• Inbound mail attachments scanned at MTA time.
• On-demand directory scans from the panel, with a findings report per run.
• ClamAV signature database auto-updates daily.

Push-to-deploy via webhook + SSH deploy keys

• Connect a GitHub / GitLab / Gitea / Bitbucket repo to a site.
• Generated deploy SSH key (read-only) you paste into the repo's settings.
• Webhook URL the panel listens on — push to your branch, the panel pulls + runs your post-deploy script.
• Per-site deploy log so you can see exactly what ran.

For sites that are applications, not just pages

• Per-site environment variables, set in the panel instead of committed to the repo.
• Application log viewer — finds and tails the site's own logs (Laravel's storage/logs, WordPress's debug.log and similar), scoped to that site's files.
• Background workers — always-on processes such as a queue worker or websocket server, run as the site's user under pm2, restarted if they crash and after a reboot. Up to 10 per site.
• Custom deploy command — runs after each git deploy, as the site's user, for build steps like composer install or npm run build.
• Site config export and import as YAML — runtime, git, domains and security settings, with a dry run before an import applies anything.
• Priority email support from the developers.

Make the customer panel look like yours

• Custom logo, favicon and primary colour — the colour carries through buttons, links and badges in both panels.
• Custom login-page copy and support email — your customers see your brand, not ours.
• Alert emails and the pages visitors see (default, error, maintenance, suspended) carry your name, logo and colour. Hiding the "Powered by" line is Pro too.
• Customer-facing URL stays on YOUR domain — no NovaPanel subdomain leakage.

What the operator sees on port 2087

• Customer accounts with packages: site / DB / disk / bandwidth quotas per package.
• Per-customer CPU, memory and process limits on packages. They cover the customer's apps and workers, the panel terminal, deploy builds, SSH sessions and cron jobs, so one customer's runaway script or fork bomb can't take the server down. PHP websites are not covered yet.
• Customer home folders are private: other accounts on the server can't read them, while the web server and panel keep the access they need.
• License management — apply Pro keys, view fingerprint, manage subscription via Stripe / PayPal portal.
• Notification system — license renewal warnings, security patches available, package updates available, low disk, failed logins, service downtime.
• Audit log — every state-changing call against the panel is logged with actor / IP / target. 90-day retention, configurable.
• Banned IPs page wired to UFW — block bad actors at the firewall, see ban history, set automatic expiry.
• Server Health Score — a single 0-100 signal on the dashboard from disk, memory, core services, SSL coverage, and backup status, with a per-signal breakdown. Resource-alert thresholds are tunable on Pro.
• Outbound webhooks (Pro) — HMAC-signed event POSTs (site lifecycle, server.alert resource warnings, and more) into Slack, Discord, PagerDuty, or your own automation.
• Updates install themselves. By default every new release installs within about an hour, and rolls back automatically if the new version will not start. Choose security fixes only, or switch it off, on the Updates page.
• Operator notices — anything you genuinely need to know about the software running your server appears in the panel, rather than depending on an email address someone typed at install time.

Bring accounts in from cPanel, DirectAdmin or HestiaCP

• Upload a cPanel, DirectAdmin or HestiaCP backup archive in the panel — no shell access needed on either server, which matters because most people leaving shared hosting have neither.
• Reads the archive and shows you exactly what it found — domains, databases with their sizes, mailboxes, forwarders, DNS records, cron jobs — before anything is created.
• Dry run first, always. The real migration is not offered until you have seen what it would do.
• Brings across sites and files, addon domains and subdomains, databases with their data, mailboxes with their stored messages, forwarders, DNS records, and each site's PHP version.
• Nothing is ever overwritten. An account, hostname, database or mailbox that already exists is skipped and reported, so re-running after a partial migration is safe.
• Says what it cannot bring: mailbox passwords are regenerated (no panel can convert another's password hashes), cron jobs arrive disabled for review, and anything the archive does not contain is named rather than quietly missing.

Drive the panel from the billing system you already use

• One call creates a whole hosting account — system user, website, virtual host, DNS zone, FTP login and SSL — instead of five separate steps.
• FOSSBilling module: order activation, suspend, unsuspend, cancel, plan change, password change, and single sign-on into the customer panel.
• REST API with personal access tokens (Pro) — the same API both panels are built on, so anything the UI can do, a script can do.
• One-time login links, so your billing system can drop a customer straight into their panel without handing round passwords.