| docs

Appearance

[1.4.0] - 2026-07-23 ​

Release Overview ​

This release adds internationalised domain name (IDN) support and login shortcut URLs, alongside broad security hardening across the panel, bolt-agent, Git, databases, email, and file handling.

Domains ​

  • Internationalised domain names (IDN) - domains with non-ASCII names (for example пример.example) can be added and used throughout AdminBolt. They are stored in Punycode and shown in their readable Unicode form. Document roots and other filesystem paths use the stored Punycode form.

Login ​

  • Login shortcut URLs - every hosted domain answers on short paths that redirect to a login screen: /cpanel and /panel open the panel login, and /webmail opens webmail. Accounts moved from cPanel keep the entry points their users already know. The paths, their destinations, and the feature itself are configurable in MyApache Settings.

Security and access ​

This release includes extensive input-validation, access-control, and data-protection hardening. The main themes:

  • Agent authentication - bolt-agent requests require a valid token, which stays enabled by default.
  • Ownership enforcement - hosting, network, email, mailing list, database backup, WordPress install, and DNS health-check actions verify that the signed-in account owns the target resource.
  • Input validation - certificate issuance, database backup and restore, directory-protection credentials, domain, file, SSH key, JetBackup license, TrackDNS, and mailing list inputs are validated on submit.
  • Git safety - Git clone URLs are allow-listed, SSH host keys are verified, and repository paths, ownership changes, and key handling use restricted file operations.
  • Path and permission handling - .htaccess builds, SSL storage, and hosting, database, and email file operations use restricted paths; framework directories and panel database files use restricted permissions.
  • Secret and log privacy - database and hosting operations keep credentials out of process listings, and database-related logs mask sensitive values.
  • Reserved usernames - hosting account creation rejects reserved system usernames.

[1.3.0] - 2026-07-15 ​

Release Overview ​

This release adds mailbox migration from external IMAP servers, reseller resource limits, panel-wide translation with 18 new languages, automatic SSL for hosting domains, and broad security hardening.

Email ​

  • Mailbox import via IMAP - migrate email from an external IMAP server into an existing mailbox. The client panel adds a per-mailbox Import email (IMAP) action with connection testing and live progress.
  • Mail subdomain SSL and SNI - mail hostnames (mail, autoconfig, autodiscover) are issued as a separate certificate group, and mail SNI keys off the certificate the server actually issued.

Internationalisation ​

  • Full panel translation - hardcoded UI strings across the panel are now translatable.
  • 18 new languages - added Brazilian Portuguese, Japanese, and 16 more panel languages.

Reseller ​

  • Reseller resource limits - resellers get resource limits (accounts, disk, and bandwidth) on the accounts they manage.

SSL ​

  • Auto-SSL for hosting domains - bolt-cli setup-cron-jobs now schedules bolt-cli run-auto-ssl, so certificates for active hosting domains are issued and renewed automatically.

Security and access ​

  • FTP passwords hashed - FTP passwords are stored as one-way hashes and can no longer be viewed after creation.
  • Unattended install admin password - a new bolt-cli set-admin-password command sets the admin password during unattended installation.
  • Mailing list validation - mailing list names are validated on create.
  • Data protection hardening - Roundcube, mail, FTP credential, and hosting account export files use restricted ownership and permissions.

Reliability ​

  • ModSecurity audit log page - the ModSecurity audit log viewer now works end to end.
  • Lighter health checks - the Services page polls a lighter health endpoint, reducing load.
  • Plan allocation alerts - fully used plan allocations no longer raise critical-severity alerts.

PHP ​

  • System restrictions apply reliably - saving disable_functions or disable_classes restarts PHP-FPM so the change takes effect.
  • Imported domain PHP engine - domain import no longer assigns the wrong PHP engine on LiteSpeed servers.

Fixes ​

  • Update modal - the update modal no longer stays open after an update completes.
  • MySQL complex passwords - MySQL user creation accepts a wider range of complex passwords.
  • mod_passenger uninstall - uninstalling mod_passenger now removes it from the Apache configuration.

[1.2.2] - 2026-07-09 ​

Release Overview ​

This release adds a per-account bandwidth limit override with a per-calendar-month usage view, lets email forwarders keep a local copy of forwarded mail, and gives the Hub dashboard clearer stale and offline status for nodes that stop reporting in.

Bandwidth ​

  • Per-calendar-month usage - bandwidth usage now shows the current calendar month instead of a lifetime total, so the counter resets on its own at the start of each month.
  • Per-account limit override - admins and resellers can set a bandwidth limit on an individual hosting account that overrides the plan default. Leave it blank to keep the plan's limit, or set 0 for unlimited. Clients cannot change it.
  • Consistent units - the client dashboard now shows bandwidth in the same units as the admin panel everywhere.

Email ​

  • Forwarders can keep a local copy - a new Keep a copy toggle delivers each message to both the forwarding address and the local mailbox, so forwarded mail stays visible in webmail.

Security and access ​

  • Suspended client login message - suspended clients now see a clear "Your account has been suspended" message instead of a blank login form.
  • IP blocker CIDR handling - the client IP blocker handles CIDR blocks and IP ranges more consistently, so a single block is enforced as one rule.
  • Admin panel not indexed - the admin panel is excluded from search engine indexing. Client and reseller panels are unaffected.

Reliability ​

  • Stale and offline node detection - the Hub dashboard flags nodes that stop reporting in as Stale and then Offline, and shows when each node was last seen.

PHP ​

  • igbinary and msgpack locked with Redis - the PHP version form keeps both extensions switched on and labels them "Required by Redis" whenever Redis is enabled.
  • Imported domains resolve PHP version - imported domains now pick up the right PHP version automatically.

Fixes ​

  • SSH Terminal page - fixed an error opening the client SSH Terminal page.
  • Update screen freezing - a follow-up fix so the update screen no longer gets stuck on an out-of-date view during an update.

[1.2.1] - 2026-07-03 ​

Release Overview ​

This release introduces BoltTerminal, a new terminal module for CloudLinux servers, brings native CloudLinux SSH and cron support to hosting accounts, and fixes LiteSpeed trial-key activation.

BoltTerminal ​

  • BoltSSH is now BoltTerminal - the SSH module has been renamed and rebuilt as BoltTerminal, with its own installer and health check.
  • Built for CloudLinux - BoltTerminal requires CloudLinux and will not install alongside a running SecureBox. On non-CloudLinux servers, SecureBox remains the way to provide isolated SSH access.
  • Shell greeting - root login sessions now show a Bolt greeting message.

CloudLinux ​

  • Native SSH access - toggling SSH access on a hosting account uses CloudLinux natively (CageFS and a per-user sshd configuration) instead of SecureBox. Leftover SecureBox setups are cleaned up automatically.
  • Cron jobs - hosting accounts on CloudLinux can manage cron jobs whenever SSH access is enabled. Commands run through bash under CageFS isolation.
  • CageFS refresh on upgrade - CloudLinux servers get a one-time CageFS update during the panel upgrade.

Fixes ​

  • LiteSpeed trial key - activating LiteSpeed with Use Trial Key no longer fails with a 500 error.
  • Custom hostname SSL - the hostname certificate is re-issued when its name no longer matches the configured hostname, so it no longer breaks after a panel update.
  • Update screen freezing - fixed the update screen freezing on a stale modal during panel updates.

[1.2.0] - 2026-07-01 ​

Release Overview ​

This release adds full CloudLinux and LiteSpeed integration, along with a completely rebuilt PHP version manager that lets regular (REMI), CloudLinux Alt-PHP, and LiteSpeed (LSPHP) engines run side by side. See the CloudLinux and LiteSpeed guides for the full workflow.

CloudLinux ​

  • Guided installer - a CloudLinux installation page walks you through activation: enter your license key, run a pre-check that validates the key and system, then convert the OS with a live deploy log. The page tracks the full lifecycle (converting → installed → reboot → converted) and surfaces a Reboot now action when the server is waiting to switch kernels.
  • Feature provisioning - after conversion you choose which CloudLinux runtimes to enable (PHP, Node.js, Python, Ruby, and mod_lsapi) with per-runtime version pickers and a live progress log.
  • LVE Manager - integrated LVE Manager with single sign-on, installed on demand directly from the panel, for managing per-account resource limits.
  • Alt-PHP - install, remove, and configure CloudLinux Alt-PHP versions (5.2 through 8.x) from the PHP manager, including per-version extension selection and default profiles.
  • Resource limits from hosting plans - hosting plans gain a Resource Limits tab (CPU speed, memory, IO, IOPS, processes, entry processes). Limits are pushed to the matching CloudLinux/LVE package automatically on plan create, update, and account provisioning, with a backfill command for existing plans.
  • Control-panel hooks - AdminBolt fires the CloudLinux control-panel hooks on admin, account, domain, and package changes so CloudLinux stays in sync with your accounts.

LiteSpeed ​

  • Web server switching - switch between Apache and LiteSpeed from the panel. The license is validated before switching, the incoming server's saved settings profile is applied first, and both servers are safely stopped and started so no request is dropped during the change.
  • LSPHP - LiteSpeed PHP (LSPHP) versions 7.4 through 8.5 can be installed, configured, and assigned to domains. Matching LSPHP versions are provisioned automatically when LiteSpeed is installed.
  • Settings and profiles - a LiteSpeed Settings page with server, security, performance, and module tabs, backed by a default-profile system that is applied on install.
  • LSCache - per-domain LiteSpeed Cache management: enable or disable caching, tune default and maximum TTL, maximum object size, and excluded paths, and clear a domain's cache from a dedicated LiteSpeed Cache page.
  • Logs and admin - built-in LiteSpeed access and error log viewers, a restart action for the LiteSpeed service, and one-click access to the LiteSpeed WebAdmin console (port 7080 is opened in the firewall on install).
  • PHP engine migration - a dedicated migration page moves your domains and plans between matching REMI and LSPHP versions when you switch web servers, with a dry-run preview beforehand. Switching back to Apache is blocked (with a direct link to the migration page) while any domain still uses LSPHP, so sites cannot break.

Improvements ​

  • Rebuilt PHP version manager - a single page to install, remove, configure, and set default profiles for every PHP engine (REMI, Alt-PHP, LSPHP), with vendor logos and clear per-version labels. Domains and plans now reference a specific PHP version, so regular, CloudLinux, and LiteSpeed builds of the same version no longer collide, and a PHP version still assigned to any plan or domain can no longer be uninstalled by accident.
  • Automatic PHP sync - installing or removing a PHP package over SSH (for example dnf install alt-php83) now updates the panel automatically via a dnf/yum hook and connects a matching default profile, with no manual refresh needed.
  • Hardened shared-hosting defaults - the default disable_functions list for PHP profiles has been tightened for safer shared-hosting environments.
  • Execution logs - background operations are saved to a durable execution log with a title, status, timing, and the operator and IP that started them, plus a richer, level-colored log viewer.
  • Reseller account view - resellers can open the full account detail view for their own accounts.
  • Convenience - copy actions on hosting plans and feature lists, and a new Resolver Configuration page.
  • Performance - CloudLinux control-panel API calls run through a native binary instead of booting PHP per request, making CloudLinux and LVE Manager interactions noticeably faster.
  • Stability - the CloudLinux installer detects and recovers from a stalled conversion, and update checks are skipped cleanly on servers where the AdminBolt repository is not configured.
  • Fixes - resolved a Safari sign-on issue on the LVE Manager page, ensured Apache is fully restarted after enabling modules (such as mod_lsapi) that require it, corrected PHP-FPM toggle visibility, hardened PHP CLI path resolution so Alt-PHP versions no longer shadow usable binaries, fixed the WordPress one-click installer, and corrected system notification email fallbacks.

[1.0.2] - 2026-05-14 ​

Source

Generated automatically from the panel's built-in changelog (/admin/change-log).

Release Overview ​

Security and hardening ​

  • phpMyAdmin: deprecated admin endpoint removed; SSO hardened (one-time tokens, hashing, POST-only validation, rate limits, stricter checks).
  • Command injection / shell safety: MLMMJ subscribe/unsubscribe and related paths; cron validation + safer command rebuild; backup tar/mkdir args escaped; nmcli DNS inputs validated/escaped; GoAccess path traversal blocked; JetBackup SSO user, license key, and log reads hardened; FTP paths jailed/validated against traversal.
  • Databases: strict DB name rules and 422 for invalid names.
  • Git: BoltGitService aligned with bolt-git (required Linux user, branches API, safer cleanup semantics).

Major product work ​

  • WordPress: client management UI (plugins/themes/posts, SSO, operations), async installer with progress, conflict handling, shared WP-CLI helpers, i18n, and follow-up security/UX fixes.
  • AI Agent Hub: SSO, WA pairing, embedded chat (proxied streams), API key scoping, admin/client routes, hub registration, and related fixes (see large #69 work in history).

Platform and services ​

  • Symlock provisioning and health integration (AB-931).
  • SSHD via Bolt Agent (provision/configure, bolt:manage-sshd, profiles command, service rename to SSHD).
  • File manager installer URL/version bump (0.0.7 mirror).

UX and admin ​

  • License page: removed extra “license information” block; key UI retained. (AB-961)
  • Safari: Filament language switcher layout/z-index fixes.
  • Admin SSO CLI: optional --expire duration on generate. (AB-452)

Email and network ​

  • POP3 in mail settings and defaults; POP3/POP3S firewall ports. (AB-514)

Cleanup and refactors ​

  • Removed unusable Fail2BanBannedIpService.
  • Removed deprecated htaccess PHP-version rebuild job/path; domain updates only rebuild general htaccess.