NovaPanel
Features Pricing Alternatives Docs Changelog Customer portal Discord GitHub
Get Pro

Changelog

Every panel release in chronological order. Updates land continuously — your panel picks them up on its next heartbeat. This page auto-refreshes from the release server, so you'll see new entries the moment they ship.

v1.9.4

  • Feature Select all in the File Manager. A checkbox in the list header (and a Select all toggle in grid view) selects everything in the current folder at once, so you can copy, compress, download or delete a whole folder without ticking each file one by one. It respects the new filter, so you can also select just the files that match.
  • Feature Copy files and folders. Alongside Move, you can now copy a single item from its menu, or copy your whole selection into another folder. Copies keep the correct owner, so copied files stay editable by your site and over FTP.
  • Feature Filter the current folder by name. A search box in the File Manager toolbar narrows the list as you type - handy in folders that hold thousands of files.
  • Feature Download several items as one zip. Select any mix of files and folders and download them together as a single zip; a single selected file downloads as-is.

v1.9.3

  • Fix Switching a site to OpenLiteSpeed now serves it with the right PHP version straight away. The switch used a graceful reload, which left the old PHP worker running - so a site could keep being served by the previous interpreter until the next restart. An app pinned to a newer PHP (Laravel's Composer check, for example) could report a PHP-too-old error even though the site was set to the correct version. The engine is now fully restarted on a real change.
  • Fix A framework whose front controller lives in public/ - Laravel, Symfony and similar - now works the same on every engine. When a site was deployed by hand (so its document root was never recorded), switching it from Caddy to OpenLiteSpeed or OpenResty could 404 because those engines served the site's top folder instead of public/. NovaPanel now detects the public/ layout automatically, so all engines agree and no manual fix is needed.

v1.9.2

  • Fix PHP extensions are now kept complete automatically. On update, NovaPanel checks every installed PHP version across all web engines (Caddy/PHP-FPM, OpenLiteSpeed and OpenResty) and installs any that are missing. Apps migrated from another host - Laravel, or anything using a SQLite database - no longer break with a cryptic 500 because a PHP extension the app needs was absent. Only missing extensions are installed, so updates stay fast.

v1.9.1

  • Fix OpenLiteSpeed's PHP (lsphp) now installs the full extension set, matching PHP-FPM (sqlite3, mbstring, xml, gd, bcmath, intl, zip, pgsql, redis and more). Apps that assume an ordinary PHP - Laravel/Symfony, or anything using a SQLite database - no longer break with a cryptic 500 when a site is switched to OpenLiteSpeed.
  • Fix PHP versions installed from the panel (7.4/8.0/8.1/8.2/8.4) now include the redis and imagick extensions too, matching the set the default 8.3 install ships with.

v1.9.0

  • Feature File Manager: Fix Permissions - one click resets ownership and standard web permissions (folders 755, files 644) on a folder, repairing files uploaded or extracted with the wrong owner, a common cause of 500 errors.
  • Feature Domains: revert SSL to HTTP - remove an issued certificate and serve a site over plain HTTP again, for sites you deliberately want on HTTP.
  • Fix Fixed a crash when opening the File Manager trash or the API Tokens page.
  • Fix Mail now self-repairs on servers whose image shipped Postfix and Dovecot preinstalled but unconfigured (some Proxmox/LXC templates), where creating a mailbox or logging in over IMAP previously failed.
  • Fix Installer now fully configures mail and other services on server images that ship them preinstalled.
  • Fix The SSH login banner now shows the correct panel version after an automatic update.

v1.8.9

  • Fix Two-factor authentication could never be enabled: the recovery-codes table was referenced by every setup since 1.6.0 but created by no migration, so a valid code was reported as invalid
  • Feature The customer panel is translated into ten languages: German, French, Spanish, Italian, Dutch, Portuguese, Turkish, Russian, Polish and Romanian
  • Feature Restore a single site from a backup instead of the whole account, leaving your other sites at their current state
  • Feature Publish a staging site to live - files only, or files and database - with a backup of production taken first
  • Fix The notification dropdown could not be scrolled and its View all link did nothing; marking a notification read now updates immediately
  • Feature Notification titles and messages are translated too, including notifications already in your list
  • Feature Dates, times and counts follow the language you chose rather than your browser's, with correct plural forms per language
  • Fix A rejected two-factor code now says whether the two clocks disagree, and by how much, instead of only 'invalid code'
  • Feature Your language choice is stored on your account, so it follows you to another device
  • Infra New tests catch a whole class of shipped bugs: SQL naming a table no migration creates, the language list's two halves drifting apart, plural forms a language is missing, and untranslated text in the interface

v1.8.8

  • Feature Migrate an account in from HestiaCP. Upload a Hestia backup and the panel recreates the account: sites, files, databases, mailboxes, forwarders, DNS records and cron jobs. Hestia packs each site, mail domain and database as a separate compressed archive inside the backup, and NovaPanel unpacks both layers for you.
  • Fix DirectAdmin import now works against real DirectAdmin backups. It had been built from DirectAdmin's published layout, which differs from what DirectAdmin actually writes in six ways. Two of them stopped an import outright, and one quietly made an addon domain the account's main site.
  • Feature Account archives are read in whatever compression they arrive in: .tar.gz, .tar.zst (DirectAdmin's current default), .tar.xz, .tar.bz2 and plain .tar. Nothing has to be converted by hand before uploading any more.
  • Fix Mail filed into folders is no longer missed. A mailbox with an empty inbox whose messages sat in folders was reported as having no stored mail, and those messages would not have been brought across.
  • Fix The migration plan no longer says a mailbox has no stored mail when what it means is that the amount is not yet known. The two look the same and only one of them is safe to decommission a server on.

v1.8.7

  • Feature Migrate an account in from cPanel or DirectAdmin. Upload a backup archive in the panel and it recreates the account: sites, addon domains and subdomains, files, databases with their data, mailboxes including their stored messages, forwarders, DNS records and cron jobs. It reads a backup file rather than logging in to the old server, so it works even when that server is already gone, and needs no shell access on either machine. Pro and Developer.
  • Feature The importer reads before it writes. It reports what the archive actually contains - domains, database sizes, how much mail each mailbox holds, DNS records - then runs a dry run showing every resource it would create, and only then offers the real migration. Nothing that already exists is overwritten, so re-running after a partial migration is safe.
  • Feature It also says what it cannot bring across. Mailbox passwords are regenerated, because no panel can convert another panel's password hashes. Cron jobs arrive disabled for review. SPF, DKIM and DMARC records are deliberately not copied, since this server publishes its own and two SPF records on one name is a permanent error. DirectAdmin backups contain no DNS at all, which is their format rather than a limitation here, so MX records for mail hosted elsewhere must be copied by hand before switching nameservers.
  • Fix novapanel user delete now actually removes the account. It was a bare database delete: the Linux user, the PHP-FPM pools, the FTP credentials, the MySQL databases and roles, the DNS zones, the caddy vhosts and the mailboxes all survived it, and those mailboxes kept authenticating. The admin panel always did this correctly; the CLI could not reach the same code. Both now share one implementation.
  • Fix Deleting an account can no longer leave PHP down for every site. A PHP-FPM pool belonging to a deleted user stops the whole FPM service from starting, which takes PHP down for every site on that version. Removing the pool ended with a reload, which does nothing to a service that is already stopped, so the deletion that removed the cause declined to fix the effect. It now restarts when a reload cannot work.
  • Fix DNS errors from PowerDNS now say what was wrong. Every failed record write reported only an HTTP status code and discarded the server's own explanation, such as a conflict with a pre-existing RRset. That affected every DNS operation in the panel, not only migration.
  • Fix Free-space checks read the correct column when a device name is long enough to wrap onto its own line, which is what LVM volume names do. /var/lib/mysql is exactly where an LVM volume tends to live.

v1.8.6

  • Security The log written during installation is removed on start. It was readable by every user on the server and recorded the database password on the command line. See novapanel.dev/security, NP-2026-002.
  • Feature The License page now shows which email address your licence is registered to, and links to the customer portal. That is the address the portal emails a sign-in link to, and nothing previously said which one it was.
  • Fix Refresh on the License page now re-fetches the licence from the licence server. It previously only re-read the copy already on the server, so it could never show anything new.

v1.8.5

  • Feature NovaPanel can now install a security release by itself. Until now every update waited for someone to press a button, which meant servers stayed on versions with published vulnerabilities for months. This applies ONLY when the panel is older than the release that fixed a published security issue - an ordinary release still waits for you, as before. It can be turned off under Updates, and the setting is administrator-only, since leaving a server on a vulnerable version affects everyone hosted on it.
  • Fix An update that fails to start is now undone automatically. The swap used to be one-way: a binary that would not boot left the service stopped with a working copy of the previous version sitting unused beside it. The panel now waits for the new version to come up and restores the previous one if it does not.
  • Feature Important notices from NovaPanel now appear in the panel itself, rather than depending on the email address given at install. Used for security advisories and similar - anything you need to know about the software running your server.

v1.8.4

  • Fix Renaming a server no longer costs it its licence. The panel identified a machine partly by its hostname, so changing the name looked to the licence server like a different machine entirely - which is a routine thing to do, since a new server usually arrives called something like localhost and gets named properly soon after. On a paid licence that consumed the single server slot and the panel began reporting that the maximum number of servers had been reached, for a machine it was already licensed to. Existing servers are recognised and carried across automatically on the first check-in after updating; nothing needs to be re-entered.

v1.8.3

  • Feature New hosting accounts get their SSL certificate during provisioning, rather than waiting for someone to press Issue SSL afterwards. It is requested only when the domain already points at the server - including through a Cloudflare proxy - because turning SSL on for a domain aimed elsewhere would take the site offline. When it cannot be issued, the account is created as normal and says why, so nothing is left half-done.
  • Fix The FTP login created with a new account now uses the account's own password, the way cPanel does. It used to get a separate generated password shown once and stored only as a hash - so an account created through an API or a billing system ended up with an FTP login whose password nobody could recover. Changing the account password now changes the FTP password with it.
  • Feature An administrator can set a customer's password. Until now the only way to help a customer who had lost theirs was editing the database by hand. Signed-in sessions end with the change, since a password is reset exactly when somebody else may know the old one.
  • Feature Account usage now reports the limits it is measured against - websites, domains, databases and mailboxes each with the package's maximum, and traffic with its monthly allowance. A count on its own cannot answer the question a customer asks of it, which is whether they can add another one.
  • Feature A billing system can now run a hosting account end to end through the API: create it with its website, DNS, FTP and SSL, sign the customer straight into their panel, change the password, suspend, unsuspend, move between packages, and terminate. Every one of those was tested against a real FOSSBilling installation, and the module for it is published separately.
  • Fix The Create Account page no longer tells you to point the DNS and issue SSL afterwards when it has already been issued. The advice now follows what actually happened, and still appears when the domain does not point here yet.

v1.8.2

  • Fix The PHP Settings page could not read a site's saved php.ini settings. It showed an empty form on every server since it shipped - the values were real and in force, the page simply could not see them - and saving that empty form replaced a customer's tuned limits with the defaults. It now reads and shows what is actually configured.
  • Feature Sites on OpenLiteSpeed now get the full PHP toolkit. OpenLiteSpeed runs PHP itself rather than through the pool every other web server uses, so PHP settings, the extension list, installing an extension and switching PHP version all silently applied to something else. They now apply to the PHP that actually serves the site, and the page says which one that is.
  • Feature The PHP Manager can install, configure and remove OpenLiteSpeed's PHP builds. They are separate from the standard PHP versions, so installing PHP 8.4 for the server did not make it available to sites on OpenLiteSpeed. Installing one now brings its extensions with it, and removing one is refused while sites still use it.
  • Fix A site set to a PHP version OpenLiteSpeed has no build of was quietly served by a different version instead. Those versions can no longer be chosen for such a site, and the page says why and where to add them.
  • Fix PHP settings are now checked before they are saved. A memory limit of 333 was accepted and means 333 BYTES to PHP, which takes every page on the site down with no indication why. Sizes now have to carry a unit, and the message says what you probably meant.
  • Fix The file manager's row menu was cut off when a folder held only one file - which is exactly when you have uploaded a single archive and want Extract, and Extract was below the cut. The menu is no longer clipped.
  • Fix The notifications panel was painted over by the page behind it on some pages, including Packages and the PHP Manager.
  • Fix A site whose application returns a temporary 503 is no longer moved off its web server. WordPress does that while it updates itself, which the panel does nightly, so a routine update could move a healthy site and notify its owner about an outage that had already ended.
  • Feature The customer dashboard shows which web server the hosting runs on.
  • Feature New API endpoints for billing integrations: look an account up by username, read one account's disk and bandwidth, and create a single-use link that signs a customer straight into their panel. Groundwork for the WHMCS and FOSSBilling modules.
  • Fix Package operations started by the panel now wait for the package manager instead of failing when another one is already running.

v1.8.1

  • Feature Subdomains now follow their site onto its web server. Move a site to Apache and its subdomains move with it, so .htaccess rules and caching apply to a subdomain exactly as they do to the site. They share the site's connection rather than taking one of their own, so there is no limit on how many a site can have, and each keeps its own SSL certificate and settings.
  • Feature Sites using a web template can now change web server too. The template's PHP handler is pointed at the chosen web server and the rest of the template is left exactly as written. Only a template with no PHP handler at all is refused, and it now says so instead of giving a blanket reason.
  • Fix A single unreachable software source no longer blocks every system update. Applying updates stopped entirely if any repository failed to refresh - a third-party repository that has gone away, or has no release for this version of Ubuntu yet, was enough to hold back every security update on the server. The upgrade now proceeds and names the source it skipped.
  • Fix The system update log is no longer left showing an earlier successful run after a failure. It was only written at the second of two steps, so a failure at the first left the previous run's log in place - a log ending in success next to a notification reporting failure.
  • Fix A failed system upgrade can no longer be reported as successful. The result was read from the logging step rather than from the upgrade itself.
  • Fix A static subdomain of a PHP site continues to be served directly, and is never handed to a web server that would execute its files.

v1.8.0

  • Feature Choose the web server that runs a site: OpenLiteSpeed, Nginx/OpenResty or Apache, set per site or as the default for new ones. Caddy stays in front for SSL, the firewall, logs and bandwidth, so a site keeps its certificate, its firewall rules and its PHP version when it moves - and can be moved back at any time.
  • Feature Apache and Nginx/OpenResty serve PHP through the site's existing pool, so file ownership and PHP version are unchanged. Apache brings the .htaccess behaviour of a cPanel server, which is usually what a migrated site is missing.
  • Feature A site is only moved once its new web server is proven to be serving it, and is moved back automatically if that web server later stops responding, with the owner notified. A switch that cannot complete leaves the site exactly where it was.
  • Feature Installed web servers now appear on the Services page with their status, memory and start, stop and restart controls, alongside Caddy.
  • Fix Installing an app reported failure on every server while actually succeeding. The install script ran without the variables telling it where the site was, because sudo removes them, so it stopped on its first line - after the panel had already put the application in place. WordPress, Laravel and every other one-click install were affected.
  • Fix WordPress staging never worked. Creating, refreshing or deleting a staging copy failed against a database column that was never created, and the errors read as 'site not found' rather than pointing at the cause. Staging now works, and a staging copy runs on the same web server as the site it was cloned from.
  • Fix DNS records for a hostname are now shown and edited in the zone they actually live in. A subdomain used to open an empty record list with an invitation to add records to a zone that does not exist, while its real records sat in the parent zone, out of sight.
  • Security A customer editing DNS for a hostname inside a zone belonging to another account can no longer see or change that zone's other records.
  • Security Licence keys are no longer written to the server log in full. The key activates the licence on a machine, and logs are routinely copied into support requests.
  • Fix A staging site is no longer listed as a mail domain, and no longer claims to be a primary domain of its own.
  • Fix Paid features now become available within the hour of an upgrade rather than at the panel's next scheduled licence refresh.
  • Fix A panel keeps honouring paid features for seven days without reaching the licence server, up from two, so a licence-server outage does not disable features on a valid licence.

v1.7.5

  • Feature A Web server card in Settings shows which engine serves new sites, with OpenLiteSpeed, Nginx/OpenResty and Apache listed as what is coming. Every site continues to be served exactly as before - this release adds the choice, not a change.
  • Security Resellers and API keys can no longer read the server's mail settings, which include the outgoing relay password in readable form. Reading it allowed sending mail as the whole server.
  • Security Changing the server's mail configuration or its nameservers is now restricted to full administrators, and to a signed-in session rather than an API key. Both reconfigure the server for every account on it.
  • Security Listing mail domains and running deliverability checks are administrator-only. They span every account on the server, so a reseller could previously enumerate other customers' mail domains.
  • Fix The Mail Server page could show invented settings as though they were live when the panel briefly failed to read them - and saving that page would then have overwritten the real relay details and stopped outgoing mail.
  • Fix Database updates are now verified to be present in the released build before it is published. A panel could previously report its database as up to date while a change it needed had never been applied.

v1.7.4

  • Feature Firewall rules you have switched off are now listed in plain language - each shows what it protects against, and one click puts it back. Previously this was a row of bare numbers with no way to tell what you had disabled
  • Feature Firewall events can be filtered by IP address, path or rule, with a one-click Only my IP button - useful when a busy site's event list is full of traffic that isn't yours
  • Feature Firewall events are now kept for 30 days. They were previously read live from the server log, so history vanished within about two days - and much sooner on a site under attack, which is exactly when you need it
  • Fix Sites that redirect to the www version of their domain showed no firewall events at all - the sites most likely to be attacked were the ones the panel was silent about
  • Security A site could be shown firewall events belonging to another account when a hostname was claimed by both. Hostnames are now single-owner: creating a domain or subdomain that clashes with an existing one is refused, and any pre-existing clash is reported to the administrator
  • Fix The firewall page no longer reports settings it could not read as though the firewall were switched off, which risked those settings being overwritten
  • Fix Saving firewall settings now tells you when the web server could not be reloaded, instead of reporting success while the change was not yet in force

v1.7.3

  • Fix Incoming mail was stored where the mailbox service never looked, so it never appeared in inboxes - fixed on every OS, and previously received messages are moved into the inbox automatically
  • Fix On Ubuntu 26.04 the system mail config silently overrode NovaPanel's - repaired with a validated config, rolled back automatically if anything looks wrong
  • Feature Email apps can now send through the server: authenticated submission on ports 587 and 465, which previously had nothing listening at all
  • Feature IMAP and SMTP serve your server's real HTTPS certificate instead of a self-signed one when panel HTTPS is enabled
  • Feature Autoresponders and spam-to-Junk filing now actually run - delivery is routed through Dovecot so filters execute, including on Ubuntu 26.04
  • Fix Webmail sending works again on Roundcube 1.6 - the bundled config used a setting the new version ignores
  • Fix Enabling DMARC no longer delays all mail on servers where Postfix lacked permission to reach the DMARC service - fixed automatically
  • Fix Mail virus scanning is properly wired into Postfix, with the scanner config Ubuntu requires
  • Fix Saving mail settings no longer times out with a false error - changes apply in the background, the page reports when they finish, and a hiccup can no longer switch a working spam filter off
  • Feature The deliverability check now catches a missing IPv6 PTR record - the exact reason Gmail rejects mail from otherwise healthy servers
  • Fix Re-adding a domain now registers secondary DNS transfer targets for its existing zone
  • Fix A database blip during token refresh no longer signs users out

v1.7.2

  • Feature Active sessions: see every device your account is signed in on, sign any of them out, or sign out everywhere else - on both panels
  • Feature File manager trash: deletes are now recoverable for 14 days, with restore and empty-trash, swept automatically
  • Feature DNSSEC DS records are shown per zone, so your registrar can finally be given what it needs
  • Fix Logging out now revokes the session server-side instead of only clearing the browser
  • Fix Secondary DNS: every zone-creation path now registers AXFR transfer targets, not just two of four
  • Fix Backup test connection proves a real write on S3 and SFTP; write-only hardened buckets pass with a warning instead of failing
  • Fix White-label brand colours now actually apply across both panels and in notification emails
  • Fix Admin impersonation works behind Cloudflare tunnels and shows up in the customer's session list
  • Fix Site and staging deletion frees disk immediately instead of silently counting against the quota
  • Fix WAF page on Community shows the upgrade state up front and points at the correct log for rule IDs

v1.7.1

  • Security Fixed DKIM signing being switched off by the mail settings page. If a server had DKIM running but the saved setting said otherwise, simply opening Mail Server and pressing Save stopped the signing service and sent every message afterwards unsigned, with nothing reported. The page now reads the server's real state, and affected servers repair themselves on update.
  • Feature Spam filtering now actually filters. SpamAssassin has shipped for years behind a toggle that only started a background service Postfix had no way to talk to, so not one message was ever scored. Inbound mail is now scored and flagged spam is filed into a Junk folder. Your own outgoing mail is never scored. Off by default - turn it on under Mail Server.
  • Feature Virus scanning for email attachments. Infected mail is refused at delivery so the sender is told, rather than disappearing silently. Off by default.
  • Feature Greylisting now works. It briefly asks unknown senders to try again, which real mail servers do and most spam software does not. Your own customers and authenticated senders are never delayed. Off by default.
  • Security Fixed restoring a backup of a single site. It unpacked to the wrong place, so the site was never restored even though the panel said it was - and because site names can match account names, it could overwrite another account's files. Restores are now atomic: a failed restore leaves your site exactly as it was.
  • Feature Customers can restore their own files from a backup, including backups kept only at an offsite destination, which NovaPanel fetches back automatically. Files only - databases are not restored.
  • Security Offsite backups over SFTP now verify the destination's identity. Every connection previously accepted any host key, including a changed one, while sending a password over it.
  • Fix Ten one-click apps installed nothing at all and showed an Installed badge anyway. They are hidden until they have a working installer, and an app with nothing to install is now refused rather than reported as done.
  • Fix File Manager Move silently did nothing when a file of the same name already existed, and reported Moved. It now tells you about the conflict.
  • Fix Setting a disk, memory or CPU alert threshold to 0 to switch that alert off now works. It previously went back to the default and kept alerting.
  • Fix Four webhook events could be subscribed to but were never sent: SSL issued, backup completed, account updated and failed login. All four now fire.
  • Fix Corrected the documentation across 19 pages after checking every claim against the code. One page told you to run a command that does not exist and would have started a second panel on your server.

v1.7.0

  • Fix Background workers and Node/Python apps no longer die when NovaPanel updates. The process manager was being started by the panel itself, so it belonged to the panel's own service - and every panel update took every customer's workers and apps down with it. It now runs independently and survives updates.
  • Security Fixed DKIM signatures silently switching off. Saving the Mail Configuration page pointed the mail server at the wrong address for the signing service, so outgoing mail was sent unsigned - which sends mail to spam far more often - with nothing reported. Affected servers are repaired automatically on update.
  • Fix Node and Python apps are now told which port to listen on. They previously fell back to their own default, which only worked because the web server happened to use the same one. Slow-starting apps are also no longer mistaken for failed ones, which could leave a working site returning 502.
  • Security Blocked .git and .env from being served on deployed sites. A site deployed from Git could expose its full repository history, including any password or key ever committed to it.
  • Fix Two deployments of the same site running at once could permanently empty it. Deployments and rollbacks are now processed one at a time per site.
  • Feature Push-to-deploy now works. The Git Deploy page has always shown a webhook URL to paste into GitHub, but nothing was listening, so automatic deploys never happened. Every push to your branch now rebuilds the site.
  • Feature Deploy rollback. Restore the previous version of a site in one click, with no rebuild and no network needed. The version you replace is kept, so a rollback can itself be undone.
  • Feature Resource history and graphs. CPU, memory and disk are now recorded over time and charted from one hour to thirty days. Previously the panel only ever showed the current instant.
  • Fix The Anti-Spam and Security settings now say which options actually do something. SpamAssassin, SPF verification and Greylisting were switches that changed nothing, and ClamAV scans uploaded files rather than email attachments.
  • Fix Creating an account no longer fails with a misleading 'package limit reached (0/0)' when the database is briefly unavailable.
  • Fix Backups no longer include NovaPanel's own temporary build and rollback folders, which could double the size of an archive.

v1.6.7.9

  • Fix Background workers and Node/Python apps now survive a server reboot. NovaPanel never installed the startup service that brings them back, so after any reboot a customer's workers stayed stopped and their Node or Python site returned 502 until someone restarted it by hand - with nothing reported. Existing servers are repaired automatically on update, and the admin is told how many accounts were affected.
  • Fix The startup service is removed when an account is deleted, so servers no longer accumulate leftover services for accounts that no longer exist.

v1.6.7.8

  • Security Fixed FTP logins not actually being revoked. Removing the last FTP account - by deleting it or by suspending the account - left its credentials valid on the server, because the FTP password database was not rebuilt when the account list became empty. Those logins kept working. The database is now rebuilt correctly, and every server is repaired automatically on update, which revokes any FTP login that should already have been removed.
  • Security Suspending an account now also disconnects any FTP session that was already open, instead of only blocking new logins.
  • Feature New Create Account page. Provisions a hosting customer in one step - the account, its website, DNS zone and FTP login - and finishes with a summary of every credential and setting, with a Copy all button for the handover. The username fills in from the domain and the password can be generated for you. Adding a staff user from the Users page is unchanged.

v1.6.7.7

  • Security Fixed a repository address that could cause the server to run a command as root during deployment. Addresses are now validated when saved and again at deploy time, and the transport is restricted.
  • Security Fixed mail interception: one hosting account could redirect all inbound mail for a domain belonging to another account.
  • Security Fixed mailbox creation on a domain owned by another account, which could also damage the domain owner's SPF and DMARC records.
  • Security Fixed an FTP directory escape that transferred ownership of another account's files and served them over the wrong account's FTP login.
  • Security Fixed a site rename that could aim privileged file operations outside the account's own folder.
  • Security Fixed site and domain deletion being able to take another account's websites offline.
  • Security Fixed redirect injection onto a domain owned by another account.
  • Security Fixed visitor statistics being readable for any domain hosted on the server.
  • Security Fixed a PHP extension toggle that applied to every account on the server.
  • Security Fixed rare account and site name collisions that could run PHP as another account's system user or remove another account's database.
  • Security Fixed private keys and passwords being written to the panel log when certain file writes failed.
  • Security Fixed the FTP password file being readable by any local user. Permissions are corrected automatically on update.
  • Feature Suspending an account now takes the hosting offline: websites serve a suspended page, and mail logins, FTP logins, scheduled tasks and background processes stop. Unsuspending restores all of it. Previously suspension only blocked the control panel.
  • Feature Deleting an account now removes its databases, mail logins and FTP logins. Previously those kept working after the account was gone.
  • Fix Fixed Postfix refusing to deliver mail after saving the mail settings page. The page applied a maximum message size without raising the mailbox size limits to match, and its own default value already exceeded them. Affected servers are repaired automatically on update.
  • Fix The custom deploy command now runs after file ownership is set, so commands that write into the site directory work.
  • Fix Background workers and app processes are now stopped when a site or account is deleted, instead of being left running.
  • Fix The domains list no longer performs a slow lookup for every domain on each load.
  • Fix Custom certificates are removed from disk when their domain is deleted.
  • Fix Accounts already marked suspended are brought fully offline on the first start after this update. Reactivate any that should be live.
  • Fix Sites configured with a non standard repository address will report a validation error instead of deploying.
  • Fix Disabling a PHP extension is refused on servers with more than one account, because it applies to every site on that PHP version. Enabling is unchanged.

v1.6.7.6

  • Feature Developer tier: background workers. Run always-on processes for a site - a queue worker, a websocket server, a custom daemon - kept alive and restarted if they crash, with start/stop/restart and live logs. Cron handles scheduled jobs; this handles the always-on ones.
  • Feature Developer tier: custom deploy command. Set a command to run after each Git deploy - database migrations, a custom build step, a cache clear - executed as your site user once the build finishes.
  • Feature Developer tier: config import. Apply an exported site config (YAML) to another site to replicate its runtime, domains and security settings, with a preview of exactly what will change before anything is applied.
  • Feature Install your own SSL certificate for a domain - for example a free Cloudflare Origin certificate, or a paid/wildcard cert - instead of Let's Encrypt. The panel validates it, serves HTTPS from it, and stops auto-issuing.
  • Feature Cloudflare-proxied domains are now detected on the SSL and Domains pages, with a clear explanation of why Let's Encrypt can't be issued and how to fix it (install a Cloudflare Origin certificate, or set the record to DNS-only) - instead of retrying forever in the background.
  • Feature The panel's own hostname gets the same SSL tools: real certificate status, Cloudflare-proxy detection, and the option to install a custom certificate - useful when the panel is served behind Cloudflare.

v1.6.7.5

  • Fix Fixed disk-quota enforcement not taking effect from the admin panel. Because the panel runs in a security sandbox, it couldn't see the quota state on the server's real filesystem, so it kept showing 'advisory only' and never applied per-account limits (enabling over SSH worked, but the panel didn't). Enabling and enforcing quotas now works directly from Admin > Disk Quotas.

v1.6.7.4

  • Feature Developer tier: per-site environment variables. Set KEY=VALUE pairs (database passwords, API keys, APP_ENV) for a site in the panel and NovaPanel injects them into your app's runtime - no SSH or hand-editing config files. Scoped to your own site.
  • Feature Developer tier: application log viewer. Browse and tail your app's own log files (Laravel storage/logs, WordPress debug.log, and any .log in your site), separate from the web-server access and error logs.
  • Feature Developer tier: export a site's configuration as YAML - a version-control-friendly snapshot of its runtime, domains and security settings.
  • Feature Package disk quotas can now be enforced at the filesystem level, not just shown. Turn it on from Admin > Disk Quotas or with 'novapanel quota enable' over SSH; accounts with no package stay uncapped, and new installs enable it automatically where the filesystem supports it.
  • Fix Firewall: when a request is blocked you can now paste the request's log ID into 'Disable specific rules' and the panel resolves it to the exact rule that fired, instead of the ID silently failing to save. The Firewall events panel is still the one-click way to do it.
  • Fix Creating a user in the admin panel now applies the Role and Package you choose - previously both were ignored and every account was created as a plain user with no package. Staff-admin creation is also capped by your license's admin-user limit.

v1.6.7.3

  • Feature API tokens now work on the Pro and Developer plans - create personal access tokens to use the panel's REST API. Existing Pro and Developer licenses unlock this automatically on their next license refresh.
  • Fix Your license's staff-admin limit is now enforced consistently across the panel, and the admin usage counter no longer counts disabled accounts - so it won't show more admins than you actually have.

v1.6.7.2

  • Fix Installing the firewall engine from the panel no longer shows a false failure. It now runs in the background and the page shows progress, then confirms when it is installed - the download just took longer than the request timeout before.
  • Feature Alert emails are redesigned to match the NovaPanel dark theme, with the NovaPanel logo, so they look consistent and on-brand across email apps.

v1.6.7.1

  • Fix Fixed outbound mail not being DKIM-signed. Postfix couldn't reach the DKIM service because of a group-permission gap, so all outgoing mail went unsigned and was far more likely to hit spam. Every server repairs itself on this update, and new installs are correct from the start.
  • Fix Fixed the 'Install firewall engine' button and its automatic repair, which failed with a read-only-filesystem error because of the panel's security sandbox. Installing the WAF-enabled Caddy now works from the panel.
  • Feature Email alerts are now proper branded HTML messages with severity, an Open-panel button, and a plain-text fallback, plus a one-click Send-test button and a live deliverability check that shows whether SPF, DKIM, DMARC and reverse DNS are set up correctly.
  • Feature Alert emails can now use a custom From address and are rate-limited so a flapping service can't flood your inbox. Clear guidance is shown for sending correctly when your server is behind Cloudflare (dedicated mail hostname or an SMTP relay).

v1.6.7

  • Fix Fixed email forwarders, which never actually forwarded mail: Postfix was missing the alias configuration, so forwarder rules were saved but ignored. Forwarding now works, and existing servers repair themselves on this update with nothing to do.
  • Feature Catch-all addresses: choose where mail to any non-existent address at your domain should go, right next to your forwarders.
  • Feature Email notifications: get important alerts (updates available, disk full, SSL expiring, service down, security events) sent to your admin email. A Settings toggle turns it on and shows the exact DNS records to make the emails land in the inbox.
  • Feature Firewall events viewer: see exactly what the WAF blocked on each of your sites, with the rule IDs, and disable a rule that is blocking you with one click.
  • Feature Firewall engine self-repair: if a server was set up without the WAF module (the build service was briefly down at install), the panel now reinstalls it automatically, or you can do it with one click in admin Settings.
  • Feature Hotlink protection: stop other websites embedding your images and files to steal your bandwidth, with a per-site on/off and an allowed-sites list.
  • Feature Domain aliases can now 301-redirect to your main domain instead of serving duplicate content, which is better for SEO.
  • Security Warn when the only admin still uses the default password, so it never goes unnoticed.
  • Feature Expanded command-line tools over SSH: report, update, repair, service control, and full backup create/list/restore.

v1.6.6

  • Fix The WooCommerce / WordPress compatibility toggle now also lets logged-in admins save posts, products and widgets containing HTML or JavaScript without the firewall returning a 403. The public-facing site stays fully protected.
  • Fix PowerDNS now self-heals the port 53 conflict with systemd-resolved. If a reboot or automatic update let systemd-resolved reclaim port 53 and crash-loop DNS, the panel masks it and restarts PowerDNS automatically on startup.
  • Infra Installer: modern dynamic SSH login banner (MOTD) with live system stats, panel URLs and service health; plus Debian 13 fixes (jq, cron/service start) and systemd-resolved masking so PowerDNS keeps port 53.

v1.6.5.1

  • Fix Fixed false 'too many requests' errors when refreshing or moving quickly through the panel. The dashboard is no longer rate-limited; login stays protected against brute force.
  • Infra Installer reliability on Debian 13: fixed a crash from a missing jq dependency, a service start failure from a missing cron spool directory, and admin credentials falling back to the default when the panel was slow to start.

v1.6.5

  • Security Remove default admin backdoor: disable admin@novapanel.local automatically when another admin exists
  • Fix Panel HTTPS: bare hostname now opens the customer panel (fixes Cloudflare 521 after enabling HTTPS on an IP-only install)
  • Fix Server page no longer goes blank on servers set to a non-UTC timezone
  • Fix App-wide error boundary so a single bad value can no longer blank the whole panel
  • Feature Settings shows an HTTPS-active shield and pre-fills the admin email from install
  • Fix Higher dashboard rate limit and correct client IP behind Cloudflare (rate limiting and fail2ban)
  • Fix Enable HTTPS for the panel button now works (base Caddyfile ownership fix)
  • Infra License activation registers the operator email as a real customer
  • Infra Installer: Ubuntu 26.04 support (Dovecot 2.4 config, sury.org PHP repo, PostgreSQL 17, Node 22)

v1.6.4.1

  • Fix Fixed the 1.6.4 update so the new phpMyAdmin/webmail ports and the panel HTTP-by-IP ports are applied automatically on existing servers. An internal validation step was incorrectly reverting the change, so phpMyAdmin and Roundcube could stay unreachable after updating; they now migrate on the next update with no manual steps.

v1.6.4

  • Feature phpMyAdmin and Roundcube webmail now use Cloudflare-supported ports, so they open correctly when your panel domain is proxied through Cloudflare (the old ports were not proxied). The phpMyAdmin button also logs you straight into the selected database, with no separate login page.
  • Feature Each panel now has a matching HTTP port for access by IP. You can reach the panel over plain HTTP at http://your-ip:2082 (customer) or :2086 (admin) even without a domain, or before a certificate is ready, so you are never locked out.
  • Feature New Enable HTTPS for the panel button in Admin, Settings, General. Point a hostname at the server and the panel is served over HTTPS with a Let's Encrypt certificate issued automatically, so you can move an IP-only install onto a real domain without reinstalling.
  • Fix Database sizes on the Databases page now show the real on-disk size instead of always reading 0 MB.
  • Feature The panel now warns you if your server's mail or FTP hostname is proxied through Cloudflare (which only carries web traffic), so email and FTP delivery do not silently break.

v1.6.3

  • Feature New WooCommerce / WordPress compatibility toggle in the firewall. One switch excludes the exact security rules that mistakenly block add-to-cart and checkout on a WooCommerce store, so you can run the firewall in full Blocking mode without breaking your shop.
  • Feature You can now switch off individual firewall rules by ID, not just whole categories, so a single false positive can be cleared without weakening a whole class of protection.
  • Feature New per-site option to block xmlrpc.php, a common WordPress attack surface used for brute-force and pingback abuse. Blocking it hardens the site and cuts bot traffic.
  • Feature The SSL Certificates page now lists your subdomain certificates alongside your domains, and the Domains list shows a clear HTTPS badge once a certificate is active instead of a plain Issue-SSL link. Subdomains also show when they were added.
  • Feature Many more actions now appear in your notifications: security and account changes (firewall settings, two-factor, password and email changes, API tokens), WordPress and staging operations, and admin configuration changes. Failed offsite backups, scheduled backups, and WordPress auto-updates now alert you instead of failing silently.
  • Fix WordPress staging sites now get an SSL certificate automatically when created, so a new staging site loads over HTTPS right away instead of needing a manual step.

v1.6.2

  • Feature Subdomains can now get their own SSL certificate. A new 'Issue SSL' button on each subdomain provisions a free Let's Encrypt certificate, so subdomains serve over HTTPS instead of failing the SSL handshake.
  • Feature Install apps directly onto a subdomain. The App Installer now lets you pick a subdomain as the target, so you can run WordPress (or any app) on something like blog.example.com and it works out of the box on its own PHP pool.
  • Fix Subdomains now inherit their parent site's settings (PHP version, protected directories, error pages, maintenance mode) and are served correctly for every runtime, including static content for Node and Python sites.
  • Security Hardened subdomain creation so a subdomain can only ever be created on a domain you own.
  • Fix Backup storage totals are now accurate and clearer: the admin Backup Manager shows separate On server, Offsite, and Total figures instead of one number that mixed them, and the customer Backups page now shows the same storage summary.

v1.6.1

  • Feature Offsite backups can now skip keeping a copy on the server. A new 'keep a copy on this server' option (on both the admin and per-customer offsite settings) lets you store backups only at your offsite destination to save disk space. Backups still appear in the panel (tagged on-server / offsite / both) and restore and download normally. The local copy is only removed after the offsite upload is confirmed successful, so you are never left without a backup.
  • Fix The Resource Usage bandwidth bar on the customer dashboard is back, and now fills against your package's monthly bandwidth allowance (for example 6.1 / 100 GB) instead of always appearing full.

v1.6.0

  • Feature Two-factor recovery codes: single-use backup codes let you sign in if you lose your authenticator app. They are shown once during setup, and the login screen now has a 'use a recovery code' option.
  • Feature Edit email accounts: change a mailbox password or storage quota in place, without deleting and recreating it, so existing mail is preserved.
  • Feature Edit FTP accounts: change an FTP account's password without removing and recreating the account.
  • Feature Customer API tokens (Pro): create tokens to access the NovaPanel API programmatically. The secret is shown once and can be revoked anytime.
  • Feature Mailbox autoresponders: set a vacation auto-reply per mailbox, with optional start and end dates.
  • Feature WordPress staging: clone a WordPress site into a separate staging copy to test changes safely, then refresh or delete it. Your live site is never touched.
  • Fix Added confirmation prompts before destructive actions: deleting subdomains, redirects, FTP accounts, DNS records, mailboxes, forwarders and protected directories, importing over a database, and regenerating a deploy key.
  • Fix The web terminal no longer shows simulated command output when the live shell is unavailable; it now says so clearly.
  • Fix Fixed several dashboard display issues: the disk usage details panel, the bandwidth meter, and the metrics page.
  • Security Background jobs now recover from unexpected errors instead of being able to take the panel down, and raise an alert if a job keeps failing.
  • Security Admins are now alerted on unusual failed-login activity and when offsite backups start failing.

v1.5.4

  • Feature Tunable Web Application Firewall
  • Fix Backup downloads now stream reliably in every browser

v1.5.3

  • Fix Fixed offsite backups (Amazon S3, Backblaze B2, Wasabi, and other S3-compatible storage) silently failing to upload for accounts with larger backups. Any backup big enough to need a multipart upload was never reaching your remote storage, even though it was created correctly on the server. All backups now upload offsite reliably regardless of size.

v1.5.2

  • Fix Fixed www redirects (and other Caddy changes) failing on servers where a redirect had been pasted into the Caddy config by hand before this feature existed. The duplicate quietly blocked every reload, so redirects worked on one site but failed on the rest. The panel now detects and clears that conflict automatically on startup, and no single site can jam the others.
  • Fix Fixed scheduled and manual backups creating a tiny empty archive for accounts that have no websites or databases (such as the admin account). These accounts are now correctly reported as skipped instead of showing a 0 MB or failed backup.

v1.5.1

  • Feature WordPress Manager: a new 'Update all' button updates core, plugins, and themes in one click. Updates now also get more time to finish on sites with many plugins, and no longer stop halfway if you close the tab.
  • Feature WordPress Manager: turn on nightly automatic updates per site and choose whether to auto-update core, plugins, themes, or any combination. Set it once and leave it.
  • Fix Fixed applying a www to non-www (or non-www to www) redirect across several sites at once, where the first site worked but the others failed. All sites now apply correctly, and one problem site no longer blocks the rest.

v1.5.0

  • Feature File Manager gains multi-select delete, sortable columns (name, size, date modified), and a built-in text editor so you can edit files directly in the panel without downloading them.
  • Feature New Server Info card on the customer dashboard shows your server IP, hostname, OS, uptime, installed PHP versions, and a simple health indicator.
  • Feature Per-customer offsite backups (Pro): send your backups to your own Amazon S3, Backblaze B2, Wasabi, MinIO, or SFTP destination on your own daily schedule, with a Test Connection button.
  • Feature WWW redirect: enable a www to non-www (or non-www to www) canonical redirect per domain from the Domains page, applied automatically with no Cloudflare required.
  • Fix Fixed File Manager uploads failing with 'no files in upload' when choosing a file; uploads now work reliably.
  • Fix Fixed a false 'Backup failed' notification that appeared even when the backup had actually completed successfully.

v1.4.8

  • Fix Fixed WordPress pretty permalinks returning 404 on sites created with the WordPress Optimized template. Post-name links such as /sample-post/ now work, and affected sites are repaired automatically on update with no action needed.
  • Fix Fixed creating a site with the WordPress Optimized template (or any PHP template) failing when the runtime was left on its default. The template's runtime is now applied automatically, so PHP sites always get their own dedicated PHP pool and work on the first try.
  • Fix Fixed the web server restart reporting a 'restart failed' error even when it restarted successfully. The panel now confirms the service is running before reporting a problem.
  • Fix Fixed the WordPress Manager page hanging on accounts with several WordPress sites. The list now loads quickly and a single broken install no longer freezes the whole page.
  • Fix Fixed SSL certificate reissue showing false 'network error' and 'failed to start' messages even though the certificate was issued successfully. Reissue now reports its status cleanly.
  • Fix Fixed the File Manager action menu opening off-screen for the last items in a folder. It now opens upward when near the bottom so every option stays reachable.

v1.4.7

  • Fix Fixed multi-site accounts hosting more than one site with a built-in template. Creating a 2nd or later site with WordPress Optimized, Laravel, Nextcloud, or any other built-in template previously made it serve the first site's content. Each site now correctly serves its own folder, and sites already affected are repaired automatically on update with no action needed.
  • Fix The App Installer now works reliably on every site: it creates the site's folder if it was missing, installs into the site you actually selected, and always shows a log when something fails (a failed install could previously show nothing at all).
  • Fix Login as (admin impersonation) now opens the customer panel on the correct public port instead of the internal one.

v1.4.6

  • Fix Fixed the App Installer installing into the wrong site on accounts that host more than one site. Installing any app (WordPress, Laravel, Joomla, Nextcloud, and the rest) on a second or later site previously wrote the files into the first site's folder, so the app never showed up and the new site served nothing. Every install now targets the site you actually selected.

v1.4.5

  • Fix Fixed a 502 Bad Gateway error on WordPress and other PHP sites created from a built-in template. Several templates pointed the web server at the wrong PHP-FPM socket, so requests failed even though PHP itself was healthy. Every built-in template (WordPress, Laravel, and the rest) now uses the correct per-site socket, so new sites work out of the box.
  • Fix Sites already affected by the socket issue repair themselves automatically on update. There is no need to recreate the site, re-issue SSL, or change any settings.

v1.4.4

  • Fix Fixed an issue where a newly created hosting account could end up with no system user on the server, blocking site creation with a confusing error
  • Fix Account usernames now follow one consistent rule everywhere, so an account can no longer be created with a name the server later rejects
  • Fix Creating a site now automatically repairs an account whose system user was missing, instead of dead-ending with an error
  • Fix If a system user cannot be set up when an account is created, the admin now sees a clear warning instead of a false success
Want to follow along live? Drop into our Discord — release notes also land there the moment they ship, plus you can ask questions and trade hosting tips with other operators.