NovaPanel
Features Pricing Alternatives Docs Changelog Customer portal Discord GitHub
Get Pro

Changelog

Every panel release in chronological order. Updates land continuously — your panel picks them up on its next heartbeat. This page auto-refreshes from the release server, so you'll see new entries the moment they ship.

v1.6.7.3

  • Feature API tokens now work on the Pro and Developer plans - create personal access tokens to use the panel's REST API. Existing Pro and Developer licenses unlock this automatically on their next license refresh.
  • Fix Your license's staff-admin limit is now enforced consistently across the panel, and the admin usage counter no longer counts disabled accounts - so it won't show more admins than you actually have.

v1.6.7.2

  • Fix Installing the firewall engine from the panel no longer shows a false failure. It now runs in the background and the page shows progress, then confirms when it is installed - the download just took longer than the request timeout before.
  • Feature Alert emails are redesigned to match the NovaPanel dark theme, with the NovaPanel logo, so they look consistent and on-brand across email apps.

v1.6.7.1

  • Fix Fixed outbound mail not being DKIM-signed. Postfix couldn't reach the DKIM service because of a group-permission gap, so all outgoing mail went unsigned and was far more likely to hit spam. Every server repairs itself on this update, and new installs are correct from the start.
  • Fix Fixed the 'Install firewall engine' button and its automatic repair, which failed with a read-only-filesystem error because of the panel's security sandbox. Installing the WAF-enabled Caddy now works from the panel.
  • Feature Email alerts are now proper branded HTML messages with severity, an Open-panel button, and a plain-text fallback, plus a one-click Send-test button and a live deliverability check that shows whether SPF, DKIM, DMARC and reverse DNS are set up correctly.
  • Feature Alert emails can now use a custom From address and are rate-limited so a flapping service can't flood your inbox. Clear guidance is shown for sending correctly when your server is behind Cloudflare (dedicated mail hostname or an SMTP relay).

v1.6.7

  • Fix Fixed email forwarders, which never actually forwarded mail: Postfix was missing the alias configuration, so forwarder rules were saved but ignored. Forwarding now works, and existing servers repair themselves on this update with nothing to do.
  • Feature Catch-all addresses: choose where mail to any non-existent address at your domain should go, right next to your forwarders.
  • Feature Email notifications: get important alerts (updates available, disk full, SSL expiring, service down, security events) sent to your admin email. A Settings toggle turns it on and shows the exact DNS records to make the emails land in the inbox.
  • Feature Firewall events viewer: see exactly what the WAF blocked on each of your sites, with the rule IDs, and disable a rule that is blocking you with one click.
  • Feature Firewall engine self-repair: if a server was set up without the WAF module (the build service was briefly down at install), the panel now reinstalls it automatically, or you can do it with one click in admin Settings.
  • Feature Hotlink protection: stop other websites embedding your images and files to steal your bandwidth, with a per-site on/off and an allowed-sites list.
  • Feature Domain aliases can now 301-redirect to your main domain instead of serving duplicate content, which is better for SEO.
  • Security Warn when the only admin still uses the default password, so it never goes unnoticed.
  • Feature Expanded command-line tools over SSH: report, update, repair, service control, and full backup create/list/restore.

v1.6.6

  • Fix The WooCommerce / WordPress compatibility toggle now also lets logged-in admins save posts, products and widgets containing HTML or JavaScript without the firewall returning a 403. The public-facing site stays fully protected.
  • Fix PowerDNS now self-heals the port 53 conflict with systemd-resolved. If a reboot or automatic update let systemd-resolved reclaim port 53 and crash-loop DNS, the panel masks it and restarts PowerDNS automatically on startup.
  • Infra Installer: modern dynamic SSH login banner (MOTD) with live system stats, panel URLs and service health; plus Debian 13 fixes (jq, cron/service start) and systemd-resolved masking so PowerDNS keeps port 53.

v1.6.5.1

  • Fix Fixed false 'too many requests' errors when refreshing or moving quickly through the panel. The dashboard is no longer rate-limited; login stays protected against brute force.
  • Infra Installer reliability on Debian 13: fixed a crash from a missing jq dependency, a service start failure from a missing cron spool directory, and admin credentials falling back to the default when the panel was slow to start.

v1.6.5

  • Security Remove default admin backdoor: disable admin@novapanel.local automatically when another admin exists
  • Fix Panel HTTPS: bare hostname now opens the customer panel (fixes Cloudflare 521 after enabling HTTPS on an IP-only install)
  • Fix Server page no longer goes blank on servers set to a non-UTC timezone
  • Fix App-wide error boundary so a single bad value can no longer blank the whole panel
  • Feature Settings shows an HTTPS-active shield and pre-fills the admin email from install
  • Fix Higher dashboard rate limit and correct client IP behind Cloudflare (rate limiting and fail2ban)
  • Fix Enable HTTPS for the panel button now works (base Caddyfile ownership fix)
  • Infra License activation registers the operator email as a real customer
  • Infra Installer: Ubuntu 26.04 support (Dovecot 2.4 config, sury.org PHP repo, PostgreSQL 17, Node 22)

v1.6.4.1

  • Fix Fixed the 1.6.4 update so the new phpMyAdmin/webmail ports and the panel HTTP-by-IP ports are applied automatically on existing servers. An internal validation step was incorrectly reverting the change, so phpMyAdmin and Roundcube could stay unreachable after updating; they now migrate on the next update with no manual steps.

v1.6.4

  • Feature phpMyAdmin and Roundcube webmail now use Cloudflare-supported ports, so they open correctly when your panel domain is proxied through Cloudflare (the old ports were not proxied). The phpMyAdmin button also logs you straight into the selected database, with no separate login page.
  • Feature Each panel now has a matching HTTP port for access by IP. You can reach the panel over plain HTTP at http://your-ip:2082 (customer) or :2086 (admin) even without a domain, or before a certificate is ready, so you are never locked out.
  • Feature New Enable HTTPS for the panel button in Admin, Settings, General. Point a hostname at the server and the panel is served over HTTPS with a Let's Encrypt certificate issued automatically, so you can move an IP-only install onto a real domain without reinstalling.
  • Fix Database sizes on the Databases page now show the real on-disk size instead of always reading 0 MB.
  • Feature The panel now warns you if your server's mail or FTP hostname is proxied through Cloudflare (which only carries web traffic), so email and FTP delivery do not silently break.

v1.6.3

  • Feature New WooCommerce / WordPress compatibility toggle in the firewall. One switch excludes the exact security rules that mistakenly block add-to-cart and checkout on a WooCommerce store, so you can run the firewall in full Blocking mode without breaking your shop.
  • Feature You can now switch off individual firewall rules by ID, not just whole categories, so a single false positive can be cleared without weakening a whole class of protection.
  • Feature New per-site option to block xmlrpc.php, a common WordPress attack surface used for brute-force and pingback abuse. Blocking it hardens the site and cuts bot traffic.
  • Feature The SSL Certificates page now lists your subdomain certificates alongside your domains, and the Domains list shows a clear HTTPS badge once a certificate is active instead of a plain Issue-SSL link. Subdomains also show when they were added.
  • Feature Many more actions now appear in your notifications: security and account changes (firewall settings, two-factor, password and email changes, API tokens), WordPress and staging operations, and admin configuration changes. Failed offsite backups, scheduled backups, and WordPress auto-updates now alert you instead of failing silently.
  • Fix WordPress staging sites now get an SSL certificate automatically when created, so a new staging site loads over HTTPS right away instead of needing a manual step.

v1.6.2

  • Feature Subdomains can now get their own SSL certificate. A new 'Issue SSL' button on each subdomain provisions a free Let's Encrypt certificate, so subdomains serve over HTTPS instead of failing the SSL handshake.
  • Feature Install apps directly onto a subdomain. The App Installer now lets you pick a subdomain as the target, so you can run WordPress (or any app) on something like blog.example.com and it works out of the box on its own PHP pool.
  • Fix Subdomains now inherit their parent site's settings (PHP version, protected directories, error pages, maintenance mode) and are served correctly for every runtime, including static content for Node and Python sites.
  • Security Hardened subdomain creation so a subdomain can only ever be created on a domain you own.
  • Fix Backup storage totals are now accurate and clearer: the admin Backup Manager shows separate On server, Offsite, and Total figures instead of one number that mixed them, and the customer Backups page now shows the same storage summary.

v1.6.1

  • Feature Offsite backups can now skip keeping a copy on the server. A new 'keep a copy on this server' option (on both the admin and per-customer offsite settings) lets you store backups only at your offsite destination to save disk space. Backups still appear in the panel (tagged on-server / offsite / both) and restore and download normally. The local copy is only removed after the offsite upload is confirmed successful, so you are never left without a backup.
  • Fix The Resource Usage bandwidth bar on the customer dashboard is back, and now fills against your package's monthly bandwidth allowance (for example 6.1 / 100 GB) instead of always appearing full.

v1.6.0

  • Feature Two-factor recovery codes: single-use backup codes let you sign in if you lose your authenticator app. They are shown once during setup, and the login screen now has a 'use a recovery code' option.
  • Feature Edit email accounts: change a mailbox password or storage quota in place, without deleting and recreating it, so existing mail is preserved.
  • Feature Edit FTP accounts: change an FTP account's password without removing and recreating the account.
  • Feature Customer API tokens (Pro): create tokens to access the NovaPanel API programmatically. The secret is shown once and can be revoked anytime.
  • Feature Mailbox autoresponders: set a vacation auto-reply per mailbox, with optional start and end dates.
  • Feature WordPress staging: clone a WordPress site into a separate staging copy to test changes safely, then refresh or delete it. Your live site is never touched.
  • Fix Added confirmation prompts before destructive actions: deleting subdomains, redirects, FTP accounts, DNS records, mailboxes, forwarders and protected directories, importing over a database, and regenerating a deploy key.
  • Fix The web terminal no longer shows simulated command output when the live shell is unavailable; it now says so clearly.
  • Fix Fixed several dashboard display issues: the disk usage details panel, the bandwidth meter, and the metrics page.
  • Security Background jobs now recover from unexpected errors instead of being able to take the panel down, and raise an alert if a job keeps failing.
  • Security Admins are now alerted on unusual failed-login activity and when offsite backups start failing.

v1.5.4

  • Feature Tunable Web Application Firewall
  • Fix Backup downloads now stream reliably in every browser

v1.5.3

  • Fix Fixed offsite backups (Amazon S3, Backblaze B2, Wasabi, and other S3-compatible storage) silently failing to upload for accounts with larger backups. Any backup big enough to need a multipart upload was never reaching your remote storage, even though it was created correctly on the server. All backups now upload offsite reliably regardless of size.

v1.5.2

  • Fix Fixed www redirects (and other Caddy changes) failing on servers where a redirect had been pasted into the Caddy config by hand before this feature existed. The duplicate quietly blocked every reload, so redirects worked on one site but failed on the rest. The panel now detects and clears that conflict automatically on startup, and no single site can jam the others.
  • Fix Fixed scheduled and manual backups creating a tiny empty archive for accounts that have no websites or databases (such as the admin account). These accounts are now correctly reported as skipped instead of showing a 0 MB or failed backup.

v1.5.1

  • Feature WordPress Manager: a new 'Update all' button updates core, plugins, and themes in one click. Updates now also get more time to finish on sites with many plugins, and no longer stop halfway if you close the tab.
  • Feature WordPress Manager: turn on nightly automatic updates per site and choose whether to auto-update core, plugins, themes, or any combination. Set it once and leave it.
  • Fix Fixed applying a www to non-www (or non-www to www) redirect across several sites at once, where the first site worked but the others failed. All sites now apply correctly, and one problem site no longer blocks the rest.

v1.5.0

  • Feature File Manager gains multi-select delete, sortable columns (name, size, date modified), and a built-in text editor so you can edit files directly in the panel without downloading them.
  • Feature New Server Info card on the customer dashboard shows your server IP, hostname, OS, uptime, installed PHP versions, and a simple health indicator.
  • Feature Per-customer offsite backups (Pro): send your backups to your own Amazon S3, Backblaze B2, Wasabi, MinIO, or SFTP destination on your own daily schedule, with a Test Connection button.
  • Feature WWW redirect: enable a www to non-www (or non-www to www) canonical redirect per domain from the Domains page, applied automatically with no Cloudflare required.
  • Fix Fixed File Manager uploads failing with 'no files in upload' when choosing a file; uploads now work reliably.
  • Fix Fixed a false 'Backup failed' notification that appeared even when the backup had actually completed successfully.

v1.4.8

  • Fix Fixed WordPress pretty permalinks returning 404 on sites created with the WordPress Optimized template. Post-name links such as /sample-post/ now work, and affected sites are repaired automatically on update with no action needed.
  • Fix Fixed creating a site with the WordPress Optimized template (or any PHP template) failing when the runtime was left on its default. The template's runtime is now applied automatically, so PHP sites always get their own dedicated PHP pool and work on the first try.
  • Fix Fixed the web server restart reporting a 'restart failed' error even when it restarted successfully. The panel now confirms the service is running before reporting a problem.
  • Fix Fixed the WordPress Manager page hanging on accounts with several WordPress sites. The list now loads quickly and a single broken install no longer freezes the whole page.
  • Fix Fixed SSL certificate reissue showing false 'network error' and 'failed to start' messages even though the certificate was issued successfully. Reissue now reports its status cleanly.
  • Fix Fixed the File Manager action menu opening off-screen for the last items in a folder. It now opens upward when near the bottom so every option stays reachable.

v1.4.7

  • Fix Fixed multi-site accounts hosting more than one site with a built-in template. Creating a 2nd or later site with WordPress Optimized, Laravel, Nextcloud, or any other built-in template previously made it serve the first site's content. Each site now correctly serves its own folder, and sites already affected are repaired automatically on update with no action needed.
  • Fix The App Installer now works reliably on every site: it creates the site's folder if it was missing, installs into the site you actually selected, and always shows a log when something fails (a failed install could previously show nothing at all).
  • Fix Login as (admin impersonation) now opens the customer panel on the correct public port instead of the internal one.

v1.4.6

  • Fix Fixed the App Installer installing into the wrong site on accounts that host more than one site. Installing any app (WordPress, Laravel, Joomla, Nextcloud, and the rest) on a second or later site previously wrote the files into the first site's folder, so the app never showed up and the new site served nothing. Every install now targets the site you actually selected.

v1.4.5

  • Fix Fixed a 502 Bad Gateway error on WordPress and other PHP sites created from a built-in template. Several templates pointed the web server at the wrong PHP-FPM socket, so requests failed even though PHP itself was healthy. Every built-in template (WordPress, Laravel, and the rest) now uses the correct per-site socket, so new sites work out of the box.
  • Fix Sites already affected by the socket issue repair themselves automatically on update. There is no need to recreate the site, re-issue SSL, or change any settings.

v1.4.4

  • Fix Fixed an issue where a newly created hosting account could end up with no system user on the server, blocking site creation with a confusing error
  • Fix Account usernames now follow one consistent rule everywhere, so an account can no longer be created with a name the server later rejects
  • Fix Creating a site now automatically repairs an account whose system user was missing, instead of dead-ending with an error
  • Fix If a system user cannot be set up when an account is created, the admin now sees a clear warning instead of a false success

v1.4.3

  • Security Hardened session handling and account-suspension enforcement
  • Fix Sessions no longer time out unexpectedly - expired logins now refresh silently in both the admin and customer panels
  • Fix PHP now self-heals: a single misconfigured site pool can no longer stop PHP from starting for every site on the server
  • Fix Account usernames are protected from changes that would break a site's files, system user, and PHP pools
  • Fix Clearer deploy feedback: deploying a site with no Git repository now explains what to do instead of failing quietly
  • Feature The admin header now shows the server's hostname and primary IP, and the hostname appears in the browser tab
  • Infra Installer: Debian 11 and 12 compatibility fixes for fail2ban and brute-force protection

v1.4.2

  • Fix DNS records with the same name and type now coexist instead of overwriting each other. Adding a second NS (or a second A/MX/TXT) at the same name previously replaced the first, and deleting one removed all of them — caused by writing the whole record set on every change. Record edits and deletes are now per-record: adding merges, editing changes just that record, and deleting keeps the siblings.

v1.4.1

  • Fix Maintenance mode is now a proper per-site toggle (Site → Settings) that serves a clean 503 page and overrides everything — and, crucially, can be turned off again. Previously it was a sticky web template with no off-switch, which could leave a site stuck until its Caddy file was hand-edited. Site Settings also gains a web-template picker whose 'Auto' option recovers a site stuck on any template.
  • Fix Activity log now shows the site name for 'Updated site' and 'Deployed site' entries instead of the raw site UUID.
  • Feature Domains can now be edited: the Domains overview shows each domain's linked site, and a new edit dialog reassigns a domain to another of your sites and changes its type (primary/alias/subdomain) — the web-server config is rebuilt automatically on reassignment.

v1.4.0

  • Feature Offsite backups: copy every backup off the server automatically to S3, Backblaze B2, Wasabi/MinIO (S3-compatible) or any SFTP host. Applies to admin, customer, and scheduled backups; restores transparently pull from the remote if the local copy was pruned. Configure under Backup Manager → Offsite Destination with a one-click connection test. (Pro)
  • Feature Server Health Score: a single at-a-glance 0–100 score on the dashboard, computed from disk, memory, core services, SSL coverage, scheduled + offsite backups, and pending updates — with a per-signal breakdown so you see exactly what needs attention.
  • Feature Monitoring & alerting: configurable disk / memory / CPU thresholds that raise an in-panel notification and fire a new server.alert outbound webhook when exceeded (great for Slack/Discord/PagerDuty). Free tier alerts at sensible defaults; custom thresholds are Pro.
  • Feature Edit everything — no more delete-and-recreate. DNS records are now editable in place (admin + customer), and sites have a full settings editor: document root (e.g. Laravel's public/), PHP version, runtime, and git repo/branch — all applied live with an automatic web-server config rebuild.

v1.3.0

  • Fix DKIM and DMARC now actually work. Enabling DKIM previously only started the opendkim service — it never generated signing keys, wired opendkim, or published the public records, so outbound mail still failed DKIM/DMARC at the receiver. Creating a mailbox now generates the 2048-bit key, configures opendkim to sign for the domain, and publishes correctly-quoted SPF, DKIM (selector "nova"), and DMARC records into PowerDNS. A "Republish mail DNS" button on the Mail Server page backfills every existing mail domain, and the DMARC policy (none/quarantine/reject) is now configurable.
  • Feature Email Deliverability page (admin): pick a mail domain and run live checks for SPF, DKIM, DMARC, reverse DNS (PTR), and the major blocklists (Spamhaus, SpamCop, Barracuda) against real public DNS — what receivers actually see, not what the panel intended to publish.
  • Feature Zone transfers (AXFR): allow secondary nameservers to pull a zone. Admin → DNS Zones → zone → Zone Transfers sets PowerDNS's ALLOW-AXFR-FROM + ALSO-NOTIFY. Transfers are deny-by-default; only literal IPs/CIDRs are accepted and "allow everything" ranges (0.0.0.0/0, ::/0) are rejected, so a zone is never accidentally exposed to the whole internet.
  • Feature Secondary DNS / hidden-master: a global secondary-nameserver list on the Nameservers page is pushed to every zone's transfer config and applied automatically to any zone created afterwards — run NovaPanel as a hidden master with external secondaries (e.g. Hurricane Electric) handling public queries.
  • Feature Wildcard SSL via DNS-01: because the panel runs its own DNS, it can now issue *.domain certificates. Click Wildcard on the customer SSL page and Caddy solves the ACME DNS-01 challenge against PowerDNS.
  • Infra Wildcard SSL needs Caddy's PowerDNS module. New installs include it automatically. Servers upgraded from an earlier version self-update only the panel binary, so they won't have the module yet — re-run the installer once to rebuild Caddy: curl -fsSL https://license.novapanel.dev/install.sh | sudo bash (safe to re-run; verify with `caddy list-modules | grep powerdns`). Until then the Wildcard button fails cleanly and single-host certs are unaffected.

v1.2.3

  • Fix DNS zones now get a correct SOA record. The primary master (MNAME) is set from your configured primary nameserver instead of PowerDNS's unresolvable "a.misconfigured.dns.server.invalid" placeholder, which a stock pdns.conf stamps onto every new zone. Existing zones still showing the placeholder are repaired automatically on upgrade and whenever you save the Nameservers page — an operator-set primary master is never overwritten.

v1.2.2

  • Fix Reject reserved usernames (user, users, root, admin, �) at account creation. Invalid names previously created an orphan panel row with no matching Linux user, then every sudo -u action (App Installer, Terminal, File Manager, FTP, cron, PHP pools) failed with "unknown user". Validation now runs in Register and surfaces the real error to the admin.
  • Fix WordPress Manager now detects installs that have been staged by the App Installer but not yet configured � shows them with an amber "Setup pending" badge and a one-click link to /wp-admin/install.php instead of saying "no sites detected".
  • Infra New how-to: running NovaPanel behind a Cloudflare Tunnel for homelab deployments � what works (panel UI + customer sites with caveats), what doesn�t (mail, FTP, auth-DNS), and the two SSL workarounds for customer websites.

v1.2.1

  • Feature File Manager: upload, download, compress (.zip/.tar.gz/.tar), extract, move, and chmod � per-row action menu plus multi-select "compress selected". Uploads stream through sudo tee so multi-GB transfers stay flat on memory
  • Fix PHP version install no longer fails with debconf TTY errors � apt-get now runs through systemd-run with DEBIAN_FRONTEND=noninteractive so dpkg-preconfigure can configure packages without a controlling terminal
  • Fix Session timeout (and other ops fields like admin email + notification toggles) save correctly on Community tier � they were incorrectly gated behind the whitelabel feature alongside true branding fields

v1.2.0

  • Feature Outbound webhooks: HMAC-signed event POSTs (user.created, site.deployed, domain.added, php.installed, …) with admin UI, test pings, and a 5s-refreshing delivery log
  • Feature Whitelabel layout editor: reorder, hide, or rename any sidebar section/item; add your own external links (billing, monitoring, support) with icon + target section
  • Feature Admin → user impersonation: one-click "Login as" opens the customer panel in a new tab via short-lived signed tokens, audit-logged on every use
  • Feature Clients Overview admin page: per-account rollup of sites, domains, PHP versions in use, disk vs quota — with inline Login as
  • Feature Session timeout: admin-configurable presets from 15 minutes through Never (with confirm gate)
  • Feature Visual distinction between admin and user panels: amber accent stripe + role pill in the header
  • Fix PHP Manager: every supported version visible in the grid, install errors captured and displayed inline with retry, view service log for stopped FPM units
  • Fix Customer Deployments page now links to the per-deployment log
  • Fix Modals are scrollable on small screens — Add Site dialog reachable on a 13" MacBook again
  • Fix Dashboard memory: use MemAvailable instead of Free+Buffers+Cached

v1.1.14

  • Fix Dashboard memory uses MemAvailable from /proc/meminfo, matching what free(1) and htop report instead of under-counting cache as free.

v1.1.13

  • Feature License page Subscription and billing card reads the actual provider - Stripe customers see Stripe wording, PayPal customers see PayPal wording. Card hides entirely for hand-issued comp licenses.
  • Fix Update notifications: routine package upgrades fire their own notification independently of security patches.

v1.1.12

  • Fix License-renewal warnings read the real license expiry instead of the JWT TTL - no more daily 'due tomorrow' toasts on lifetime or hand-issued comp licenses.

v1.1.11

  • Feature License page shows an Included-with-this-license section listing every feature your tier unlocks, with friendly labels and icons. Driven by tier_configs so admin edits propagate without a panel release.
  • Fix Server-wide Usage caps render correctly for all tiers - no more empty slash for unlimited limits.

v1.1.10

  • Fix License page Expires field shows the real subscription renewal date (or Never for lifetime licenses) instead of the rolling 24h JWT refresh window.

v1.1.9

  • Security JWT TTL reduced from 30 days to 24 hours; panels drop to Community within minutes of a binding reset on the license server. Closes the rolling-reset abuse window.
  • Feature Admin Refund and suspend now works for PayPal customers too (previously Stripe-only).

v1.1.8

  • Infra Production hardening across the license server: CSRF on the admin SPA, metrics endpoint for Prometheus, audit-log retention sweep.
Want to follow along live? Drop into our Discord — release notes also land there the moment they ship, plus you can ask questions and trade hosting tips with other operators.