Features

Everything NovaPanel does

The honest list. What's bundled in Community, what's locked behind Pro, and how each piece is actually implemented underneath. If something's missing it's because we haven't built it yet — call it out in Discord and it might land on the roadmap.

Sites & domains

Caddy 2 reverse proxy with auto-TLS for every hostname

Add a domain → Caddy provisions a Let's Encrypt cert within seconds. No config files, no certbot cron jobs.
Per-site PHP-FPM pools — each site gets isolated memory limits, time limits, opcache settings.
Custom error pages per site (404 / 500 / etc) editable from the UI.
Per-site access + error log tail in the browser. No SSH-and-grep dance.

One-click apps

~30 applications installed onto any site in a single click

WordPress, Ghost, Joomla, Drupal, Laravel, Next.js, Django, Rails, Nextcloud, Magento, PrestaShop, Matomo, n8n, Moodle — and roughly twenty more — installed straight onto a site.
Framework apps get the right document root automatically (Laravel / Shopware / Bagisto serve from public/).
Installs land in that specific site's own docroot, so you can run a different app on every site you host.
Every install captures a log you can read if something fails; uninstall cleans the files back to a welcome page and leaves your database untouched.

WordPress Manager

Update and auto-update every WordPress site from one place — free on every tier

Update core, plugins, and themes individually or all at once; partial failures are reported per target, not swallowed.
Updates run detached with a 15-minute budget, so they finish on plugin-heavy sites even if you close the tab.
Nightly automatic updates per site — pick core, plugins, themes, or any combination; runs once a night at 4am server time, at most once a day.
Flush cache, toggle maintenance mode, and jump straight into wp-admin without hunting for the login URL.

Databases

PostgreSQL 16 + MariaDB, both first-class

Per-customer database isolation: each customer gets their own postgres roles + databases, no cross-tenant access.
phpMyAdmin bundled, available per-customer.
One-click logical backups (mysqldump / pg_dump) → optional remote upload (S3 / Backblaze B2).
Import / export from the UI — drag a .sql file, restore in place.

Mail server (Pro)

Postfix + Dovecot + DKIM + Roundcube webmail

SPF / DKIM / DMARC records auto-generated for every domain — copy-paste into your DNS.
Per-domain catch-all routing, alias management, autoresponders, vacation messages.
Sieve filtering for inbox rules without leaving the panel.
Spam scoring via SpamAssassin; ClamAV scanning on inbound (Pro tier).
Outbound SMTP relay support — point at SES / Postmark / Mailgun if your VPS has port 25 blocked (most do).

DNS

PowerDNS authoritative, optional DNSSEC

Manage A / AAAA / MX / TXT / SRV / CNAME records per domain in the UI.
DNSSEC toggle per zone — keys generated and rotated for you.
Slave / master modes: run NovaPanel as your authoritative or as a hidden master behind a public secondary.
API-driven for automation — every UI action has a corresponding REST endpoint.

File manager + terminal

Browser-based file ops, no SSH needed for most tasks

Multi-file upload, an in-panel text editor (2 MB guard, refuses binaries), chmod permissions grid, and compress / extract archives (.zip, .tar.gz).
Sortable columns (name / size / modified), multi-select with batch delete and compress, rename, and move without silent overwrite.
In-browser shell — full xterm.js terminal scoped to the customer's home directory (or full root for admin).
Integrates with the file manager: select files → 'open in terminal here' jumps you to that path.

Backups

Local + remote, scheduled or on-demand

Per-site, per-database, or full-account backup targets.
Local destinations work in Community; offsite S3 / Backblaze B2 / Wasabi / MinIO / SFTP destinations are Pro-only.
Per-customer offsite: each hosting customer can point their own backups at their own remote storage, on their own schedule — not just one server-wide destination.
Streamed signed download links — pull any backup straight from the browser without exposing your session token, and multi-gigabyte archives download without choking.
Schedules with retention policies, and offsite uploads use multipart so archives larger than 5 GB upload reliably.
One-click restore — pick a snapshot, confirm, the panel handles the database drop / re-create / file-overwrite. Restores transparently pull from the offsite copy if the local one has been pruned.

WAF (Pro)

OWASP Core Rule Set enforced in Caddy via Coraza — no extra proxy hop

Three modes per site: Off, Detection-only (inspect + log, never block), and Blocking (403 on match).
Detection-only is the WooCommerce-safe answer — run it on a live store to see exactly which rules fire on real orders before you ever block anything, so add-to-cart never 403s by surprise.
Per-category toggles — SQL injection, XSS, RCE, remote/local file inclusion, scanner detection, protocol enforcement, session fixation. Switch off just the class that false-positives on your app and keep the rest protecting you.
Blocked requests return 403 and are logged with the exact CRS rule ID that fired, so tuning is a two-minute job, not guesswork.

Virus scanner (Pro)

ClamAV with on-upload + scheduled sweeps

Inbound mail attachments scanned at MTA time.
On-upload scanning for FTP and webmail attachments.
Scheduled full-server sweeps with quarantine-on-detection.
ClamAV signature database auto-updates daily.

Git deploy (Pro)

Push-to-deploy via webhook + SSH deploy keys

Connect a GitHub / GitLab / Gitea / Bitbucket repo to a site.
Generated deploy SSH key (read-only) you paste into the repo's settings.
Webhook URL the panel listens on — push to your branch, the panel pulls + runs your post-deploy script.
Per-site deploy log so you can see exactly what ran.

White-label branding (Pro)

Make the customer panel look like yours

Custom logo, favicon, primary colour, accent colour.
Custom login-page copy and support email — your customers see your brand, not ours.
Custom outbound-email From address for password resets, account notifications.
Customer-facing URL stays on YOUR domain — no NovaPanel subdomain leakage.

Admin & ops

What the operator sees on port 2087

Customer accounts with packages: hardcoded site / DB / disk / bandwidth quotas per package.
License management — apply Pro keys, view fingerprint, manage subscription via Stripe / PayPal portal.
Notification system — license renewal warnings, security patches available, package updates available, low disk, failed logins, service downtime.
Audit log — every state-changing call against the panel is logged with actor / IP / target. 90-day retention, configurable.
Banned IPs page wired to UFW — block bad actors at the firewall, see ban history, set automatic expiry.
Server Health Score — a single 0-100 signal on the dashboard from disk, memory, core services, SSL coverage, and backup status, with a per-signal breakdown. Resource-alert thresholds are tunable on Pro.
Outbound webhooks (Pro) — HMAC-signed event POSTs (site lifecycle, server.alert resource warnings, and more) into Slack, Discord, PagerDuty, or your own automation.

Free Community tier covers most of this

Everything except WAF, virus scanner, S3 backups, mail accounts, git deploy, and white-label is unlocked in Community. Try it before you pay.

Install free See Pro pricing