[1.4.0] - 2026-07-22
This release adds Punycode/IDN domain support, login shortcut URLs on account domains and a wide security pass with more than 60 items: ownership checks, input validation and restricted path handling across the panel, bolt-agent, Git, databases, email and file handling.
New Features
- Punycode/IDN domain support (AB-1109): Internationalised domain names such as
bücher.example can now be added and used across AdminBolt. Domains are stored as Punycode and shown in their readable Unicode form.
- Login shortcut URLs (AB-1130): Account domains now answer on familiar paths:
yourdomain.com/cpanel opens the panel login, yourdomain.com/webmail opens webmail and /panel ships as a third default, so end users keep entry points they already know. The paths can be customised or the feature switched off in the admin panel.
Security
- Agent authentication (AB-548, AB-553): Agent requests authenticate with a valid token and agent configuration keeps authentication enabled.
- Ownership checks across the panel (AB-810, AB-829, AB-899, AB-1059, AB-1087, AB-1088, AB-1096, AB-1099, AB-1101): WordPress installs, database backups, DNS health checks, applications, hosting and network management, email and mailing list actions all enforce account ownership.
- Input validation (AB-558, AB-559, AB-560, AB-562, AB-611, AB-696, AB-758, AB-819, AB-825, AB-840, AB-911, AB-1070, AB-1076, AB-1089, AB-1091, AB-1097, AB-1098): Certificate issuance, database backup and restore, hosting account deletion, protected directory credentials, TrackDNS, JetBackup license keys, SSH keys, database names, domain, file and mailing list inputs are validated on submit. Hosting account creation also rejects reserved system usernames.
- Restricted path handling (AB-589, AB-811, AB-812, AB-813, AB-1058, AB-1061 to AB-1067, AB-1094, AB-1095):
.htaccess builds, SSL certificate storage, folder backup restore and hosting, domain, file, database and email operations use restricted path handling.
- Git (AB-817, AB-907 to AB-910, AB-912, AB-914): Git clone accepts only allowed remote URLs, remote connections verify SSH host keys, SSH key writes use restricted file handling, key listings return only what the operation needs and repository operations validate paths and require a valid user context.
- Process privacy and log sanitisation (AB-1071, AB-1075, AB-1079 to AB-1086): Database and hosting operations keep sensitive values out of process listings and database-related logs mask sensitive values.
- Panel file permissions (AB-1056, AB-1057): Framework directories and panel database files use restricted permissions.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.3.0
- Log in to the Admin Panel.
- Open System, then System Updates.
- Click Check for updates and review the release notes.
- Start the update if a newer version is available.
The technical changelog can also be previewed in the admin panel by clicking the 1.4.0 version link in the footer.
