[1.5.0] - 2026-07-29
This release adds mail queue and delivery visibility, zone file export and import, configurable DMARC, Cloudflare zone management, per-site AI bot blocking, improved JetBackup Linux integration and landing page templates per hosting plan, plus a security pass covering process privacy, home directory permissions and firewall source handling.
New Features
- Mail Queue (AB-1255): A new admin Mail Queue page in the Email group shows active, deferred and hold totals with sender, recipient and domain filters. Preview a message, retry or delete it, delete everything matching the current filters or flush the queue. The Email dashboard shows a backlog indicator when the queue grows.
- Mail Delivery tracking (AB-1131): A new client Mail Delivery page lists recent delivered, deferred and bounced messages for the account's own domains with timestamp, sender, recipient, status and the deferral or bounce reason. When an alias expanded a message, the original recipient is shown as well.
- Outbound mail over IPv6 (AB-1196, AB-1197): Default Email Settings gain an Outbound mail (SMTP) over IPv6 select with
auto, disabled and enabled. The existing IPv6 toggle is relabelled Enable IPv6 (IMAP/POP3), so each control states exactly what it covers.
- Zone export and import (AB-1252): Export a zone as a standard zone file and import one back, in both the Zone Editor and Global DNS Zones. The import reports every line it could not apply and why. TTLs are clamped to the panel's
60 to 86400 range with a warning. The SOA record stays panel-managed.
- Configurable DMARC (AB-1258): DNS settings gain a DMARC policy and a DMARC report address, used by mail DNS provisioning and the DNS record templates. Defaults are policy
none and postmaster@ on the domain. A _dmarc record you created by hand is never overwritten or duplicated.
- Cloudflare zone management (AB-1052): Add a domain to your Cloudflare account with the Create zone action and see the assigned nameservers and zone status in the list. A per-domain proxy toggle pushes web records (A, AAAA, CNAME) with proxying enabled while mail and service hostnames stay DNS only, plus per-domain cache purge and development mode.
- AI bot blocking (AB-1108): Clients can allow or block AI bots per site, by bot type (training, search, assistant) and by owner, with 27 known AI bots covered including OpenAI, Anthropic, Google, Meta, Perplexity and ByteDance.
- Default landing page (AB-973): Admins and resellers manage landing page templates and assign one per hosting plan. A new account is provisioned with its plan's template and falls back to branding when no template is set.
- Custom 404 for PHP requests (AB-515): A site with a custom 404 page now serves it for requests to non-existent
.php files too, not only for static files.
- JetBackup Linux integration (AB-1127): Backups and restores now cover every account resource instead of just the home directory: hosting accounts, packages, domains with their zones, email accounts, FTP accounts, SSL certificates, databases and database users. Each backup includes a complete panel inventory, including cron jobs and DNS records. FTP and mailbox passwords survive a restore intact and a health check repairs the integration when a JetBackup package upgrade replaces it.
- In-place conversion (AB-1317): The migration importer can adopt an existing system user instead of rejecting the username, so an in-place cPanel or DirectAdmin conversion keeps each account's uid, files and passwords. Plain backup restores keep refusing an existing username.
- Admin and reseller User API (AB-1122): Admin and reseller API keys can call every client API endpoint on behalf of an account by naming it (id or username) in the
X-Hosting-Account header. The header is required, reseller keys can only name accounts they own and endpoint ACLs apply exactly as on the admin and reseller APIs.
Security
- Process listing privacy (AB-1078): An account's running processes and their command lines stay visible only to that account, on new installs and on upgrade.
- Home directory permissions (AB-1077): Site and account directories use restricted permissions that keep other accounts out, applied across every existing account on upgrade. Ownership and the files inside are left as they are. Each path is handled on its own, so one unreachable account does not stop the rest.
- Firewall source restrictions (AB-1310): A firewall rule pinned to an IPv4 source or destination applies over IPv4 only, an IPv6-pinned rule over IPv6 only and a rule with no family applies over both. Where a restriction cannot be expressed for one family, the port stays closed there. Identical rules are deduplicated, so each rule is applied once.
- File ownership handling (AB-719, AB-718): File ownership checks stay within the account's own home directory and validate the path before any privileged operation.
- Panel login protection (AB-1119): Repeated failed panel logins are banned automatically. Admin, reseller and client logins are all covered. Existing installs pick the protection up on upgrade.
- Client email page scoping (AB-1306, AB-1307): Subscribers, Catch All and Email Filters in the client panel list only the signed-in account's records.
Bug Fixes
- Email account status (AB-1020): The email account list shows Restricted only for a mailbox that actually carries a restricting state. Mailboxes without restrictions are shown as Unrestricted.
- Admin Send Email (AB-1213): Send Email delivers to the address typed in the To field. The configured system addresses stay the visible defaults.
- Database and user deletion (AB-1212): Deleting a database together with its user revokes access first and then removes both. When a step fails, the real error is reported instead of a false success.
- Security jails (AB-1119): A jail using a custom filter is applied with that filter, the Enabled toggle in the jail list takes effect on the server and bans from the shipped SSH, mail and web server jails are enforced by the server firewall. Existing installs pick up the enforcing ban action on upgrade, keeping any tuning you made.
- JetBackup service control (AB-1128): The JetBackup page reports service state, version and license correctly. Start, Stop and Restart control the JetBackup services, verify the result and report the real outcome. The controls are offered only when JetBackup is installed.
Improvements
- Module upgrade reliability (AB-1304): A module that fails to upgrade no longer stops the chain: every module is attempted and the update log ends with a summary naming each module as upgraded or failed. The update status names the failed modules instead of only reporting a failure.
- Serialized update flows (AB-1303): An upgrade and the scheduled update check no longer run at the same time, so a scheduled check cannot interrupt a running upgrade.
- Upgrade failure diagnostics (AB-1305): A failed module upgrade shows the underlying error in the log view, instead of only a generic message.
- License revalidation (AB-1050): License revalidation runs in the background, so it never delays an admin request.
- PHP disable_functions cleanup (AB-1040): An upgrade step removes
parse_ini_file, file_get_contents and curl_multi_exec from stored PHP disable_functions lists, so sites that use those core functions keep working when PHP settings are re-applied.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.4.0
- Log in to the Admin Panel.
- Open System, then System Updates.
- Click Check for updates and review the release notes.
- Start the update if a newer version is available.
The technical changelog can also be previewed in the admin panel by clicking the 1.5.0 version link in the footer.
