[1.6.0] - 2026-08-04
This release adds OpenLiteSpeed as a third web server with its own .htaccess handling, Remote MySQL access for hosting accounts, a webmail.<domain> address for every domain, login history and active session management for every role, panel-owned admin credentials and managed open_basedir paths.
New Features
- OpenLiteSpeed web server (AB-1111): OpenLiteSpeed joins Apache and LiteSpeed Enterprise as a supported web server. Install it from the Module Manager and switch to it from the new OpenLiteSpeed dashboard, which shows the running status, restart and switch actions and the WebAdmin Console details with its own credentials and a reset action. Dedicated Error Logs, Access Logs and Settings pages cover log viewing and core server tuning (max connections, timeouts, request body size, gzip). The PHP Engine Migration page applies to OpenLiteSpeed as well, so plans and domains can follow the switch. Switching web servers reports success once the incoming server is up and serving. If it does not come up, the panel keeps the current server running and tells you what to check. A new admin LiteSpeed Cache page manages the per-domain cache settings and purge actions across every account. The client page is available on OpenLiteSpeed as well, following the hosting plan's LiteSpeed Cache feature.
.htaccess handling (AB-1112): Pick how OpenLiteSpeed applies .htaccess on the OpenLiteSpeed dashboard: off, restart-on-change or module. In module mode .htaccess is interpreted per request with no restarts. A site using a directive that module mode does not cover is listed on the dashboard with the directive that caused it and keeps serving its .htaccess through restart-on-change, with a per-site Retry to put it back on module mode once the directive is gone.- Remote MySQL (AB-1285): A new client Remote MySQL page where an account authorizes external hosts to reach its own databases: add a host to allow it, remove it to revoke access again. An account's allowed hosts reach only that account's databases. Admins get a Remote MySQL settings page with a server-wide toggle for wildcard hosts, off by default, plus a Remote MySQL Hosts list to review and revoke allowed hosts across every account. The page is enabled per hosting plan.
- Webmail subdomain (AB-947): Every domain is provisioned with a
webmail.<domain> subdomain serving Roundcube, so account users reach webmail at the address they expect. The parent domain keeps serving as before when the subdomain is added or removed. Deleting a subdomain also removes its records from the parent zone.
- Managed open_basedir (AB-1009): With Softaculous installed, the SitePad editor path is added to the allowed paths for every site automatically. Admins can add extra
open_basedir paths per hosting account on the Edit Account form. Entries are validated on save, naming any line that is rejected. Installing or removing Softaculous applies the change to existing sites, not only to new ones.
- JetBackup hooks on upgrade (AB-1327): A host that already ran JetBackup before AdminBolt shipped its integration receives the AdminBolt hooks and the database configuration on upgrade, so backups and restores cover every account resource instead of the home directory alone. A recurring check reinstalls them if a JetBackup update replaces them.
- Restored cron jobs (AB-1328): Cron jobs restored outside the panel are adopted onto the Cron Jobs page and keep running. A scheduled sweep picks up a restore shortly after it happens. Lines the panel cannot represent (
@reboot, environment assignments, malformed schedules) are left untouched and logged instead. Only users with a hosting account are reconciled.
Security
- Login history and sessions (AB-1253): Every role gets a security section listing the recent login attempts (timestamp, IP, device and result) and the active sessions, with per-session revoke and Log out all other sessions: inline on the client Password & Security page and the admin My Profile page, plus a new Settings > Security page in the reseller panel. Logging out everywhere also ends remembered logins on other devices while the browser you asked from stays signed in. History retention is configurable in Panel Settings > Security.
- Panel admin credentials (AB-1199): Admin accounts are managed by the panel with their own passwords, kept separate from the server's system accounts. Existing installs keep signing in with the password they use today and are asked to set a panel password on the next login. A fresh install starts from the single-use sign-in link the installer prints.
- License enforcement (AB-1324): License validity applies to every way the server is controlled. With an expired license the client and reseller panels show a page pointing the user to their provider. API calls that change something are refused while reads keep working, so monitoring and billing integrations still see data. Hosted websites, mail, DNS and webmail are never gated.
- Input validation (AB-1018): Track DNS, Git operations and directory privacy credentials validate their input on submit.
Bug Fixes
- Firewall rule source (AB-1309): A firewall rule created with a Source or Destination IP applies to exactly those addresses.
- Managed cron on upgrade (AB-1316): Every upgrade reconciles the managed cron entries, so a server missing one picks it up on the next upgrade rather than only on a fresh install. This covers the sweep that issues and renews certificates for hosting domains.
- Webmail after a panel upgrade (AB-1314): Webmail keeps working after an upgrade that does not include Roundcube itself. The shipped security jails, panel login protection among them, come up after an upgrade.
Improvements
- Certificate issuance (AB-1129): A domain's web server configuration is brought up to date before certificate issuance starts, so validation runs against the current configuration. New
bolt-cli rebuild-apache-vhosts regenerates the configuration of every non-parked domain, or of a single one with --domain=. Run it once after an upgrade to bring existing sites onto the current templates.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.5.0
- Log in to the Admin Panel.
- Open System, then System Updates.
- Click Check for updates and review the release notes.
- Start the update if a newer version is available.
The technical changelog can also be previewed in the admin panel by clicking the 1.6.0 version link in the footer.
