[1.7.0] - 2026-08-17
This release adds per-account backups with scheduled snapshots and self-restore, two-factor authentication and passkeys for every role, a panel-wide activity log, outbound mail sending limits with automatic suspension, SpamExperts incoming filtering, CPGuard as a second server security suite, LSPHP on plain Apache and configurable remote IP handling for servers behind a CDN.
New Features
- Per-account backups (AB-530): A new Backups section where you register a storage destination, attach a backup policy to a hosting plan, a reseller or a single account, then follow every account's backup state, size, last run and error from one dashboard. Backups run on the server without holding up the panel. Older ones are removed on the retention you set. A failed run raises a notification. Clients get their own Backups page with a snapshot picker, a searchable file browser, restore in place or as a copy that leaves the live files untouched. There is also a Backup now button with a daily limit. Self-restore is granted per policy and an account can be opted out of backups entirely. Admins and resellers can start a backup or a restore for any account they manage. Every run records who asked for it.
- JetBackup restores (AB-1368, AB-1369, AB-1370, AB-1371): Restoring an account that no longer exists in the panel now completes end to end: the system user JetBackup creates is adopted and the domain, DNS zone, quota and cron jobs are provisioned around it. After a restore the site and mailbox ownership is put back the way the panel expects, so restored sites serve and restored mail is delivered. The account's cron jobs are reconciled as soon as the restore finishes instead of on the next sweep. A restored account comes back with its reseller owner, hosting plan and shell access intact. The admin JetBackup page reports the license, version, storage and last-backup figures read from JetBackup itself. Signing in to the JetBackup interface from the panel reports a EULA still waiting to be accepted instead of opening a session you cannot use.
- LSPHP on Apache (AB-1366): Install
mod_proxy_lsapi from the Module Manager to serve LSPHP on plain Apache, with a pool per account and PHP version carrying the hosting plan's memory, CPU and process limits. LSPHP then appears next to the other PHP providers on the domain, plan and PHP Engine Migration screens. The module refuses to uninstall while a domain still uses it and points you at the migration page.
- Remote IP handling (AB-1329): Servers behind Cloudflare or another CDN can name the header that carries the visitor address and the proxies allowed to set it, from both the Apache and the LiteSpeed settings pages, with a one-click Cloudflare preset that fills in the published ranges. Visitor statistics, access logs, the IP Blocker, login protection and
REMOTE_ADDR then all read the visitor's own address. The header is applied only together with a trust list and both pages say so. The client Access Logs viewer gains a Remote Host column.
- OpenLiteSpeed hostname SSL (AB-1355): Under OpenLiteSpeed the panel hostname is served by its own virtual host, so hostname certificate issuance and renewal complete. The server is restarted after a certificate change, so both the panel and the WebAdmin Console serve the current certificate.
- ICMP and IPv6 firewall rules (AB-1311): Firewall rules can be created for ICMP and ICMPv6 and for IPv6 addresses, with the port fields hidden where they do not apply and an IP Version badge in the list. The ping rules that used to be fixed become editable system rules. The page warns you when the firewall service is down or the live ruleset is empty. A rule the server refuses reports the reason instead of a generic message.
- CloudLinux IP-based licenses (AB-1007): Install CloudLinux without an activation key to use an IP-based license: leaving the key empty selects it. The panel shows which mode a server was licensed in.
- CloudLinux precheck results (AB-1354): The CloudLinux page names the precheck checks that failed and any warnings reported alongside them. An installation starts only on a clean precheck.
- CloudLinux provisioning progress (AB-1210): A running CloudLinux job shows how long it has been going and states that every step is time-bounded. A PHP version being installed or removed carries an Installing badge with elapsed time, or a Queued badge while it waits behind another package operation, instead of looking untouched. Clicking again during a run reattaches to the running job. The Services page lists the CageFS daemons on CloudLinux servers, so a stuck one can be restarted from the panel.
- Installed PHP versions (AB-1403): The PHP Versions page reports the versions the server actually has, so a version that finished installing can be assigned to a domain and one the server does not have is not offered anywhere. Uninstall is refused while a version is still serving a site, naming the blocking domains and plans in the confirmation dialog before you commit. A PHP version change the server refuses leaves the domain on the version it was already running. A failed install tells you why instead of returning quietly to Install. When the panel cannot ask the server, the page says the state is not confirmed rather than reporting an all-clear.
- CloudLinux conversion (AB-1388): Converting a server to CloudLinux puts back the suexec build the panel's CGI wrappers run under, so domains served through CGI keep answering after the conversion and the reboot that follows. The conversion result reports the state it left the server in.
- Usage history charts (AB-1256): Hosting accounts get Disk Usage History and Bandwidth History charts built from a daily snapshot of disk, database and transfer usage, with a day the panel could not collect drawn as a gap rather than smoothed over. The reseller dashboard shows real disk and bandwidth totals and trends across its accounts. Retention is configurable in Panel Settings > Usage History.
- Certificate expiry alerts (AB-1251): The panel warns before a certificate expires, warns again when a renewal fails and reports a certificate that has expired, over email, webhooks and the admin bell. A renewal alert carries the reason the issuer gave. All three templates are editable under Notifications.
Email
- Outbound sending limits (AB-1363): A new Sending Limits tab in Email Settings with hourly and daily limits per mailbox and per domain, per-plan values and per-sender overrides for a single mailbox or domain. The Email > Sending Limits page lists every rejected message with the account, domain and mailbox it came from. With automatic suspension on, a mailbox over its limit loses SMTP login until its rate drops back under the limit and keeps IMAP and webmail meanwhile. An admin can also suspend a mailbox by hand. A manual suspension is never lifted automatically. Mail sent by site scripts carries the site's own sender address, so it is delivered and counted against the right domain. An upgrade applies that to the sites already on the server. The page also reports whether the limits are being applied, separating enforcing from degraded, where outbound mail is deferred rather than sent unmetered, from unknown when the server cannot be asked. The sender exemptions in force are listed next to that state. An upgrade removes the shipped example exemptions from servers already in the field and names every entry it removed, leaving the ones you added in place.
- SpamExperts filtering (AB-1110): A new SpamExperts page in Email Settings for the cluster API and the MX hosts. Clients whose plan includes the feature get a per-domain filtering toggle and one-click sign-in to the Spam Panel. Enabling registers the domain on the cluster before the MX records are rewritten and disabling restores them first, so mail keeps flowing either way. Access can be limited to selected resellers. A scheduled sync retries unfinished changes and repairs a domain whose delivery route has drifted.
- Outbound SMTP relay (AB-949): Send outgoing mail through an external relay, configured from the panel or the CLI with host, port, credentials and encryption.
- Sender Rewriting Scheme (AB-1308): Forwarded mail leaves the server with a rewritten envelope sender, so a forward passes the receiving side's sender checks. Forwarding survives a restore.
Security
- Two-factor authentication (AB-945): Admin, reseller and client accounts can add a second step to their login with an authenticator app (TOTP) or a passkey, with single-use recovery codes for a lost device. Changing the second factor, regenerating recovery codes or removing a passkey asks for a fresh code first. An admin resetting another account's second factor confirms with their own. A challenge left open expires on its own.
- Panel audit log (AB-1250): A new Logs > Activity Log page recording who changed what and when across hosting accounts, domains, DNS records, email, databases, FTP accounts, cron jobs, certificates, firewall rules, hosting plans, API keys and the panel's own accounts. Each entry opens on the previous and the new values. The list filters by event, object type, actor role, date and impersonated actions only. An action taken while impersonating names both the admin who started the session and the account they acted as. The start and the end of every impersonation are recorded even when nothing was changed in between. Resellers get the same page scoped to their own accounts, with an action taken through an API key attributed to the reseller that owns the key. Passwords, tokens and keys are recorded as changed without keeping the value itself.
- CPGuard security suite (AB-986): CPGuard joins Imunify360 in the Module Manager as a server security suite, with one of the two active per server. Install it from the module wizard with your license key, then follow the status, license and connection state on the admin CPGuard page. The client page is handed to accounts through the hosting plan feature. A switch on the page hands request filtering over to CPGuard's own rule set, turning on its security engine and restarting the web server where needed. Switching back restores the shipped rules. Accounts and domains stay in step with CPGuard as they are created, changed and removed, including after a web server switch.
Bug Fixes
- Database name casing (AB-1171): A database created with capital letters in its name is addressed under the same name everywhere, so grants, size, delete and backup all act on the database that exists. The client forms fold the name to lowercase while you type and refuse a name that differs from an existing one only by case. Existing rows are repaired on upgrade. The database users attached to a repaired database keep their privileges on it, with any that could not be moved named in the result so you can re-attach them.
- Outbound relay authentication (AB-1382): Mail servers provisioned before the outbound SMTP relay shipped pick up the missing authentication plugin on upgrade, so mail sent through an external relay authenticates with the smarthost and is delivered instead of being deferred on the server.
- SSH access on account edit (AB-1365): Saving an account with SSH enabled re-applies its SSH access configuration on the server. When the server refuses, it reports a warning naming the reason instead of showing a clean success.
- Failure reasons in notifications (AB-1373): A failed action tells you why it failed in the admin, reseller and client panels, on the account actions, the account View page and the client cron form, instead of a generic message.
- WordPress uninstall cleanup (AB-1211): A WordPress uninstall reports an error when its database cleanup does not finish and removes the site files last, so a failed uninstall stays visible and a retry completes it. Panel writes wait for the database instead of failing while another write is in flight. Queued jobs run exactly once under load.
Improvements
Faster panel after upgrade (AB-1048): The panel's framework caches are built into the package, so the first page after an install or an upgrade is served without building them on the server first.
Upgrades that install packages (AB-1381): A panel upgrade whose steps install packages, such as the backup tools or a module reinstall, runs those steps once the package manager is free and finishes on its own instead of stalling with no output. The managed cron jobs are reconciled after the upgrade rather than while the agent is restarting. The copy of the panel database taken before an upgrade is a consistent snapshot that restores the committed data.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.6.0
- Log in to the Admin Panel.
- Open System, then System Updates.
- Click Check for updates and review the release notes.
- Start the update if a newer version is available.
The technical changelog can also be previewed in the admin panel by clicking the 1.7.0 version link in the footer.
