[1.8.2] - 2026-09-10
AdminBolt hosting can be sold from Blesta and Upmind now, with modules beside the WHMCS one. An account can run a Redis instance of its own for object caching, sold through the hosting plan. Clients open a support ticket in the client panel, into the helpdesk you already run. Around those: every update a server can install on one screen, an editor for Apache include files, ModSecurity rule vendors, remote mail routing, mail restores out of an account backup, a choice of MariaDB series and a page for the server clock.
Billing platforms
- Modules for Blesta and Upmind (AB-1116, AB-1118): AdminBolt hosting can be sold from Blesta and Upmind as well as WHMCS. The billing system creates the account, suspends and unsuspends it, changes its plan and terminates it, following the order it manages. The client area of the billing system shows the account's disk and bandwidth usage and a button that logs the client straight into the panel. A module can work under an administrator key or under a reseller key, so a reseller can sell from their own billing system too.
- Billing integration API (AB-1115): The administrator and reseller APIs are ready for billing modules of your own. A hosting account can be looked up by exact username or by domain, a plan can be given by name rather than by id and usage details answer with plain numbers. The modules use the same API, so a billing platform we do not cover yet can be wired up by whoever runs it.
Redis and databases
- Per-account Redis (AB-1441): An account can run its own Redis instance for object caching under Databases > Redis. Enable it, read its memory, keys and uptime, restart it or flush it. Ready-made connection details are on the page to copy, for LiteSpeed Cache, Redis Object Cache and your own PHP code. The instance belongs to that account alone and is reachable only from it. The hosting plan sets how much memory it may use, where 0 means no Redis at all, so Redis is a feature you sell. The account's WordPress sites connect to it in one click, which installs the cache plugin and points it at the instance. They disconnect the same way.
- Server-wide Redis limits (AB-1556): General Settings > Redis instances bounds what all account instances may take together: a memory budget, where 0 means a quarter of the installed memory, a maximum number of instances and an In use line showing what is reserved today. An account can enable Redis only while it fits both limits. The memory ceiling its hosting plan sets is enforced by the server. A suspended account's instance stays down until the account is unsuspended. The budget and the ceiling apply to the instances a server already runs.
- MariaDB series (AB-1446): You choose which MariaDB series a server provisions, the 10.11 line or the newer long-term 11.4 one, with
bolt-cli manage-mariadb --action=install --series=11.4. Database Settings shows which series runs and how long it is supported. It offers the in-place upgrade when a newer supported series exists. The upgrade is followed on the page and recorded once the server reports the new series. There is no downgrade.
- phpMyAdmin configuration storage (AB-1431, AB-1545): phpMyAdmin's configuration storage is set up on new installs and on upgraded servers, so its extended features are available. Where the installed phpMyAdmin is too old for them, the panel names the update that brings them. The health check reports the same state.
Support tickets
- Tickets from the client panel (AB-963): Clients open a support ticket in the client panel and follow the whole conversation there. Settings > Support Tickets connects the panel to Freshdesk, WHMCS or Zendesk. A reseller can connect a helpdesk of their own, inherit the panel-wide one or turn tickets off for their clients. The client's Support group gains Submit a Ticket. Each ticket has a thread with the helpdesk status, unread markers, a reply form and the client's earlier tickets beside it. Replies from your staff come back into the panel on their own. A ticket reopened on either side returns to the conversation. Settings > Ticket Submissions lists every submission with its provider and its status, so an integration that stops working is visible to the administrator.
System updates
- Update progress and log (AB-1032): The update screen reports the phase it is in and a ticking clock while AdminBolt upgrades itself. The page stays with the run from start to finish. The whole log is on the page. The run counts as complete only once the server is out of maintenance mode and usable. A panel already running a build newer than its channel says so. An administrator REST API drives the same run without a browser: check, start, follow the progress, read the log and the changelog and switch the unattended run on or off.
- Automatic panel updates (AB-1438): A switch on System Updates installs new AdminBolt versions every night on its own. Each run reports its outcome to every administrator's notifications. The switch is off by default. Nothing changes for a server that does not opt in.
- Operating system updates (AB-1409): System Updates gains an OS packages tab for the distribution's own packages. It shows what is pending, which of them are security updates and whether a reboot is due. You install all of them or the security ones only, with live progress and the log on screen. The tab can run nightly on its own too, optionally security-only. AdminBolt's own packages are never touched by that run. The Attention Center warns about a due reboot and about pending security updates.
- CloudLinux packages (AB-1483, CloudLinux Only): A converted server gets a CloudLinux tab with its own package table, a Check for updates action and an install that upgrades only those packages. The rest of the page stays usable while it runs. The tab has a nightly unattended run of its own, separate from the distribution one. The same set is on the administrator API. It appears as soon as a conversion finishes.
- System Updates page layout (AB-1497): System Updates is one page per package set. Each tab carries a count of what is outstanding behind it. Every tab is built from the same parts in the same order: a status line, the automatic updates switch, the counts, the package table and the install action. A running update fills the page but keeps the sidebar and the header, so there is always a way off the screen. A failure the page cannot explain links to the execution logs.
Web server
- Apache include files (AB-1440, AB-1549): Settings > Web Server > Apache Includes edits custom Apache directives that survive a configuration rebuild. An include applies globally, to one domain, to every domain of an account or to a single port. A directive that cannot be applied is refused with the reason and nothing changes. An include you save takes effect straight away. Deleting an account takes its includes with it, so a later account under the same username starts with none. Remove file acts on the file picked in Existing file and names it in the confirmation.
- ModSecurity rule vendors (AB-1447): Web Server > ModSecurity Vendors installs a rule set from an archive URL, then enables, disables, updates or removes it. A vendor that fails keeps its error on its own row. The Rules tab lists each vendor's rules under its name. The OWASP Core Rule Set that AdminBolt installs is the system vendor: you can disable it, you cannot remove it.
- ModSecurity screens match the server (AB-1550): The ModSecurity screens describe what the web server is enforcing. Saving ModSecurity Configuration applies the settings and says so when protection could not be activated. While OpenLiteSpeed serves, adding, updating or enabling a rule vendor is refused with the reason on both pages. A vendor whose change did not take effect shows the reason. An archive URL the server refuses carries the reason it gave.
- Apache MPM limits (AB-1433): Max Request Workers and Threads Per Child take effect as entered on the page. Event and Worker gain optional Server Limit and Thread Limit fields. Saving a changed ceiling restarts Apache.
- PHP memory ceiling per domain (AB-1425): Every domain carries a PHP memory ceiling sized against the server's own RAM, so one site cannot ask for more memory than the machine has. The client reads the same number in the domain's own PHP settings. It applies to new accounts and to every PHP change. Existing domains pick it up on upgrade.
Email
- Email routing (AB-1442): Emails > Email Routing marks a domain as remote, so mail this server originates follows the domain's MX record to an external provider. Switch it back to local when the mail belongs here. Marking a domain remote stops local delivery and mailbox logins in one step. It leaves the domain out of SpamExperts. The MX records stay yours to set. The page follows a hosting plan feature, granted on upgrade to every plan that already allows email accounts.
- Mail restore from an account backup (AB-1444): The client Backups page restores a mailbox that was deleted, with a password you choose. It also restores a single mail folder from a snapshot into a new folder named after the snapshot date, so nothing is overwritten and individual messages can be picked out of it. A restore never merges into a folder the account made itself. Repeated restores of the same folder each get their own destination. The restored mailbox opens straight away. The controls say when a restore is blocked before you press the button.
- Cron output email (AB-1445): A cron job that writes output can mail it to the account owner, to an address you give or nowhere at all. Clients choose it on Cron Jobs. Administrators set the same for the panel's own root cron jobs. The change takes effect at once. An invalid address is refused and the page keeps showing the address that is still in force.
Hosting accounts
- Change primary domain (AB-1515): An account's primary domain can be changed from its View page in the admin panel. The domain, its DNS zone and the account record move together. The zones for the old names are retired. A domain that already serves HTTPS is renamed together with its certificate, so the site answers on the new name over both HTTP and HTTPS. A rename that cannot be completed leaves the site as it was. A primary domain carrying mail is refused up front, because the change does not move mail. That covers mailboxes, forwarders, autoresponders, a catch-all, domain forwarders and mailing lists. Clients cannot rename an account's primary domain. Renaming a secondary domain is unchanged for everyone.
- Backups of a deleted account (AB-1434, AB-1542): The backups of a deleted hosting account are kept. The repository stays under the old username with an Account deleted note. Restore to new account recreates the account and restores the snapshot into it. It states the password rule the server enforces and can generate one for you. A creation the server refuses names the cause. Delete backups removes the repository with its history. A username reused after a deletion gets a repository of its own. It adopts the previous one only when the deleted account had the same owner. Repositories left by accounts deleted before this release get the same row and the same two actions.
- Client PHP configuration follows the plan (AB-1443, AB-1546): A hosting plan decides whether clients see the Global Configuration tab on a domain. That tab holds the per-domain PHP directives such as the memory limit, the execution time and the upload size. Withheld, the tab is absent from the client's domain form and the client API refuses those fields. A plain PHP version change still goes through. Administrators always see the tab. Every existing plan keeps it.
- Account IP changes (AB-1451, AB-1554): Creating, editing or deleting a network IP assignment re-points the account's DNS records, so the site and the zone answer on the account's current address. Records aimed somewhere else on purpose are left alone. A parked domain's zone follows the account. Whoever made the change is told when part of it did not go through. Deleting an account or a reseller takes its IP assignments with it, so Network IPs lists only assignments with something behind them. Accounts already on an address other than the server default are brought in line on upgrade.
- Suspension page (AB-1547): Every host and document root of a suspended account serves the suspension page. Unsuspending removes it again. Domains that share a document root share one redirect that names all of their hosts. A visitor reaches it whether or not the domain has a certificate.
- Disk usage that could not be measured (AB-1551): An account whose home directory cannot be measured keeps its last known disk usage. The figure is marked stale with the reason behind it, on the account page and in the accounts table. Refresh Usage answers with that warning. A measurement that succeeds clears the marks.
Server settings
- Server Time (AB-1439): Settings > System > Server Time shows the server clock, the hardware clock in UTC, the time synchronisation state and the offset from network time. Pick a timezone, switch synchronisation on or off or step the clock now. A refusal reports what the server itself said. The screen states when it cannot read the machine.
Security
- Firewall rules that block (AB-1435, AB-1436): A firewall rule carries an action of its own: accept, drop or reject. The screen blocks traffic as well as allowing it. A block rule wins over an accept rule for the same port. The destination port is optional, which is how an address is covered on every port. A rule that would match every address on every port asks for an explicit confirmation first. The bans tab gains Ban IP address, so a ban can be added from the panel.
- Ban exemptions (AB-1544): Ban exemptions on the Firewall page are checked on the form, so an entry the server would not take is refused there. The page reports what the server did with the list and names anything left out of it. Rows can be removed from the table itself, one at a time or in bulk.
- AutoSSL follows the account switch (AB-1427): AutoSSL obeys the per-account switch on Hosting Accounts > SSL. An account it is switched off for is left out of every automatic run and of the health check. Naming one of its domains explicitly says so. The switch sits on an AutoSSL tab beside Certificates and Issuance History.
- Certificates for late domains (AB-1429): A domain whose DNS was not ready when it was created gets its certificate soon after it points at this server. A domain that is not pointed at this server is skipped before any certificate authority is asked.
- PHP file handling (AB-1491): Only files whose final extension is a PHP one are run through PHP.
- Mail login bans (AB-1450): Repeated failed mail logins are blocked. Settings you tuned yourself are left alone.
Improvements
- Improved (AB-1466, AB-1485, AB-1123, AB-1528, AB-1495, AB-1514): Improved administrator password changes, usage history charts and usage-based limits in the reseller panel, client login sessions, hosting account statistics refresh and web log cleanup on domain and account deletion.
- Reliability: The release also carries reliability fixes across the panel and the components AdminBolt ships.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.8.1
- Log in to the Admin Panel.
- Open System, then System Updates.
- Click Check for updates and review the release notes.
- Start the update if a newer version is available.
The technical changelog can also be previewed in the admin panel by clicking the 1.8.2 version link in the footer.
