AdminBolt 1.9.4 extends the REST API across the admin, reseller and client panels. DNS, logs, cron jobs, modules, web server settings, domain settings, caching and cPGuard scans can now be managed through the API. The client API follows each hosting plan's feature list and the account's suspension, the same way the client panel does. You can also set your own domain for the temporary domains the panel suggests for new accounts. Health gets new server security warnings for root password login over SSH and for websites served with a self-signed certificate. The panel opened by the server's public IP address can show a trusted certificate. New installs get MariaDB 11.4. They can also add root's SSH key during installation. Fixes cover WordPress installs and single sign-on, DNS Health, migrations between nodes, CloudLinux, MariaDB settings and backup imports.
REST API coverage
- Client API plan rules (AB-2128): Every client API route follows the hosting plan's Feature List and the account's suspension, the same way the client panel does. A request for a feature the plan leaves out gets a 403 answer with the reason. So does a request made with a suspended account's own API key.
- Client API (AB-2129, AB-2133, AB-2135, AB-2136, AB-2138, AB-2141, AB-2145, AB-1866): The client API now covers mailing lists. For domains it covers redirects, maintenance mode, custom error pages, hotlink protection, directory indexes and private directories. It manages Redis, LiteSpeed Cache and Cloudflare for the account. It also manages the cron notification email, Git repositories and Git SSH keys. Clients can export a zone file and import a zone after a preview. On servers with cPGuard, they can start, list and stop cPGuard scans of their home folder. They can manage AI bot blocking for each domain. The client API reads a domain's access log, its raw access logs and the disk usage of each folder. It also reports the service status of the account's own server. Refused values come back as JSON with the field named.
- Reseller API (AB-2131, AB-2132, AB-2145): The reseller API covers account actions, reseller settings, landing pages, IP assignments and reports, with the same rules as the reseller panel. It manages hosting plan feature lists and reads the reseller's own activity log.
- Admin API (AB-2130, AB-2131, AB-2133, AB-2138, AB-2141, AB-2143, AB-2145): The admin API edits the same hosting account fields as Edit Account. An unknown field is refused by name and nothing is applied. New actions refresh an account's usage and remove the copy of a migrated account. Reseller limits, overselling and the reseller's mail server can be set with the same checks as the reseller form. A single-use link signs you in to a reseller's panel. The admin API manages DNS templates, secondary DNS servers, DNS cluster settings, global DNS zones, host records and external DNS sources. It manages the server's cron jobs, with a separate permission on the API key and every change in the activity log. It covers modules and their updates, PHP-FPM, MyApache and ModSecurity settings, configuration profiles and web server repairs. It reads and changes the Domain Security settings. It reads the activity log and the server logs with the filters of their pages. Log text keeps sensitive values masked.
- API reference (AB-2146): The REST API reference also describes the routes a hub calls on its nodes for account migration and cluster services.
- Admin API on CloudLinux (AB-2130, AB-2131, AB-2143, CloudLinux Only): The admin API sets LVE limits and CageFS for hosting accounts and the LVE pool for resellers. It also covers the Isolation Report and MySQL Governor.
Temporary domains
- Your own temporary domain (AB-2094): Settings > General > Branding sets your own domain for the temporary domains that Create Account suggests. It replaces the default myboltip.com domain. The domain needs a wildcard DNS record that points at this server. When that record is not ready, the panel says which record to add or change. The admin API offers the same setting.
- Temporary domain mail (AB-2086): DNS Health checks the mail records of the free temporary domain in public DNS. Email Accounts, the Zone Editor, the client dashboard and onboarding warn that mail sent from a free temporary domain may fail SPF and DKIM checks at receiving servers.
Server security
- Root password login warning (AB-2022): Health and the Dashboard's Needs attention card warn when root can log in over SSH with a password. The warning names the settings involved and links to SSH Access. It clears at the next check after the setting changes, whether you change it in the panel or on the server.
- Self-signed certificate warning (AB-2023): Health warns when an active domain is served with a self-signed certificate. The warning clears once the certificate is replaced.
- Trusted certificate by IP (AB-2105): On a server with a public IP address, the panel opened by that address shows a trusted certificate once one is issued. This covers new installs and upgraded servers. When the certificate cannot be issued, Health shows the cause.
- Installer SSH key (AB-2106):
install.sh --ssh-key installs root's SSH public key and can turn off password login for root. If a step cannot finish, the installer keeps the previous SSH settings. It prints the command to finish the step later.
- Certificate private key (AB-2029): In the client panel, a certificate's private key stays hidden until the account owner clicks Show private key. Each such view is recorded in the activity log.
- cPGuard and Apache (AB-2224): Sites keep serving and System Updates complete when a cPGuard file breaks the Apache configuration. The CPGuard page and Health say so, with the file and the line when they are known. They also say how to turn cPGuard's protection back on.
Databases
- MariaDB 11.4 by default (AB-2228): New installs get MariaDB 11.4. The installer's
--mariadb-version option picks another series. Existing servers keep their series. A migration between nodes whose target MariaDB cannot take the databases stops with the reason.
- MySQL Governor on MariaDB 11 (AB-1787, CloudLinux Only): MySQL Governor installs on MariaDB 11.4 and 11.8. On CloudLinux 9 it offers the database versions CloudLinux supports there. A version the server cannot take is refused before the database backup starts.
- MariaDB settings (AB-2215, AB-2251): When Database Settings for MariaDB or PostgreSQL cannot save a value, it names the field. When MariaDB refuses a new value, the panel tries to put the previous settings back. The page says what happened and gives the reason.
- Remote MySQL (AB-2226, AB-2227): Remote MySQL accepts remote addresses as hosts. A host stays listed until access from its address is revoked. A removal that does not finish names what is left and can be run again. Removing a host keeps the account's local database users.
Multi-server management and DNS
- Migration DNS cutover (AB-2239): With secondary DNS checks on, a migration between nodes reports completed once every active secondary nameserver serves the migrated zone. It names any secondary that still serves the old records.
- Hub copy after migration (AB-2259): Removing the hub's copy of a migrated account keeps the zone the node serves.
- PostgreSQL databases in migration (AB-1891): Migrating an account with PostgreSQL databases keeps each database's owner within the migrated account. The database users of other accounts stay as they are.
- Secondary DNS summary (AB-2240): The Secondary DNS Servers summary leads with the number of zones that are not served correctly.
- DNS Health (AB-1522): For each domain that is not healthy, DNS Health names the cause and the next step. Each row loads on its own.
- DNS templates (AB-2133): DNS templates accept SRV priority, weight and port. Applying a template reports the result for each domain.
- Nameserver Selection (AB-1887): Nameserver Selection stores a choice once the server has applied it. When the server refuses, the previous choice stays, with the reason and the next step.
- DNS re-provision (AB-1909): Re-provision of the DNS service on the Services page keeps the zones.
- DKIM and customer records (AB-2255): A CNAME or DKIM key the customer added under the DKIM record name stays as it is.
WordPress and websites
- WordPress installer file conflicts (AB-1140, AB-2089): The WordPress installer checks the target folder at the start of the wizard. It names conflicting files before anything is installed.
- Stopped WordPress install (AB-2115): A failed or blocked WordPress install shows the reason and the next step on the wizard page. Every attempt is recorded in the activity log.
- WordPress SSO (AB-2250): When single sign-on to WordPress fails, Login to Admin (SSO) says why. The installed WordPress version shows correctly.
- LiteSpeed Cache on LiteSpeed Enterprise (AB-2253): LiteSpeed Cache caches on LiteSpeed Enterprise.
- LSPHP versions (AB-2085, AlmaLinux Only): Hosting packages, account creation and new domains offer LSPHP versions while a web server that runs LSPHP is active. A package that holds a version no web server runs says why and how to fix it.
- Not Found URLs list (AB-2091): The Not Found URLs card on Metrics > Visitors and on Domain Statistics opens the list of those URLs. It shows their method and hits for the same period and domain as the count.
CloudLinux
- Default PHP extensions in CageFS (AB-1818, CloudLinux Only): An account that enters CageFS gets the default alt-php extensions of every installed version. It keeps the extensions it selected itself. The Isolation Report offers Restore default PHP extensions for accounts in CageFS.
- PHP Selector versions (AB-1907, CloudLinux Only): alt-php versions disabled in the CloudLinux PHP Selector are not offered for websites and hosting plans.
- Resource Usage for HTTP queries (AB-2242, CloudLinux Only): LVE Manager has a switch that lets Resource Usage show HTTP queries.
- Redis next to AccelerateWP (AB-2254, CloudLinux Only): Redis works on alt-php next to AccelerateWP Object Caching.
Backups and backup import
- Backup import (AB-2176, AB-2180, AB-2203): Items left out of a restore show as skipped. A refused import clears its progress line. When a plain
.tar backup may have been cut short, the preview, the report and the API say so. An account with its own IP address imports completely.
- Client Backups notice (AB-2087): On a server that hosts its owner's own websites, the client Backups page says what is missing and where to set it up in the admin panel. The same notice shows while an administrator impersonates the account.
Updates and installation
- Third-party application updates (AB-2232, AB-2223): Panel updates upgrade AdminBolt's own software. Roundcube, phpMyAdmin, Adminer, Softaculous and other third-party applications are upgraded from their own page, from the Updates tab of Module Manager or by their automatic updates.
- Upgrade after a reboot (AB-2216): When a reboot interrupts the post-upgrade work, it resumes on the next start. The panel stays in maintenance mode until it is done.
- First-run status checks (AB-2026): A fresh install shows the update status, the mail server check and the hostname and reverse DNS checks within minutes. While the update status is still unknown, the panel says why.
- Fallback page (AB-1504): The server's own IP address serves the fallback page. Health offers Repair fallback page.
- Installer trial email (AB-2211): The installer checks the
--email value and names any characters it does not accept. The address reaches the trial request as you typed it.
Fixes and smaller changes
- Client pages outside the plan (AB-2218): Client pages for features the hosting plan leaves out stay closed, from the menu and by address. Imunify360 and Private Directories follow the Feature List. Existing plans keep both on upgrade.
- Unlimited in hosting package counts (AB-2084): The count fields of the hosting package form say what 0 means. Where a field allows it, they say how to allow none.
- Current CPU usage on Metrics (AB-2025): The overall Current Usage on Health > Metrics shows the latest CPU sample, the same value as the Dashboard. The page states the period its statistics cover. The metrics history keeps 30 days.
- Pending certificates (AB-2116): A domain waiting for its first automatic certificate shows a pending certificate. It gives the reason and when AutoSSL tries again. One such reason is DNS that does not point at the server yet.
- Sign-in and setup (AB-2021, AB-2100, AB-2101, AB-2102): The email address entered during onboarding is saved on the admin account, so the admin signs in with it. The user menu links to My Profile. The admin login always leads to the admin panel. The login forms trim spaces around the username. They also say when the password starts or ends with a space. The setup wizard marks first and last name as optional.
- Impersonation banner (AB-2119): While an administrator impersonates an account, the admin pages name the account that is signed in to the client or reseller panel. Leave stays at hand.
- Mailing list recipients (AB-1965): The upgrade restores missing mailing list recipients and tells the administrator which lists changed.
bolt-cli repair-mailing-list-recipients runs the same repair.
- Reseller panel (AB-2002, AB-2132): Creating an API key in the reseller panel shows its secret once, ready to copy. Webhost Manager in the reseller panel shows the second root nameserver.
- Smaller fixes (AB-1223, AB-2117, AB-2178): A hosting account created with a chosen login shell gets that shell. The License page checks the trial confirmation again when you return to its tab. Set up bolt-livescan on Health > Security does not start while another security operation runs, like the other actions.
Install
curl -sSL https://get.adminbolt.com/install.sh | bash
Upgrade from 1.9.3
- Log in to the Admin Panel.
- Open Settings, then System Updates under System.
- Click Check for updates and review the release notes.
- Click Install update if a newer version is available.
