Changelog

0.9.37 – 0.9.38 — Central Operations and guarded updates Current

• Central Operations and Notifications. A new top-bar view tracks site imports, remote account migrations, Laravel deploys and malware scans through one shared status and progress model; running jobs refresh on their own and every row links to its detail screen.
• Panel updates now run pre-flight checks. Before an update starts, the database, free disk space, the backup tool, the current frontend and the nginx configuration are verified. If a blocking check fails, the update is refused both from the UI and from a direct API call; the existing rollback path is unchanged.
• Fixed a bug where, with idle session timeout enabled, a fresh login inherited the previous session's idle counter — a correct password could still be bounced straight back to the login screen.
• Settings cards now show loading, error and retry states explicitly; profile preference save errors are no longer swallowed silently.

0.9.33 – 0.9.36 — Malware scanning, security center and panel access control

• Malware and integrity scanning. PHP webshell content signals and writable-location heuristics combine into an explainable 0–100 risk score; weak signals alone never raise a finding. WordPress core files are verified against official checksums. Quarantine and undo never follow symlinks and refuse a changed source.
• Security notification center. Login attempts, ModSecurity/WAF events, malicious files and failed deploys/migrations are correlated over time windows; repeats are merged, a severity is assigned, and open/resolved state is managed from the panel.
• Panel access can be restricted. The panel API can be limited to an IPv4/IPv6 CIDR allowlist, with temporary access and a root recovery command. Bot and rate-limit profiles, exceptions and nginx-validated rollback were added for panel and domain traffic.
• Migration from cPanel, Plesk and DirectAdmin over SSH, as a background job. For Laravel: discovery, masked .env viewing, allowlisted Artisan commands, a deploy health gate and automatic rollback.
• HTTP/3 can be enabled through nginx capability detection; cache profiles for plain PHP, WordPress and PrestaShop shipped with session/cart/checkout bypass rules.
• Fixed the white page seen during a panel version update and the "this page failed to load" error on settings pages that returned empty lists; a global error boundary now keeps the menu and top bar alive when a page fails to render.

0.9.28 – 0.9.32 — Cloudflare, staging, safe imports and verified backups

• Cloudflare integration. The API token is stored AES-256-GCM encrypted after the connection is verified, and is never sent back to the browser. A domain binds to the active zone whose name matches exactly; DNS records can be listed, created, updated and deleted, orange-cloud proxying toggled, and the zone cache purged in one click.
• Real staging environments. Each staging site gets its own Linux user, PHP-FPM/vhost and database; WordPress, Laravel and PrestaShop connection settings are rewritten and search engines are blocked with X-Robots-Tag. Files and database can be pushed to live separately — a successful full backup of the live site is required first.
• Site import is now a background job. File extraction and SQL import report percentage, step and errors; on a partial failure the affected part is restored automatically and a competing import for the same domain is blocked. A local HTTP health check runs afterwards.
• PrestaShop operations toolkit. The panel discovers an installed store and summarises version, PHP, modules, cache, SSL and database health. Maintenance mode can be toggled, cache directories cleared and the application log viewed; a recovery point is mandatory before a maintenance-mode change.
• Backups are now verified. Archives are extracted safely, manifest/domain match and SHA-256 integrity are checked, and the SQL dump is actually restored into a random temporary schema with a single-use MariaDB account. The newest backups are re-tested periodically; if a digest changed, restore is blocked fail-closed.

0.9.19 – 0.9.27 — Reverse proxy, server maintenance and recovery drills

• Reverse Proxy site type. Node.js, Next.js and similar apps running on 127.0.0.1 can be published on a domain. WebSocket upgrades, the real client IP and X-Forwarded-* headers are supported; the target is restricted to loopback against SSRF, and if nginx -t fails the previous target is kept.
• Server Time card. Shows the active timezone and NTP sync state; the timezone can be selected and automatic sync toggled. If applying fails, the previous timezone is restored.
• Seven new server maintenance cards: automatic security updates, hostname / IP / PTR consistency check, disk and inode warning thresholds, kernel and reboot state, journald disk usage with safe vacuum, DNS resolver settings, and swap management.
• Recovery drills. The sanalcp-recovery-check tool verifies the latest panel database backup and can actually restore it into a random temporary database; a monthly systemd timer runs that drill automatically. If a health check fails, rollback now restores the frontend and migration directory as well as the binary and database.
• Disk quota loss on ext2/3/4 root filesystems after a new kernel entry was fixed permanently; maintenance cards were grouped into colour families.

0.9.13 – 0.9.18 — One-click application installs

• Applications menu. Install / update / remove from a single screen: WordPress, Joomla, Drupal, PrestaShop, OpenCart, Grav, Matomo, MediaWiki, Nextcloud and phpBB. Installs are per domain, and every installed app appears in one list.
• A registry-based driver architecture: each application declares its own PHP version range, database prefix and detection file, so adding one does not touch the rest of the panel.
• Real application icons on the app cards, and a fix for the breadcrumb link on domain sub-pages.
• Fixed a TMPDIR permission error that made WordPress updates fail.

0.9.8 – 0.9.12 — License number and the Manage Database page

• Manage Database page. A dedicated screen per database: size and character set, rename, several users on the same database, password changes; one-click gzip backup, restore from .sql/.sql.gz, optimise and repair. phpMyAdmin access moved to this page.
• License number card. Tools & Settings → Server maintenance shows the installation's unique identifier, with a copy button for support requests.
• An inode usage/limit indicator was added to the "Plan and Resources" card on the domain detail page.

0.9.2 – 0.9.7 — Security hardening and a password generator

• The panel session moved to an HttpOnly cookie — an XSS in the browser can no longer steal it.
• The plugin bundle endpoint was put behind authentication; long command output can no longer leak through error messages; antivirus scans got a concurrency limit.
• Secure password generator. A shared generator with a show/hide toggle on the account password, database password reset, mailbox and directory protection screens.
• The N+1 query in backup cleanup was collapsed into single statements; an ACME_STAGING flag was added for Let's Encrypt testing; ESLint was set up for the frontend and 33 accessibility issues were fixed.

0.9.0 – 0.9.1 — Panel login separated from root

• The panel has its own administrator account. Login no longer depends on the server's root password. New installs generate an admin account during setup — the password is only printed to the screen — and start with root login disabled.
• Nothing breaks on existing installs. Root login stays enabled; you can turn it off from Tools & Settings → Server Maintenance when ready. Turning it off does more than block new logins: root's live sessions are dropped and its API tokens are revoked.
• Two lockout guards: root login cannot be disabled unless another active administrator exists, and while root login is off the last administrator account cannot be deleted. SSH root access is unaffected.
• Lists are sorted alphabetically using Turkish collation (natural order kept, so db2 < db10); server maintenance cards moved to three columns on wide screens, and a Shut Down Server button was added — since it does not come back on its own, confirmation requires typing KAPAT.

0.8.0 — Debian and Ubuntu support

• The panel now installs on Debian 13 / 12 and Ubuntu 26.04 LTS / 24.04 LTS. All four were tested end to end on live servers. AlmaLinux/RHEL support continues unchanged; a single installer handles both families.
• On Debian, PHP packages come from the deb.sury.org repository (7.4 – 8.5).
• Disk quota fix. On the Debian family, quotas were silently lost from the second reboot onwards: accounting kept working and the numbers looked right, but no limit was enforced. This update repairs quotas without requiring a reboot.
• Disk quotas now work on both XFS and ext4 root filesystems.
• Idle PHP-FPM processes are stopped (a fresh Debian box was running seven versions at once).
• The Apache backend and vulnerability (CVE) scanning are not supported on Debian/Ubuntu; both now appear disabled in the panel with the reason stated. The Apache backend used to be selectable and selecting it took the site down with a 502 — sites left in that state are repaired automatically after the update.

0.7.1 — Emergency patch

• A database migration shipped in 0.7.0 was malformed and the panel would not start at all. 0.7.1 fixes only that. Do not use 0.7.0.
• The rollback path in the updater was hardened.

0.7.0 — Automatic intrusion blocking and management API

• Automatic intrusion blocking. The panel watches authentication failures from system services; an IP that crosses the threshold is blocked in nftables for a period. No separate service (fail2ban) is installed.
• Management API and API tokens added.

0.6.x — Backups, session security and UI

• Scheduled backups, one-click restore.
• Plan resource limits are now applied the moment the plan is saved — no panel restart needed.
• Many file manager and UI improvements.

0.5.x — Multi-user model and AlmaLinux 9 support

• Reseller/customer roles, service packages.
• AlmaLinux 9.4+ support.

How do I update?

You can see the installed version under Tools & Settings → Panel Update or in the page footer. Updates are applied with sanalcp-update; the database is backed up automatically before every update.