WebDeck 2.0.2 → 2.0.7: what’s changed, and why
It’s been a few releases since we last did a proper round-up, so here’s everything that’s landed in WebDeck since 2.0.2 — what we built, what we fixed, and the reasoning behind each one.
2.0.2 — Free and Pro, properly
This is where the licensing model settled. Free gives you 2 hosting accounts and 4 websites with every feature included — no crippled tier, no features locked behind a paywall on the free plan. Pro (£12/month per server) unlocks unlimited accounts and websites, plus reseller accounts, with a 14-day trial and no card required.
The rule the whole model is built around: a licence should never take a customer’s website offline. If a trial ends or a subscription lapses, nothing is suspended or deleted — every website keeps serving, every mailbox keeps receiving. You simply can’t create new accounts until you’re back under the Free limits or upgrade.
2.0.3 — A security review, taken seriously
Following a community review, we went through the 2.0.x codebase and verified every claim against the real code — not the description of the bug, the actual code path. Five issues were confirmed and fixed:
- Every server now generates its own unique SSL private key, locally, never shared
- Panel updates are cryptographically signed, and unsigned updates are refused
- Stored database passwords use proper authenticated encryption
- Network and licence errors are logged with their real cause, not swallowed silently
- Each install generates its own strong, unique signing key on first boot
Why it matters: a control panel sits at the centre of your server’s security. Outside scrutiny is useful, not something to be defensive about — we’d rather someone find a real issue and tell us than not find it at all.
2.0.4 — Fixing the update system itself
This one’s important: we found and fixed a bug where signed updates could fail to apply without any visible error — the panel would check for an update, find one, and silently do nothing. The root cause was in how the update signature was carried through the check; it’s fixed now, and update failures are logged and shown in the panel instead of disappearing.
Also in this release:
- phpMyAdmin single sign-on — opening it from the panel logs you straight in
- Database password encryption now survives panel restarts and updates
- Missing dependencies are repaired automatically on boot
- Database passwords no longer appear in the server’s process list
Why it matters: an update button you can’t trust is worse than no update button. This makes sure that when you click it, something actually happens — and if it doesn’t, you’re told why.
2.0.5 — Five more apps, 53 in total
Added Typecho and Grav (lightweight CMSs), YOURLS (your own URL shortener), LinkAce (a self-hosted bookmark manager) and Chamilo (e-learning). Each installs the same way as the rest of the catalogue — database created, permissions set, SSL live from the first request.
2.0.6 — Email notifications, and closing a real security gap
The headline feature: email notifications. WebDeck can now tell you when a service goes down (or gets auto-healed), a backup completes or fails, disk space is running low, or a security event happens — with a toggle for each alert. Your customers get the same, scoped to their own sites: SSL, backups, suspension, account changes.
Alongside that, two security fixes:
- phpMyAdmin sign-on hardened — the panel session token no longer travels in the URL when opening phpMyAdmin. It now uses a single-use, 30-second ticket instead.
- Stronger two-factor authentication — reused codes are now rejected, and turning 2FA on requires your password, so a stolen session alone can’t add an authenticator.
Why it matters: notifications mean you find out about a problem before a customer emails you about it. The security fixes close a real gap — session tokens simply shouldn’t end up in a URL, however convenient it is in the short term.
2.0.7 — A notification bell, and a mobile fix
Two things, both requested by people actually using the panel day to day:
- Notification bell — the same alerts as email, but right there in the panel header, on desktop and mobile, with an unread count. It works even if you’ve never touched the email settings — it’s a separate channel, not dependent on it.
- Mobile menu fixed — the navigation menu couldn’t be scrolled on a phone; anything below the first few items was unreachable. It scrolls properly now, and the page behind stays still while the menu’s open.
Why it matters: a control panel gets used from a phone more often than you’d think — at 2am, fixing something, standing in a server room that isn’t yours. It should work properly there.
The short version
| Version | Headline |
|---|---|
| 2.0.2 | Free and Pro tiers, 14-day trial |
| 2.0.3 | Security review — five issues verified and fixed |
| 2.0.4 | Fixed the update system itself, phpMyAdmin SSO |
| 2.0.5 | Five more apps — 53 in total |
| 2.0.6 | Email notifications, phpMyAdmin sign-on hardened, stronger 2FA |
| 2.0.7 | Notification bell, mobile menu fixed |
Full details on every release are on the release notes page. If you’re not running WebDeck yet, it’s free to download and install in a few minutes — grab it here.