Everything you need to run WebDeck.

Overview

WebDeck is a hosting control panel for Linux servers. It installs and manages the full stack — web server, PHP, database, mail, DNS and SSL — and gives you, your resellers and your customers an interface to run it all from.

It's designed to be installed on a fresh server and to take care of everything from there. You don't configure Apache by hand, you don't write DNS zones, and you don't set up DKIM yourself — WebDeck does it.

What it manages

• Web: Apache, nginx or OpenLiteSpeed, with multiple PHP versions
• Mail: Postfix and Dovecot, with DKIM, SPF and DMARC
• DNS: PowerDNS, authoritative, with your own nameservers
• Database: MySQL/MariaDB, with phpMyAdmin
• SSL: Let's Encrypt, issued and renewed automatically
• Backups: restic and rclone, local and off-site

Requirements

Supported operating systems

• Debian 11, 12, 13
• Ubuntu 20.04, 22.04, 24.04
• Rocky Linux 8, 9, 10
• AlmaLinux 8, 9, 10
• RHEL 8, 9

Minimum server

• 1 vCPU, 1 GB RAM, 10 GB disk — enough to run the panel and a few small sites
• A fresh install of a supported OS — WebDeck expects to own the stack
• Root access
• A public IPv4 address

Recommended for production

• 2+ vCPU, 4 GB RAM, 40 GB+ SSD
• Correct reverse DNS (rDNS) on the IP — mail deliverability depends on it
• Port 25 open outbound if you're sending mail directly

Installation

One command on a fresh server. The installer detects your distribution, installs the stack, configures everything and starts the panel.

Step 1 — download and run

It takes a few minutes — it's installing a full hosting stack. You'll see each step as it completes.

Step 2 — open the panel

At the end, the installer prints your server's free hostname — an address like:

Use it. It carries a browser-trusted certificate, so the panel loads with a padlock and no warnings. The direct IP (https://YOUR-IP:2087) works too, but uses a self-signed certificate and shows a warning.

Step 3 — keep the MySQL password

The installer prints your MySQL root password and saves it to /opt/vm6panel/.env. Keep it somewhere safe.

First-run setup

The first time you open the panel, a wizard walks you through the essentials. There are no config files to edit.

1. Licence — VM6 Networks clients are licensed automatically by server IP and skip this step. Everyone else enters a licence key, or clicks Start a 14-day free trial for full features with no key.
2. Admin account — your username, email and password. Use a strong password; this account controls the server.
3. Nameservers — the ns1 / ns2 hostnames your DNS will be served from. You'll point these at your server's IP with your domain registrar.
4. Web server — Apache, nginx or OpenLiteSpeed. You can switch later without rebuilding sites.
5. Mail — set up the mail server, or skip it if you're using an external provider.
6. Done — you land on the dashboard.

Setting up your nameservers

To serve DNS for customer domains you need glue records at your registrar:

1. Register a domain for your nameservers (e.g. yourhost.com)
2. At the registrar, create host records / glue records: ns1.yourhost.com → your.server.ip and ns2.yourhost.com → your.server.ip
3. Enter those hostnames in the panel's Nameservers step

Logging in

There are three ways into WebDeck, depending on who you are:

• Admin / reseller — the panel at port 2087
• Customers — the same address; they see only their own account
• Webmail — customers can open webmail from inside the panel

Two-factor authentication

Enable TOTP two-factor from Security. Scan the QR code with any authenticator app. Strongly recommended for admin accounts.

Websites

Adding a website creates everything it needs in one step: the virtual host, the document root, the DNS zone, an SSL certificate and a PHP pool.

Adding a site

1. Go to Websites → Add website
2. Enter the domain and choose a PHP version
3. WebDeck creates the vhost, DNS zone and requests an SSL certificate

Per-site options

• Force HTTPS — redirect all traffic to the secure version
• Page caching — a quick speed boost for static-heavy sites
• PHP version — change per site at any time
• Edit PHP Settings — memory limit, upload size, execution time and more, for that site alone
• Directory privacy — password-protect a folder
• Analytics — visits, top pages, referrers and errors, built from the server's own logs (no tracking scripts)

SSL certificates

WebDeck issues free Let's Encrypt certificates and renews them automatically.

How it works

1. Point the domain's DNS at your server (an A record to your IP)
2. Add the site in WebDeck
3. WebDeck requests a certificate as soon as the domain resolves
4. Renewal happens automatically, well before expiry

Free panel hostname

Every WebDeck install is assigned a free hostname under wd-server.co.uk — for example srv-a1b2c3.wd-server.co.uk — pointing at your server, with a browser-trusted HTTPS certificate.

This gives you a clean, padlocked panel address from the very first minute, before you've set up any of your own domains.

How it works

1. On boot, the panel claims its hostname and the DNS record is published
2. It fetches a trusted certificate and installs it into the web server
3. The certificate is kept renewed automatically — you do nothing

PHP versions & settings

Multiple versions

Install several PHP versions and assign them per site — a legacy app on 7.4 and a modern one on 8.3, on the same server. Go to PHP Versions to install or remove versions.

Modules

Sixty-five modules can be toggled on and off per PHP version — gd, imagick, redis, intl, soap, ionCube and the rest. WebDeck installs the right package for your distribution and reloads the right service, so a toggle takes effect immediately.

Per-site settings

Click Edit PHP Settings on any website to change:

• memory_limit — how much memory a script may use
• upload_max_filesize — largest uploadable file
• post_max_size — largest form submission
• max_execution_time — how long a script may run
• max_input_time, max_input_vars
• display_errors — leave off on live sites

Settings apply to that website only, take effect immediately, and can't affect any other site on the server. Admins, resellers and customers can all use it, each for the sites they manage.

Databases

Create MySQL/MariaDB databases and users from Databases. Each user can be scoped to a single database.

• phpMyAdmin is built in — one click from the panel
• Backups include your databases automatically
• Remote access can be enabled per user if an external app needs it

DNS & nameservers

WebDeck runs PowerDNS as an authoritative nameserver. Zones are created automatically when you add a site.

Editing records

Go to DNS Records, pick a domain, and edit A, AAAA, CNAME, MX, TXT, SRV and CAA records. Mail records (MX, SPF, DKIM, DMARC) are written for you when mail is set up.

Adding a secondary nameserver

A second nameserver on a different server means DNS keeps working if one box goes down. WebDeck can set one up remotely:

1. Go to Nameservers
2. Enter the second server's IP and root password
3. WebDeck installs and configures PowerDNS there and starts zone transfers

Email accounts

WebDeck runs Postfix and Dovecot. Create mailboxes per domain from Email.

• Mailboxes — unlimited per domain, with quotas if you want them
• Aliases and forwarders
• Catch-all addresses
• Webmail — customers open it from inside the panel

Connecting a mail client

WebDeck publishes autoconfig and autodiscover records, so Outlook and Thunderbird set themselves up from just the email address and password. Manual settings:

• IMAP: mail.yourdomain.com, port 993, SSL/TLS
• SMTP: mail.yourdomain.com, port 587, STARTTLS
• Username: the full email address

Deliverability — DKIM, SPF and DMARC

This is what stops your customers' mail landing in spam, and WebDeck sets it up for you rather than leaving it as homework.

• DKIM — a signing key is generated per domain and the DNS record published automatically
• SPF — a record authorising your server to send for the domain
• DMARC — a policy record telling receivers what to do with mail that fails the checks

The deliverability checker

Go to Email → Deliverability to see, per domain, whether DKIM, SPF, DMARC and rDNS are correct — and exactly what to fix if they aren't.

SMTP relay

Some providers block outbound port 25, and some IP ranges have a poor sending reputation. You can route all outbound mail through a relay instead.

1. Go to Settings → Mail Relay
2. Enter the relay host, port, username and password
3. Outbound mail is routed through the relay from then on

Works with any SMTP relay — a commercial sending service, or your own.

Backups

WebDeck backs up websites, databases, mail, DNS and the panel's own configuration. Backups are deduplicated and encrypted (restic under the hood).

Setting up scheduled backups

1. Go to Backup Manager
2. Choose a destination — local disk, SFTP, or any rclone remote (S3, Backblaze B2, Google Drive and others)
3. Set the schedule and how many copies to keep

Backup self-test

The self-test verifies that a backup can actually be restored — not just that it exists. Run it occasionally. An untested backup isn't a backup.

Disaster recovery

WebDeck can rebuild an entire server from a backup onto a brand-new machine.

Rebuilding a dead server

1. Install WebDeck on the new server as normal
2. Go to Backup Manager → Restore
3. Point it at your backup destination
4. Choose a full restore

Accounts, packages, websites, databases, mail, DNS zones and panel settings are all restored.

Restoring one website

You can also roll a single site back without touching anything else — and customers can restore their own sites from the backups you manage, scoped to their own domains.

Resellers & packages

WebDeck has four roles: admin, master reseller, reseller and user.

Packages

A package defines what an account gets — disk, bandwidth, number of websites, databases and email accounts. Create packages under Packages, then assign them when creating accounts.

Allocation and overselling

When you create a reseller you allocate them a pool — disk, bandwidth, account slots and site slots. They can only hand out what they've been given. WebDeck refuses to let a reseller oversell their pool.

What resellers can see

Resellers manage their own customers and nothing else. They never see the server, its settings, or other resellers' customers.

White-label branding

Under Branding you can set the panel's name, logo, favicon and accent colour.

Branding cascades: a reseller's customers see the reseller's brand, not yours. If a reseller sets no brand of their own, they inherit the brand above them.

Security

• Two-factor authentication (TOTP) — enable it on admin accounts
• fail2ban — bans IPs that brute-force; managed from the panel
• Firewall — manage rules from the interface
• Login rate limiting — cap attempts per minute per IP
• API keys — scoped keys for automation
• Audit log — every administrative action, with who and when

Account isolation

WebDeck confines each customer to their own website's files, so one account can't read another's data or exhaust the server. It's on by default for new accounts and needs no configuration — and unlike the big panels, it doesn't require a CloudLinux licence.

What you get

• Filesystem confinement — each SFTP/SSH account is jailed to its own site's folder. It cannot see other customers' files, or browse the wider system.
• Resource limits — CPU, memory and process caps per account, so a single customer can't fork-bomb or hog the box.
• Process cage (optional) — where the kernel supports it, an optional bubblewrap cage also stops a tenant seeing other tenants' running processes.

New accounts

Every SFTP/SSH account created in WebDeck is isolated automatically. There's nothing to enable and nothing to remember — it's simply how accounts are made.

Existing accounts

Accounts that existed before you upgraded are left exactly as they are. Nothing changes until you choose. To confine one, go to Server → Isolation, find the account and click Isolate. Its files and access are unchanged — it's simply contained. Un-isolate reverses it.

The Isolation page

Server → Isolation shows every SFTP/SSH account on the server, which website it belongs to, and whether it's isolated. It also tells you what your server supports — resource limits, and whether the process cage is available. If the cage isn't available, install bubblewrap and click Refresh.

Self-healing

If a jail's mount or configuration is ever lost — after a reboot, or a manual change — WebDeck repairs it automatically. You can see what it fixed in the self-heal activity feed on the Server dashboard.

Updates

WebDeck updates itself. New releases are fetched, applied and verified — and if an update fails to come back up, it rolls itself back automatically.

You can also update on demand from Settings → Updates, and see exactly what changed in each release.

Migrating from cPanel

The cPanel importer reads standard cPanel backup archives and recreates the account in WebDeck — websites, databases, email accounts, DNS records and files.

Importing an account

1. Generate a full backup in cPanel (or a cpmove archive in WHM)
2. In WebDeck, go to cPanel Importer
3. Upload the archive, or pull it directly from the old server
4. Review what was found, then import

Moving a whole server

Bulk import handles many accounts at once — point it at a directory of archives, or at the old server, and let it work through them.

After importing

• Check DNS — point the domains at the new server when you're ready to cut over
• SSL certificates are requested once DNS resolves to the new box
• Test mail before switching MX records

WHMCS module

The WebDeck WHMCS module provisions accounts automatically when an order is paid, and handles the whole lifecycle after that — suspensions, upgrades, usage sync and terminations. It's free.

Installing it

1. Download the module from the WHMCS module page
2. Copy the webdeck/ folder to modules/servers/webdeck/ on your WHMCS server
3. In WebDeck, go to Settings → API and create an API key. Lock it to your WHMCS server's IP
4. In WHMCS: System Settings → Servers → Add New Server. Type WebDeck, hostname = your panel, port 2087, tick Secure, and paste the API key into Access Hash
5. Click Test Connection — it should go green
6. Create a hosting product, choose WebDeck under Module Settings, then pick a package (they load live from your panel) and an account level

What it syncs

• Create, suspend, unsuspend, terminate — on WHMCS's normal schedule
• Package changes — upgrades and downgrades
• Password changes from WHMCS
• Usage — disk and bandwidth, nightly, one API call per server
• Single sign-on — clients click through from the WHMCS client area and land in the panel already logged in

Selling resellers

Set Account Level on the product: Normal User, Reseller or Master Reseller. Make a separate product for each level you want to sell.

API keys

WebDeck has a REST API for automation. Create keys under Settings → API.

• Lock keys to an IP wherever you can — a key that only works from one address is far safer than one that works from anywhere
• Scope them to what they need
• Revoke a key the moment it's not needed

The API is what the WHMCS module uses, and you can use it for your own automation — provisioning, monitoring, or wiring WebDeck into whatever else you run.

What your customers can do

When a customer logs in they see only their own account — never the server, never anyone else. Here's what's available to them, so you know what you're selling.

Websites

• See their sites, SSL status and PHP version
• Edit PHP Settings — memory limit, upload size, execution time
• Toggle Force HTTPS and page caching
• View analytics — visits, top pages, referrers, 404s
• Password-protect directories

Email

• Create mailboxes, aliases and forwarders
• Open webmail without leaving the panel
• Get the settings for Outlook, Thunderbird or their phone

Files & databases

• File manager — browse, upload, edit, download
• FTP accounts
• Create databases and users; open phpMyAdmin
• Cron jobs

Backups

• Restore their own site from the backups you manage — scoped to their own domains, restore only, they can't touch anyone else's

Apps

• Install WordPress and thirty-seven other applications in one click, with the database created and SSL live from the start

One-click apps

Thirty-eight applications install properly — database created, permissions set, config written, SSL working from the first request. Go to Apps on a website, pick one, and it's up in a minute or two.

Websites & blogs

• WordPress — plus a WordPress + WooCommerce variant
• Ghost, Drupal, Grav, Pico, Bludit, HTMLy
• Laravel — for developers starting a project

E-commerce

• WooCommerce, Magento, PrestaShop, OpenCart

Business, CRM & billing

• SuiteCRM, Dolibarr — CRM and ERP
• Invoice Ninja, Akaunting, Firefly III — invoicing and accounts
• Kimai — time tracking
• Snipe-IT — IT asset management
• Monica — personal CRM
• WHMCS — needs your own licence

Support & helpdesk

• osTicket, GLPI

Files, docs & productivity

• Nextcloud — file sync and share
• BookStack, DokuWiki, MediaWiki — docs and wikis
• Kanboard — project boards
• wallabag, Shaarli — read-later and bookmarks
• Moodle — learning management

Community, media & tools

• HumHub — your own social network
• Piwigo — photo gallery
• Matomo — privacy-friendly analytics
• Roundcube, phpList, FreshRSS, Cachet

Files, FTP & cron

File manager

Browse, upload, download, rename, delete and edit files straight in the panel. Useful for a quick config fix without opening SSH.

FTP accounts

Create FTP accounts per site under FTP Accounts. Each is scoped to its own home directory — an FTP user can't wander into another site's files.

• Host: the domain or the server IP
• Port: 21 (FTP) — use FTPS where your client supports it
• Username: as created in the panel

Cron jobs

Create scheduled tasks under Cron Jobs. Standard cron syntax, with common schedules available as presets if you'd rather not remember the fields.

Troubleshooting

Most problems fall into a handful of categories, and nearly all of them are fixable in a couple of minutes once you know where to look. If yours isn't here, email us — we'd genuinely rather hear about it than have you struggle.

The panel won't load at all

Work through these in order:

1. Is the panel running? systemctl status vm6panel
2. Is the web server running? systemctl status apache2 (or httpd on Rocky/Alma, or nginx)
3. Is port 2087 open — both in the server's firewall and at your VPS provider? A lot of providers have their own firewall in front of the box.
4. Check the panel's log: journalctl -u vm6panel -n 50

"Your connection is not private" warning

If you're on the IP address, that's expected — the IP uses a self-signed certificate. Use your server's free hostname instead (the installer printed it, and it's shown in the panel). That address has a proper trusted certificate.

If you're on the hostname and still see a warning, the certificate may not have been fetched yet. Give it a minute, then reload. Chrome caches certificate errors aggressively — try an incognito window to be sure.

An SSL certificate won't issue for a customer's site

Nearly always DNS. Let's Encrypt has to reach the domain from the public internet, so:

1. Check the domain resolves to your server: dig +short thedomain.com
2. If it doesn't show your server's IP, the A record is wrong or hasn't propagated yet — fix that first, then wait
3. Once DNS is right, run self-heal from the dashboard and it'll pick the certificate up

Email is going to spam

Go to Email → Deliverability. It checks everything and tells you exactly what's wrong. The usual culprits, in order of how often they're the problem:

1. Missing reverse DNS (rDNS/PTR) — set this with your VPS provider so your IP resolves back to your mail hostname. Without it, a lot of receivers will bin your mail no matter what else you do.
2. SPF, DKIM or DMARC missing — WebDeck sets these up, but if the domain's DNS is hosted elsewhere you'll need to copy the records across.
3. A poor-reputation IP range — some VPS ranges are simply distrusted. If that's you, use an SMTP relay.

Mail isn't sending at all

• Is port 25 outbound blocked? Many providers block it by default and will unblock on request. Test with telnet gmail-smtp-in.l.google.com 25
• Check the mail queue in the panel under Logs — it'll show what's stuck and why
• If port 25 is blocked and your provider won't open it, use an SMTP relay

A website shows the wrong content, or "It works!"

Usually a virtual host that didn't get written, or a DNS record pointing somewhere unexpected. Run self-heal from the dashboard — it rebuilds missing or drifted vhost configuration. If it persists, check the domain actually resolves to this server.

A PHP module won't enable

The error message names the packages it tried. If none of them were found, that module may not be packaged for your PHP version on your distribution. Tell us which module and which OS and we'll add the right package name — it's usually a one-line fix in the next release.

A site is slow

• Check the dashboard — is the server itself under load?
• Turn on page caching for the site
• Raise the site's memory limit under Edit PHP Settings if it's a heavy app like Magento
• Make sure OPcache is enabled (PHP Versions → modules)
• Look at Resource Usage to see which account is using what

I've locked myself out

If fail2ban has banned your IP, you'll need console access from your VPS provider. Then: fail2ban-client set sshd unbanip YOUR.IP.HERE

If you've forgotten the admin password, you can reset it from the server — ask support and we'll walk you through it.

An update went wrong

WebDeck rolls itself back automatically if an update fails to come back up. If you're stuck on an old version, check Settings → Updates for the error, and send it to us.

Where are the logs?

• Panel: journalctl -u vm6panel -f
• Install log: /var/log/webdeck-install.log
• Web, mail and panel logs: in the panel under Logs
• Mail queue: mailq

Glossary

Hosting is full of jargon. Here's the plain-English version of the terms you'll meet in WebDeck — no shame in checking.

• A record — a DNS entry that points a domain at an IP address.
• DKIM — a cryptographic signature on outgoing mail proving it really came from your domain. Big deal for not landing in spam.
• SPF — a DNS record listing which servers are allowed to send mail for your domain.
• DMARC — a DNS record telling receivers what to do with mail that fails SPF and DKIM.
• rDNS / PTR — reverse DNS. Makes your IP resolve back to a hostname. Set it with your VPS provider; mail deliverability depends on it.
• MX record — the DNS entry saying which server receives mail for a domain.
• Virtual host (vhost) — the web server's configuration for one website. WebDeck writes these for you.
• Document root — the folder on disk that a website is served from.
• PHP-FPM — the process manager that runs PHP for nginx and modern Apache setups.
• Let's Encrypt — the free certificate authority WebDeck uses for SSL.
• Propagation — the delay between changing a DNS record and the world seeing the change.
• TTL — how long DNS resolvers cache a record before checking again.
• Reseller — an account that can create and manage its own customers, within a quota you allocate.
• Self-heal — WebDeck's engine that rebuilds missing configuration and repairs drift automatically.

Getting support

WebDeck is built and maintained by VM6 Networks Ltd — a small UK hosting company. There's no support ticket queue with fifty people in front of you; you email us and we read it.

Bug reports genuinely get fixed, often in the next release. If something's broken, wrong, confusing, or just annoying — tell us. We'd much rather know.

How to get help fast

Email support@vm6.co.uk and include:

• Your OS and version — e.g. "Rocky Linux 9"
• Your WebDeck version — shown in the top-right of the panel
• What you were doing when it broke
• The exact error, copied and pasted — a screenshot works too
• Anything from the logs — journalctl -u vm6panel -n 50

That's usually enough for us to spot it straight away. If it's a bug, you'll normally see the fix in the next release with a note in the changelog.