Every release and what changed in it, newest first. WebDeck updates itself — and rolls back automatically if an update fails to come up.
SEO tools for your customers, a panel that keeps its own permissions healthy, and dark mode by default
SEO tools. A new SEO Tools page in the customer panel gives every website a search-engine check-up. One click scans the site and gives it a score out of 100 with a plain list of what to fix — missing page titles and descriptions, headings, image descriptions (alt text), mobile layout, sharing previews and insecure links. Build sitemap creates a sitemap.xml from the site’s pages, and Submit to search engines sends them to Bing, Yandex and others straight away through IndexNow. Google no longer accepts automatic submissions from anyone, so rather than pretend, WebDeck walks you through the quick one-off Search Console setup. With AI switched on, Get AI advice turns the results into a short, prioritised to-do list in plain English. How to use SEO tools →
Permissions that look after themselves. The self-healing checks now keep file permissions in a safe, working state too. If something drifts — the web server dropping out of a site’s group (the classic cause of a sudden “403 Forbidden”), a WordPress wp-config.php left readable by everyone, a certificate key left too open, or the panel’s own settings file and database becoming readable by other accounts — WebDeck puts it back on its next pass and logs exactly what it changed. Riskier fixes are reported for you to review rather than applied blindly.
Dark mode and Aurora by default. New installs open in dark mode with the Aurora interface from the very first screen, with no flash of the older design while the panel loads. Prefer light mode? It’s one click, and your choice is remembered.
Under the hood: smarter website building. The AI builder’s engine can now tell when a request needs a full application rather than a page — a shop needs WordPress and WooCommerce, a blog needs WordPress, a forum needs phpBB — and prepare a set of example products and a step-by-step “how to run your shop” PDF. It only ever chooses from WebDeck’s own vetted list of apps. The button for this arrives in the Website Builder in a coming update.
Security hardening. Every new feature went through the same penetration testing as the rest of the panel, plus an independent review:
Tested. More than 800 automated checks ship inside the release and run on the server itself. It was also tested end-to-end on a freshly installed server, where two isolated customer accounts tried to read, change and delete each other’s files, reach each other’s databases, escape through planted shortcuts and reach each other’s sites through the API. Every attempt to reach the other customer was refused — and the one gap the test did find, the panel’s settings file being readable on an older install, is fixed in this release.
Updating by hand? Also run /opt/vm6panel/venv/bin/pip install fpdf2 so shop guides are produced as PDFs (without it they’re made as a printable web page). If your panel was installed with an older version, it’s worth confirming /opt/vm6panel/.env is -rw------- root only — this release corrects it automatically.
An AI website builder, and a deep round of security hardening across the file, installer, database and reseller code
AI website builder. Describe the site you want in plain English and WebDeck builds it in front of you — a full, responsive page that appears live in a preview as it is generated, so you watch it take shape rather than waiting for a result. Change your mind as you go: undo and redo step back and forward through the versions, and the builder acknowledges each change so you always know where you are. The preview sits beside the chat on a desktop and drops below it on a phone, so you can scroll straight down to it on mobile. When it looks right, publish puts it live on the site in one click. Long generations stream as they are produced and stop cleanly if nothing comes back, so the page never hangs.
Security hardening. A thorough penetration-testing round across the parts of the panel that run as root on behalf of a customer, closing the classes of issue that matter most on a shared server:
Nothing here needs any action on your part — it is all on by default the moment you update.
Tested. Over 650 automated checks ship inside the release and run on the server itself, alongside interface render checks. Every security fix in this release was proven on a live web server — the exact attack is shown working against the old code and refused by the new code — so a fix is only shipped once it is demonstrated, not assumed.
Per-site isolation, a new Aurora interface, three brand colours, and a deep round of security hardening
Per-site isolation. Each website can now run as its own system user, so code running on one site can never read or change another site's files — a real operating-system boundary between accounts, not just a software check. Apps that keep data outside their web folder, such as WHMCS, are detected and handled automatically. New sites get this on by default; existing ones switch on when you are ready, under Site Isolation, where a single page shows how many of your sites are isolated at a glance.
A new look — “Aurora”. WebDeck ships with a modern default theme: a clean, dark, glassy interface with your brand colours running right through it, including live charts on the dashboard. It is fully responsive and takes far less space on phones and tablets. Two other themes remain a click away under Branding → Interface template — Classic (the original) and Console (flat and lightweight) — all three in light and dark.
Three brand colours. Set an accent, a secondary (the gradient’s second colour) and a third colour for positive and success highlights. All three apply across every theme and cascade to the accounts beneath you, so your resellers and customers see your branding, not ours. Changes preview live as you pick them.
Security hardening. A thorough round of fixes across SSH and SFTP accounts, backups, file uploads, cPanel imports, account management and mailbox limits — closing the classes of issue that matter most on a shared server, several of them found by independent external review. SFTP and SSH accounts are now strictly confined and fail safe if setup is interrupted; backups and imports can only ever act on files that belong to the account; archive handling is hardened against malicious files; first-run setup is protected by a one-time code. Nothing here needs any action on your part.
Tested. Over 400 automated checks ship inside the release and run on the server itself, alongside interface render checks and repeated penetration testing of the isolation, backup and archive code — with the per-site isolation proven on a live web server: one site cannot read another’s files over the web, by shell, or by scheduled task.
A built-in web application firewall, parked domains, hotlink protection, and a redesigned interface
Web Application Firewall. WebDeck now has a built-in WAF — ModSecurity with the OWASP Core Rule Set — that inspects requests before they reach a site and recognises the common attack shapes: SQL injection, cross-site scripting, path traversal, scanners. It installs in detection-only mode and changes nothing for visitors until you choose to block; protection levels are named in plain English (Balanced, Strict, Aggressive, Maximum) with the panel flagging which are safe to run while blocking. The admin page shows the rules firing most, so you can switch off any that trip your own traffic before enabling blocking. Works on Apache and nginx; every config change is applied with a config test and automatic rollback so a bad rule can never take the web server down. Each customer also gets their own firewall view — the detections on their domains, and per-site control on Apache — scoped so one account never sees another's.
Parked domains. Point an extra
domain at an existing site — an alternate spelling, a .net as well as a
.com, another brand you own. Add it under Parked Domains, point its DNS at
the server, and SSL is added automatically on the next renewal. A domain can only be parked by
the account that owns it — it is checked against every other site and parked domain on
the server, so one customer can never alias a domain belonging to someone else.
Hotlink protection. Stop other websites embedding your images and burning your bandwidth. Your own pages, direct visits and search engines are unaffected — only other sites displaying your images are blocked, and there is an allow-list for a CDN or a partner site. Under Hotlink Protection, per site.
A redesigned interface. The v2 — Modern template has been reworked into a cleaner, lighter dark-console style — flat panels, crisper labels, steady metrics — and every page now carries a short line explaining what it is for. It is lighter on your device than before, works in light and dark, and carries your branding throughout. v1 — Classic is unchanged; nothing switches unless you pick it in Branding → Interface template.
Sturdier self-repair. The engine that keeps WebDeck's own configuration healthy is more robust: each check now has a time limit, so one slow or hung check can no longer stall the rest; a scheduled repair and one you trigger by hand can no longer overlap; and a problem that keeps recurring is flagged as a persistent fault rather than looking like a one-off.
Tested. Over 300 checks ship inside the release and run on the server itself, alongside an interface render check and a penetration test of the firewall and the new domain tools — covering config injection, cross-tenant access, path traversal and argument injection. The WAF in particular was tested against a live ModSecurity: detection logs attacks without blocking, blocking returns 403 to malicious requests while ordinary traffic is untouched.
A second interface design, point-in-time backups you can restore one file from, and a round of security work
Two interface templates. WebDeck now ships v1 — Classic, exactly the interface you have today, and v2 — Modern: softer surfaces, rounded cards, cleaner typography and a redesigned sidebar. Both work in light and dark, and both carry your branding — in v2 your accent colour flows through the highlights, gradients and focus states rather than sitting on top of a fixed palette. Choose it under Branding → Interface template. It previews as you click, applies to accounts beneath you, and nothing switches on its own.
Restore a single file, not the whole site. Restoring used to mean restoring everything — right when a server dies, wrong when one config file gets overwritten. WebDeck can now keep incremental snapshots alongside the usual archives. Each snapshot restores on its own but stores only what changed since the last, so nightly snapshots cost a fraction of nightly full backups. Open one from the account's Backups page and browse it like a file manager — folders load a level at a time, so a large site opens immediately instead of enumerating every file first — then restore an individual file, a whole folder, or a single database from that day, leaving everything else untouched.
A schedule described in plain
terms. Backup settings now sit in one place, Settings → Backups:
Full backup every day or once a week on a day you choose, and Incremental
snapshots off or every night, keeping 7 to 90 days. The usual pairing is a full backup
weekly with snapshots nightly — a complete, portable .tar.gz archive, plus
the ability to recover one file from any day, without pushing the whole site off-site every
night. Snapshots are off by default and need restic on the server; existing
backups carry on unchanged until you turn them on.
Stop advertising your web server's version. Apache and nginx announce their exact version in every response and on error pages, which is the first thing an automated scanner reads. A switch under Settings → Server identity turns that off. The server still identifies itself by name — neither can drop the header entirely without extra modules — but the version, which is the part that maps to a list of exploits, disappears. Applied with a config test and automatic rollback, so a bad state cannot take the web server down.
Security work carried over from 2.2.6 and 2.2.7. Those two versions were internal, so if you are coming from 2.2.5 you get their fixes here as well. Two privilege-escalation flaws in FTP and mailbox creation where a value inside an authorised request was not checked against the caller's own website; backup restores now scoped so an uploaded archive cannot reach another account's database; account imports constrained to the import folder; login-token signing pinned to HMAC; and licence responses from the update server are now signed and verified by the panel, so a spoofed server cannot lock a panel out or alter its entitlements.
PowerDNS self-repair. Enrolling a secondary nameserver could write a setting that a newer PowerDNS rejects, leaving the daemon unable to start — no DNS for any zone, while the panel itself looked healthy. WebDeck now validates settings against what the installed PowerDNS actually accepts, applies config changes transactionally and rolls them back if the daemon does not come up, and repairs a stopped PowerDNS on boot and from the repair button. If an earlier version left PowerDNS down, 2.2.8 fixes it on first start.
Fixes. The Restore button on the account Backups page could fail on some backups; the Settings page could come up blank after an update; the panel could serve a stale page after an upgrade, needing a forced refresh; and a harmless warning repeated hourly in the system log. All fixed.
Tested. A 198-check suite ships inside the release and runs on the server itself, alongside a render check over the interface and a penetration test of the new backup endpoints covering cross-account access, path traversal and argument injection. Panels update themselves; no hard refresh needed this time. As with any new backup feature, do a test restore of a single file on a site you control before you need it in a hurry.
Secondary DNS — put a full copy of every zone on a second machine, with one command
A secondary nameserver cluster. One nameserver is a single point of failure: if the box goes down, every customer's DNS goes with it. WebDeck can now enrol a second machine as a secondary nameserver. You paste one command on the new box and it installs PowerDNS, configures itself as a secondary of your panel, opens the right firewall rules and registers itself back — then every zone transfers over AXFR and is kept in step from then on. There is no cap on how many secondaries you add. See the documentation for the walkthrough.
No root credentials leave the panel. Enrolment uses a single-use token that expires after 60 minutes, not SSH keys or a root password. That also means it works on boxes where SSH from the panel simply would not — root login disabled, key-only auth, a non-standard port, NAT or a bastion in the way. The token is stored only as a hash, and the secondary's API key is encrypted at rest and never returned by the panel's API.
Your zones actually use the new nameserver. Copying zones is only half the job — a domain will not use a nameserver that its NS records never mention. Once a secondary is confirmed to be answering, WebDeck adds it to the NS records of every zone it manages, using the same publish path as the Nameservers page. A secondary that is still starting up is deliberately left out, because advertising a nameserver before it answers just makes lookups slow. Custom NS records — a third-party nameserver at the apex, or a delegated subdomain — are preserved untouched, and zones the panel does not manage are never rewritten.
Retire a nameserver without breaking anything. Once a healthy secondary exists you can disable one of the server's own nameservers from the Secondary DNS page — useful when moving DNS onto dedicated machines. WebDeck refuses to do it if the result would leave you with fewer than two working nameservers.
Guards against the bad day. Zone transfer has no concept of "this zone was deleted", so WebDeck reconciles instead. That reconciler will refuse to delete anything if the primary reports zero zones, waits for a zone to look orphaned twice in a row before removing it, and stops and asks for confirmation rather than removing more than five zones or a fifth of the total at once. A glitch on the primary cannot cascade into wiping your secondaries.
Clear status, in plain English. Each secondary shows how many zones are in sync, its PowerDNS version, OS and when it was last seen. A box that is up but still waiting for records reads as healthy rather than as an outage, and connection problems are explained in words you can act on instead of a raw error.
Works across distributions and PowerDNS versions. Debian 12+, Ubuntu 22.04+, and AlmaLinux, Rocky or RHEL 9+ each get the right packages, config paths, firewall and SELinux handling. PowerDNS renamed its replication settings at 4.5 and removed the old names at 4.9, so the installer detects the version on the box and writes whichever names that build accepts.
Tested. A 43-check suite covering the reconciler's guards, the enrolment flow and the API, plus config validated against a real PowerDNS daemon and an end-to-end enrolment on Debian 13. Panels update themselves; hard-refresh the browser after updating.
Simpler first run, drag-to-reorder websites, and stronger self-healing on every stack
A simpler install, and a proper introduction to web stacks. The web-server question has been removed from the setup wizard — every install now starts on LAMP, which is the safe default. The first time you log in, a short one-time guide explains what LAMP, LNMP and LOMP actually mean and lets you either stay on LAMP (recommended if you're not sure) or switch there and then. Because the guide appears after setup has finished and the panel already holds a real certificate, switching can no longer collide with the install.
Drag to reorder your websites. On the Websites page, grab a site card by its handle and drop it where you want it. The order is remembered per customer, so the sites you care about stay at the top.
Stronger self-healing across every stack. The per-site PHP repairs that previously only ran when the server booted — shared-master repair, socket relabelling, per-site PHP services, OpenLiteSpeed handlers — now also run on the routine background check and whenever you press Reconcile. A site that drifts out of shape is put back on whatever stack is live, without a reboot.
No misleading CPU field on OpenLiteSpeed. On LOMP, PHP runs through LSAPI and sits outside the per-site container, so a per-site CPU quota can't be enforced. Rather than let you set a number that silently does nothing, the CPU limit is now hidden on that stack with a short explanation. RAM and process limits still apply as normal.
Messages stay on screen long enough to read. Confirmation messages now stay up for between 5 and 12 seconds depending on how much they have to say, instead of a fixed few seconds.
Tested. Verified on AlmaLinux with a 30-check acceptance suite and a full cross-stack run over LAMP, LNMP and LOMP. Panels update themselves; hard-refresh the browser after updating.
One customer's PHP can no longer read another's files — plus a complete clean-up on delete
Cross-tenant filesystem isolation.
Every website with its own PHP environment is now confined to its own folder, its own private
temporary directory (used for sessions, uploads and temp files) and the read-only system PHP
libraries — and nothing else. One customer's PHP can no longer read another customer's
files, including things like a neighbouring site's wp-config.php database
password. The jail isn't a customer-editable setting and PHP refuses to widen it from a
.user.ini, so it can't be turned off from inside a site. It applies on all three
stacks. Note: this covers sites that have their own PHP environment; a fully default
site still shares the web user. Per-site Linux users are planned separately.
Websites on OpenLiteSpeed served the control panel instead of their own content. On LOMP, sites could return the panel's page with a 404 rather than their own site. Fixed and verified serving correctly.
Changing a per-site PHP module or setting could fail with an error. On Apache and nginx a fault in the reload path returned a server error instead of applying the change. Fixed.
Deleting an account or a website now removes everything. All delete paths run one thorough clean-up that removes the databases, the SFTP and FTP logins, the per-site PHP service, the resource pool, the cron file, the DNS zone, the web-server configuration and the files. No more orphaned system users, pools or databases left behind after a delete.
Isolation is no longer lost during a repair. When WebDeck rebuilds a missing web-server configuration, a site keeps its own PHP environment instead of quietly dropping back to the shared one — on both PHP-FPM and OpenLiteSpeed.
Suspension now cascades. Suspending an account also locks its SFTP and FTP access and applies to its sub-accounts.
Verified with two full cross-stack runs on AlmaLinux across LAMP, LNMP and LOMP.
Switching web stacks made reliable — and per-site PHP made solid on Rocky and Alma
Two follow-up releases to 2.2.0 that hardened switching between Apache, nginx and OpenLiteSpeed, and fixed the RHEL-family problems that per-site PHP environments exposed. Recommended for every server.
502 and 503 errors on Rocky and AlmaLinux. PHP sockets were being given a security label that the web server wasn't allowed to connect to, so sites could fail with a bad-gateway error. Labels are now applied correctly, in the right order, and a sweep repairs every existing socket at boot, on every stack switch and whenever a site is set up — so the first site on a new server can no longer be left broken.
Switching stacks no longer gets stuck or rolls back. Fixed a race where the outgoing web server grabbed port 80 back before the new one could start, and fixed the health check that made every switch to OpenLiteSpeed roll back even when it had worked. Rollback paths were audited so a failed switch always restores a running server.
OpenLiteSpeed serves the right site. Domain mappings are now always written, and OpenLiteSpeed's stock catch-all — which swallowed every hostname and could hand visitors the wrong site — is removed. The panel keeps its own listener on 2087.
nginx now works on RHEL-family systems. The PHP configuration nginx used was Debian-only, so nginx never worked properly on Rocky or Alma. It now uses portable settings.
Per-site memory limits behave. A site's own memory limit is respected again instead of being overridden by the pool, with the hardware RAM cap remaining the real ceiling.
Per-site PHP environments — every website gets its own isolated PHP
The big one. Every website now runs its own
PHP environment — its own version, its own extensions, its own php.ini
settings and its own kernel-enforced CPU/RAM/process limits — on a dedicated per-site
php-fpm master. It's the per-tenant isolation people buy CloudLinux for, built in.
Smoke-test on one server before rolling out to the fleet.
Per-site PHP modules. Each customer enables or disables their own extensions (ionCube, ImageMagick, Redis…) on their site alone, with zero effect on any other website. This closes a cross-tenant issue where toggling a module previously applied server-wide for that PHP version.
Per-site settings & version, unified with isolation. A site's PHP version, php.ini settings, modules and hardware caps now all live on one per-site master. Already-isolated sites keep every cap and gain per-site modules automatically.
Safe by design. A bad module change is auto-reverted so it can never take a site down, and a site falls back to the shared master if its own can't start. Panels self-update; hard-refresh after updating.
Cleaner Websites page with usage bars, subdomains and Site Health
Redesigned Websites page. Each site now shows clean live usage bars for CPU, RAM, tasks, disk and traffic, with a tidier action layout.
Subdomains. Create and manage subdomains for a website in one click — own docroot, vhost and DNS.
Site Health. Per-site checks for files, permissions and SSL, with safe one-click fixes (permissions repair backs up before it touches anything; .htaccess reset keeps a backup).
Fixed. Pages now always open at the top when you switch between them.
Email forwarders, DNS pointing helper, customer SSH keys and malware scan
Email forwarders & catch-all. Customers can forward addresses and set a catch-all from their own panel.
“Point your domain here.” A live check that tells a customer whether their domain is pointing at the server yet.
Customer SSH keys & on-demand malware scan. Customers manage their own authorized SSH keys and can run a ClamAV scan of their site on demand.
Hardened SSH jails, fairer rate limiting, WordPress manager polish
Hardened isolation jails. Per-site
SSH jail mounts are now mounted nosuid,nodev, and existing jails are migrated to
match on upgrade.
Fairer rate limiting. The expensive-operation limit was raised and now only counts state-changing requests, so normal browsing of the panel never trips it.
WordPress manager polish. Clearer naming and a one-click “install WordPress now” action.
Security hardening — backend only, no action required
A backend-only security release with no interface, database or configuration changes. Recommended for all servers; panels update themselves automatically.
Hardened API-key IP allow-list.
Provisioning endpoints now resist X-Forwarded-For header spoofing when matching an
API key's IP allow-list, so a request can't disguise its origin to slip past the lock.
Closed a reseller privilege path. Removed a route that could let a reseller assign their own package a dedicated resource pool — resource pools are admin-only. No action required.
Dedicated pools cascade to reseller sites; resellers get view-only isolation
Reseller websites inherit the pool. When a reseller is on a dedicated resource pool, every website they create — and every website their own customers create — is now automatically built inside that pool, isolated with the same CPU, RAM and process caps. Set 4 GB on a reseller plan and each site across their whole account is capped at 4 GB.
Isolation is admin-only. Resellers can now view their pool settings but can't change them — CPU, RAM and process limits are set by the provider. Resellers keep full control of dividing their disk, bandwidth, website and account allowances among their customers, as before.
Unlimited limits, unlimited-site provisioning, and full reseller cleanup
Unlimited now works everywhere. Every limit field — disk, bandwidth, websites, sub-accounts, email, databases, FTP — has a clear Unlimited tickbox. Tick it and the number box disappears; untick to enter a value. Previously marking a limit unlimited on the Edit Resources panel could save as zero.
Unlimited websites provisions correctly. A package set to unlimited websites now creates the customer's site on signup, instead of reading "unlimited" as "none".
Reseller termination cleans up fully. Terminating a reseller in WHMCS now removes everything that belonged to them — their own hosting account, all their customers, and every website and database underneath — scoped to that reseller only, and without failing if a single resource is stubborn.
Dedicated resource pools for packages
Shared or dedicated, per package. Every package now has a Shared / Dedicated toggle. Shared works as before — sites use the server's default PHP pool. Switch to Dedicated and you set CPU, RAM and process caps that each website on that plan runs inside, isolated in its own pool. The caps pre-fill from your global isolation defaults, so you edit from sensible starting values.
It cascades. On a reseller plan, the dedicated pool flows down to every website the reseller and their customers create — assigned and isolated automatically at creation. If a server can't apply isolation for any reason, the site is still created on the shared pool; provisioning never fails.
Package types, account limits, and unlimited support
Package types. Packages now have a type — Normal User, Reseller or Master Reseller — chosen from a dropdown. The type decides what kind of account the package creates, so provisioning (including from WHMCS) makes the right account automatically. Reseller and Master Reseller packages let you set how many accounts they can create, shown as readable "How many User / Reseller accounts" fields.
Enforced hardware limits. A package's CPU, RAM and process limits are now applied to the account, so they're actually enforced by isolation rather than being set and ignored.
Unlimited, done properly. A cPanel-style Unlimited tickbox across the limit fields, with the underlying handling fixed so unlimited is stored and honoured rather than clamped to zero.
Websites created on provisioning, and cleaner reseller hosting
Provisioning creates the website. When an account is provisioned with a domain (for example from a WHMCS order), the website is now created and set up as part of provisioning, with a landing page ready to go.
Reseller websites in one place. A reseller's own websites now live in their personal hosting area, reachable with the same top-of-panel switch they use to move between managing customers and running their own sites.
Accurate isolation metrics on every platform
Correct cgroup readings. Isolated-site resource readings now come straight from systemd, so RAM and process usage report accurately on the full range of supported platforms rather than occasionally showing flat or zero values.
Per-site resource history graphs, isolation logs, and five more apps
Resource history graphs. Every isolated site now has a View history button on its card, showing RAM and process usage over time (1 hour, 24 hours or 7 days) with the cap drawn as a reference line. A lightweight collector samples each isolated site's real usage about once a minute; storage is strictly bounded so it never grows without limit.
Isolation logs in the admin Logs page. You can now read an isolated site's own PHP-FPM log straight from the Logs page — handy for spotting a site that's hitting its limits.
Five more one-click apps. WonderCMS, Baïkal (CalDAV/CardDAV), Leantime, Microweber and Typemill — bringing the library to 57 applications.
Live account usage, and a Cancel button
Live usage on the customer home. The account summary box now shows CPU, memory and tasks in use right now, alongside disk, websites and SSL — so customers can see their real resource use at a glance.
Cancel button on Edit caps. The isolation Edit caps box now has a Cancel button to close it without saving changes.
Shared-pool protection and self-healing
A per-site pool can never take down the shared PHP server. Isolated sites are now fully independent — each with its own PHP-FPM process, PHP version, config, socket and resource caps — and can no longer interfere with the shared pool that other sites run on.
Boot-time self-heal. On startup WebDeck now checks each shared PHP master and automatically recovers it if a stray or stale per-site pool ever left it in a bad state — without touching anything it doesn't own.
Per-site resource isolation
Real per-site CPU, RAM, process and disk-I/O caps. Give any site its own capped PHP process so it can't starve the others — enforced by the Linux kernel, not just PHP. Set caps per site or per account, with an Isolation control centre for defaults and bulk actions. The whole thing runs with SELinux left enforcing — no need to disable it, and no CloudLinux required.
Notification bell, and a mobile menu fix
Notification bell. A bell in the header, on desktop and mobile, with an unread count. Click it to see recent alerts — services going down or being auto-healed, backups, low disk space, security events, updates. It works whether or not email notifications are set up. Your customers get their own bell showing alerts about their own websites.
Mobile menu now scrolls properly. On phones, the navigation menu couldn't be scrolled past the first few items, and dragging on it moved the page behind instead. Fixed — the menu scrolls on its own, and the page behind stays put while it's open.
Other improvements. Settings tabs are easier to swipe through on mobile, and the menu closes with the Escape key.
Email notifications, and security hardening
Email notifications. WebDeck can now email you when things happen on your server — a service going down (or being auto-healed), backups completing or failing, low disk space, security events, panel updates and new accounts. There's a Notifications tab in Settings with a toggle for each alert. Your customers get their own toggles for alerts about their own sites (SSL, backups, suspension) — you set the defaults, they can override their own. It works out of the box through the local mail server, with an optional SMTP relay for reliable delivery, a test-email button, and a built-in rate limit so a busy server can't flood your inbox.
phpMyAdmin sign-on hardened. The panel session token no longer travels in the URL when you open phpMyAdmin. Sign-on now uses a single-use, 30-second ticket instead.
Stronger two-factor. Two-factor login now rejects reused codes, and turning 2FA on requires your password — so a stolen session can't add an authenticator to your account.
Five more apps — 53 in total
Five more one-click apps — 53 in total. Typecho and Grav (lightweight CMSs), YOURLS (URL shortener), LinkAce (bookmark manager) and Chamilo (e-learning). Each installs the same way as the rest — database, permissions and SSL set up for you.
phpMyAdmin single sign-on, and several important fixes
phpMyAdmin single sign-on now works. Opening phpMyAdmin from the panel logs you straight in to the right database, rather than landing on its login screen.
Stored database passwords are kept safe. The encryption key for saved database passwords is now held independently, so it survives panel restarts and updates.
Update reliability. Updates now report clearly when something goes wrong instead of failing silently, missing dependencies are repaired automatically, and configuration is refreshed on in-place updates.
Other hardening. Closed a setup-page issue on misconfigured servers, tightened the WHMCS and login handling, and stopped database passwords appearing in the server's process list.
Security review — findings verified and fixed
Community security review. Following a review on the LowEndSpirit forum, five issues in the 2.0.x line were each verified against the real code and fixed: every server now obtains its own SSL certificate with its private key generated locally and never shared; panel updates are cryptographically signed and unsigned updates are refused; stored database passwords use proper authenticated encryption; network and licence errors are logged with their real cause; and the panel generates a strong, unique signing key on first boot.
Our approach. Invite scrutiny, verify every claim against the real code before responding, fix what's real, and say so plainly. That posture matters as much to us as any individual fix.
Free and Pro plans, with a 14-day Pro trial
WebDeck now comes in two tiers. Free gives you 2 hosting accounts and 4 websites with every feature included — account isolation, all 48 one-click apps, free SSL, DNS, mail, backups and the WordPress manager. Pro (pricing to be confirmed) unlocks unlimited accounts and websites, plus reseller accounts. A flat fee, however many customers you host.
14-day Pro trial. One click at install gives you every Pro feature for 14 days. No licence key, no card.
Your websites never go down. This is the rule the whole model is built around. If a trial ends or a subscription lapses, nothing is suspended, disabled or deleted — every website keeps serving and every mailbox keeps receiving. You simply drop to the Free tier limits, so you can't create new accounts or websites until you're back under them or you upgrade. A licence should never take a customer's website offline.
Free for VM6 Networks clients. Host with VM6 and you get the full Pro version at no cost, licensed automatically by server IP. Nothing to enter, nothing to renew.
Ten more apps — 48 in total — and an account cleanup fix
Ten more one-click apps — 48 in total. Joomla and Concrete CMS (websites), phpBB and Flarum (forums), Mautic and EspoCRM (marketing and CRM), LimeSurvey (surveys), phpMyFAQ (knowledge base), Chevereto (image hosting) and Pydio Cells (file sharing).
Deleting a website now removes its SFTP/SSH accounts. Previously the account was left behind with no website attached, showing as an orphan on the Isolation page. It's now cleaned up properly, along with its jail.
Account isolation, service logs in the panel, and a cross-platform overhaul
Account isolation. Every new SFTP/SSH account is now automatically confined to its own website's files and can't see other customers on the server. Resource limits cap CPU, memory and processes per account, so one customer can't exhaust the box. An optional process cage (bubblewrap) also hides other tenants' processes where the kernel supports it. A new Isolation page shows every account's status with one-click controls, and it self-heals if a mount or config is ever lost. Existing accounts are untouched — isolate them individually whenever you choose. No CloudLinux licence required.
Service logs, in the panel. Live Apache, MariaDB, PHP, mail, DNS and FTP logs straight from the Logs page — no SSH needed. There's also a self-heal activity feed on the Server dashboard so you can see exactly what the panel repaired and when.
Cross-platform reliability. A large chunk of this release was hunting down the differences between Debian-family and RHEL-family systems. Websites now configure correctly on Rocky and AlmaLinux, PowerDNS starts reliably under SELinux, PHP version selection only offers versions actually installed (and switches instantly), and the ionCube Loader installs correctly everywhere.
A more resilient installer. Transient package-mirror failures are retried rather than aborting the install, and the FTP server and process-isolation tools are set up for you automatically.
Security hardening. Every server is guaranteed a strong, unique signing key — the panel will never run with an insecure default. Rate-limiting now covers credential and expensive operations without getting in the way of normal use, and downloaded install scripts are verified before they run rather than piped straight to a shell.
Everyday improvements. Clear login errors ("incorrect username or password", not a confusing "session expired"), no forced password change right after setup, longer sessions, SFTP/FTP homed to the domain folder so private files can live outside the web root, and PHP module toggles that respond instantly and follow the selected PHP version.
Joomla, EspoCRM and phpBB are back. Their upstream downloads are working again, and they return in 2.0.1 along with seven more.
38 one-click apps, 65 PHP modules, and important app-installer fixes
Thirteen more apps — 38 in total. osTicket and GLPI (helpdesk), SuiteCRM, Dolibarr, Invoice Ninja, Akaunting, Firefly III, Kimai, Snipe-IT and Monica (business and CRM), wallabag and Shaarli (productivity), Pico and Bludit (websites), HumHub (community), and Piwigo (photo gallery).
Composer is now included. Several popular applications ship as source code with their dependencies missing — download them yourself and they fail on the first page load. WebDeck now installs those dependencies as part of the install, so Snipe-IT, Kimai, HumHub, Monica and Invoice Ninja actually run.
Apps stay current on their own. The installer asks each project what its latest release is at the moment you install, rather than relying on a version baked into WebDeck.
Fixed .zip extraction. WebDeck could only unpack .tar archives, so any app shipping as a .zip failed to install — this affected Grav, Matomo, OpenCart, PrestaShop and others. All install correctly now. Matomo and OpenCart were also being unpacked into the wrong place; both fixed.
65 PHP modules, up from 46. snmp, mcrypt, memcache, msgpack, amqp, oauth, uuid, zstd, brotli, smbclient, maxminddb, pcov, pspell, enchant, shmop and the SysV set — on every OS and web stack.
Joomla, EspoCRM and phpBB temporarily removed. Their download servers are currently returning errors. They'll return as soon as upstream is working — we'd rather remove an app than offer one that fails to install.
Status bar, cleaner navigation & per-site PHP settings
Per-site PHP settings. A new Edit PHP Settings button on every website lets admins, resellers and customers set memory limit, upload size, execution time, input variables and error display — per site, applied instantly, with no effect on any other site. Works on Apache, nginx and OpenLiteSpeed across every supported OS.
Server status bar. OS, kernel, load average and WebDeck version now show in the top-right of the panel. Load is colour-coded so you can spot a struggling server at a glance.
Cleaner navigation. The sidebar is now grouped into Hosting, Server, Tools and Configuration rather than one long list.
A dashboard that tells you what to do. The health card now lists each problem as its own item — which sites, what's wrong, and what fixes it — instead of one run-on summary line.
7-day free trial, PHP modules on every OS, licence management
7-day free trial. Install WebDeck on any host and start a free trial in one click at the licence step — every feature unlocked, including the free hostname and trusted SSL, with no key and no card. A countdown banner shows how long is left.
PHP modules on every OS and stack. Module toggles now work across Debian, Ubuntu, RHEL, Rocky and Alma, on Apache, nginx and OpenLiteSpeed. RHEL-family servers previously couldn't manage modules at all. Fourteen new modules added, bringing the total to 65.
PHP module self-heal. On boot and on demand, WebDeck now repairs broken module configuration — clearing orphaned files and neutralising entries that point at missing extensions.
Licence management. Settings → Licence gained a Refresh button and a Change licence key option. Both verify with the licence server before saving, so a bad key can't be saved.
Free panel hostname with trusted SSL, analytics, customer restore
A free hostname with a valid certificate. Every install is assigned a hostname like srv-a1b2c3.wd-server.co.uk with a browser-trusted HTTPS certificate — so the panel loads with a padlock from the very first minute, before you've pointed any domain at the box. No more "your connection is not private" on a fresh install.
Website analytics. Each site gets a privacy-friendly Analytics tab built from the server's own access logs — visits, top pages, referrers, 404s and errors. No tracking scripts, no third parties, nothing added to the site.
Customer self-restore. Customers can now restore their own sites from backups their host manages centrally — restore only, scoped to their own domains.
Licence keys for non-VM6 servers. VM6 clients stay licensed automatically by IP. Other servers activate with a licence key entered during setup.
Disaster recovery & login hardening
Rebuild a server from a backup. Restore an entire server — accounts, websites, databases, mail, DNS and panel configuration — onto a brand-new machine.
Backup self-test. Verifies that a backup can actually be restored, not just that it exists. An untested backup isn't a backup.
Login hardening. Configurable rate limits on panel logins and unauthenticated API requests.