Release notes

Secondary DNS — put a full copy of every zone on a second machine, with one command

A secondary nameserver cluster. One nameserver is a single point of failure: if the box goes down, every customer's DNS goes with it. WebDeck can now enrol a second machine as a secondary nameserver. You paste one command on the new box and it installs PowerDNS, configures itself as a secondary of your panel, opens the right firewall rules and registers itself back — then every zone transfers over AXFR and is kept in step from then on. There is no cap on how many secondaries you add. See the documentation for the walkthrough.

No root credentials leave the panel. Enrolment uses a single-use token that expires after 60 minutes, not SSH keys or a root password. That also means it works on boxes where SSH from the panel simply would not — root login disabled, key-only auth, a non-standard port, NAT or a bastion in the way. The token is stored only as a hash, and the secondary's API key is encrypted at rest and never returned by the panel's API.

Your zones actually use the new nameserver. Copying zones is only half the job — a domain will not use a nameserver that its NS records never mention. Once a secondary is confirmed to be answering, WebDeck adds it to the NS records of every zone it manages, using the same publish path as the Nameservers page. A secondary that is still starting up is deliberately left out, because advertising a nameserver before it answers just makes lookups slow. Custom NS records — a third-party nameserver at the apex, or a delegated subdomain — are preserved untouched, and zones the panel does not manage are never rewritten.

Retire a nameserver without breaking anything. Once a healthy secondary exists you can disable one of the server's own nameservers from the Secondary DNS page — useful when moving DNS onto dedicated machines. WebDeck refuses to do it if the result would leave you with fewer than two working nameservers.

Guards against the bad day. Zone transfer has no concept of "this zone was deleted", so WebDeck reconciles instead. That reconciler will refuse to delete anything if the primary reports zero zones, waits for a zone to look orphaned twice in a row before removing it, and stops and asks for confirmation rather than removing more than five zones or a fifth of the total at once. A glitch on the primary cannot cascade into wiping your secondaries.

Clear status, in plain English. Each secondary shows how many zones are in sync, its PowerDNS version, OS and when it was last seen. A box that is up but still waiting for records reads as healthy rather than as an outage, and connection problems are explained in words you can act on instead of a raw error.

Works across distributions and PowerDNS versions. Debian 12+, Ubuntu 22.04+, and AlmaLinux, Rocky or RHEL 9+ each get the right packages, config paths, firewall and SELinux handling. PowerDNS renamed its replication settings at 4.5 and removed the old names at 4.9, so the installer detects the version on the box and writes whichever names that build accepts.

Tested. A 43-check suite covering the reconciler's guards, the enrolment flow and the API, plus config validated against a real PowerDNS daemon and an end-to-end enrolment on Debian 13. Panels update themselves; hard-refresh the browser after updating.

Simpler first run, drag-to-reorder websites, and stronger self-healing on every stack

A simpler install, and a proper introduction to web stacks. The web-server question has been removed from the setup wizard — every install now starts on LAMP, which is the safe default. The first time you log in, a short one-time guide explains what LAMP, LNMP and LOMP actually mean and lets you either stay on LAMP (recommended if you're not sure) or switch there and then. Because the guide appears after setup has finished and the panel already holds a real certificate, switching can no longer collide with the install.

Drag to reorder your websites. On the Websites page, grab a site card by its handle and drop it where you want it. The order is remembered per customer, so the sites you care about stay at the top.

Stronger self-healing across every stack. The per-site PHP repairs that previously only ran when the server booted — shared-master repair, socket relabelling, per-site PHP services, OpenLiteSpeed handlers — now also run on the routine background check and whenever you press Reconcile. A site that drifts out of shape is put back on whatever stack is live, without a reboot.

No misleading CPU field on OpenLiteSpeed. On LOMP, PHP runs through LSAPI and sits outside the per-site container, so a per-site CPU quota can't be enforced. Rather than let you set a number that silently does nothing, the CPU limit is now hidden on that stack with a short explanation. RAM and process limits still apply as normal.

Messages stay on screen long enough to read. Confirmation messages now stay up for between 5 and 12 seconds depending on how much they have to say, instead of a fixed few seconds.

Tested. Verified on AlmaLinux with a 30-check acceptance suite and a full cross-stack run over LAMP, LNMP and LOMP. Panels update themselves; hard-refresh the browser after updating.

One customer's PHP can no longer read another's files — plus a complete clean-up on delete

Cross-tenant filesystem isolation. Every website with its own PHP environment is now confined to its own folder, its own private temporary directory (used for sessions, uploads and temp files) and the read-only system PHP libraries — and nothing else. One customer's PHP can no longer read another customer's files, including things like a neighbouring site's wp-config.php database password. The jail isn't a customer-editable setting and PHP refuses to widen it from a .user.ini, so it can't be turned off from inside a site. It applies on all three stacks. Note: this covers sites that have their own PHP environment; a fully default site still shares the web user. Per-site Linux users are planned separately.

Websites on OpenLiteSpeed served the control panel instead of their own content. On LOMP, sites could return the panel's page with a 404 rather than their own site. Fixed and verified serving correctly.

Changing a per-site PHP module or setting could fail with an error. On Apache and nginx a fault in the reload path returned a server error instead of applying the change. Fixed.

Deleting an account or a website now removes everything. All delete paths run one thorough clean-up that removes the databases, the SFTP and FTP logins, the per-site PHP service, the resource pool, the cron file, the DNS zone, the web-server configuration and the files. No more orphaned system users, pools or databases left behind after a delete.

Isolation is no longer lost during a repair. When WebDeck rebuilds a missing web-server configuration, a site keeps its own PHP environment instead of quietly dropping back to the shared one — on both PHP-FPM and OpenLiteSpeed.

Suspension now cascades. Suspending an account also locks its SFTP and FTP access and applies to its sub-accounts.

Verified with two full cross-stack runs on AlmaLinux across LAMP, LNMP and LOMP.

Switching web stacks made reliable — and per-site PHP made solid on Rocky and Alma

Two follow-up releases to 2.2.0 that hardened switching between Apache, nginx and OpenLiteSpeed, and fixed the RHEL-family problems that per-site PHP environments exposed. Recommended for every server.

502 and 503 errors on Rocky and AlmaLinux. PHP sockets were being given a security label that the web server wasn't allowed to connect to, so sites could fail with a bad-gateway error. Labels are now applied correctly, in the right order, and a sweep repairs every existing socket at boot, on every stack switch and whenever a site is set up — so the first site on a new server can no longer be left broken.

Switching stacks no longer gets stuck or rolls back. Fixed a race where the outgoing web server grabbed port 80 back before the new one could start, and fixed the health check that made every switch to OpenLiteSpeed roll back even when it had worked. Rollback paths were audited so a failed switch always restores a running server.

OpenLiteSpeed serves the right site. Domain mappings are now always written, and OpenLiteSpeed's stock catch-all — which swallowed every hostname and could hand visitors the wrong site — is removed. The panel keeps its own listener on 2087.

nginx now works on RHEL-family systems. The PHP configuration nginx used was Debian-only, so nginx never worked properly on Rocky or Alma. It now uses portable settings.

Per-site memory limits behave. A site's own memory limit is respected again instead of being overridden by the pool, with the hardware RAM cap remaining the real ceiling.

Per-site PHP environments — every website gets its own isolated PHP

The big one. Every website now runs its own PHP environment — its own version, its own extensions, its own php.ini settings and its own kernel-enforced CPU/RAM/process limits — on a dedicated per-site php-fpm master. It's the per-tenant isolation people buy CloudLinux for, built in. Smoke-test on one server before rolling out to the fleet.

Per-site PHP modules. Each customer enables or disables their own extensions (ionCube, ImageMagick, Redis…) on their site alone, with zero effect on any other website. This closes a cross-tenant issue where toggling a module previously applied server-wide for that PHP version.

Per-site settings & version, unified with isolation. A site's PHP version, php.ini settings, modules and hardware caps now all live on one per-site master. Already-isolated sites keep every cap and gain per-site modules automatically.

Safe by design. A bad module change is auto-reverted so it can never take a site down, and a site falls back to the shared master if its own can't start. Panels self-update; hard-refresh after updating.

Cleaner Websites page with usage bars, subdomains and Site Health

Redesigned Websites page. Each site now shows clean live usage bars for CPU, RAM, tasks, disk and traffic, with a tidier action layout.

Subdomains. Create and manage subdomains for a website in one click — own docroot, vhost and DNS.

Site Health. Per-site checks for files, permissions and SSL, with safe one-click fixes (permissions repair backs up before it touches anything; .htaccess reset keeps a backup).

Fixed. Pages now always open at the top when you switch between them.

Email forwarders, DNS pointing helper, customer SSH keys and malware scan

Email forwarders & catch-all. Customers can forward addresses and set a catch-all from their own panel.

“Point your domain here.” A live check that tells a customer whether their domain is pointing at the server yet.

Customer SSH keys & on-demand malware scan. Customers manage their own authorized SSH keys and can run a ClamAV scan of their site on demand.

Hardened SSH jails, fairer rate limiting, WordPress manager polish

Hardened isolation jails. Per-site SSH jail mounts are now mounted nosuid,nodev, and existing jails are migrated to match on upgrade.

Fairer rate limiting. The expensive-operation limit was raised and now only counts state-changing requests, so normal browsing of the panel never trips it.

WordPress manager polish. Clearer naming and a one-click “install WordPress now” action.

Security hardening — backend only, no action required

A backend-only security release with no interface, database or configuration changes. Recommended for all servers; panels update themselves automatically.

Hardened API-key IP allow-list. Provisioning endpoints now resist X-Forwarded-For header spoofing when matching an API key's IP allow-list, so a request can't disguise its origin to slip past the lock.

Closed a reseller privilege path. Removed a route that could let a reseller assign their own package a dedicated resource pool — resource pools are admin-only. No action required.

Dedicated pools cascade to reseller sites; resellers get view-only isolation

Reseller websites inherit the pool. When a reseller is on a dedicated resource pool, every website they create — and every website their own customers create — is now automatically built inside that pool, isolated with the same CPU, RAM and process caps. Set 4 GB on a reseller plan and each site across their whole account is capped at 4 GB.

Isolation is admin-only. Resellers can now view their pool settings but can't change them — CPU, RAM and process limits are set by the provider. Resellers keep full control of dividing their disk, bandwidth, website and account allowances among their customers, as before.

Unlimited limits, unlimited-site provisioning, and full reseller cleanup

Unlimited now works everywhere. Every limit field — disk, bandwidth, websites, sub-accounts, email, databases, FTP — has a clear Unlimited tickbox. Tick it and the number box disappears; untick to enter a value. Previously marking a limit unlimited on the Edit Resources panel could save as zero.

Unlimited websites provisions correctly. A package set to unlimited websites now creates the customer's site on signup, instead of reading "unlimited" as "none".

Reseller termination cleans up fully. Terminating a reseller in WHMCS now removes everything that belonged to them — their own hosting account, all their customers, and every website and database underneath — scoped to that reseller only, and without failing if a single resource is stubborn.

Dedicated resource pools for packages

Shared or dedicated, per package. Every package now has a Shared / Dedicated toggle. Shared works as before — sites use the server's default PHP pool. Switch to Dedicated and you set CPU, RAM and process caps that each website on that plan runs inside, isolated in its own pool. The caps pre-fill from your global isolation defaults, so you edit from sensible starting values.

It cascades. On a reseller plan, the dedicated pool flows down to every website the reseller and their customers create — assigned and isolated automatically at creation. If a server can't apply isolation for any reason, the site is still created on the shared pool; provisioning never fails.

Package types, account limits, and unlimited support

Package types. Packages now have a type — Normal User, Reseller or Master Reseller — chosen from a dropdown. The type decides what kind of account the package creates, so provisioning (including from WHMCS) makes the right account automatically. Reseller and Master Reseller packages let you set how many accounts they can create, shown as readable "How many User / Reseller accounts" fields.

Enforced hardware limits. A package's CPU, RAM and process limits are now applied to the account, so they're actually enforced by isolation rather than being set and ignored.

Unlimited, done properly. A cPanel-style Unlimited tickbox across the limit fields, with the underlying handling fixed so unlimited is stored and honoured rather than clamped to zero.

Websites created on provisioning, and cleaner reseller hosting

Provisioning creates the website. When an account is provisioned with a domain (for example from a WHMCS order), the website is now created and set up as part of provisioning, with a landing page ready to go.

Reseller websites in one place. A reseller's own websites now live in their personal hosting area, reachable with the same top-of-panel switch they use to move between managing customers and running their own sites.

Accurate isolation metrics on every platform

Correct cgroup readings. Isolated-site resource readings now come straight from systemd, so RAM and process usage report accurately on the full range of supported platforms rather than occasionally showing flat or zero values.

Per-site resource history graphs, isolation logs, and five more apps

Resource history graphs. Every isolated site now has a View history button on its card, showing RAM and process usage over time (1 hour, 24 hours or 7 days) with the cap drawn as a reference line. A lightweight collector samples each isolated site's real usage about once a minute; storage is strictly bounded so it never grows without limit.

Isolation logs in the admin Logs page. You can now read an isolated site's own PHP-FPM log straight from the Logs page — handy for spotting a site that's hitting its limits.

Five more one-click apps. WonderCMS, Baïkal (CalDAV/CardDAV), Leantime, Microweber and Typemill — bringing the library to 58 applications.

Live account usage, and a Cancel button

Live usage on the customer home. The account summary box now shows CPU, memory and tasks in use right now, alongside disk, websites and SSL — so customers can see their real resource use at a glance.

Cancel button on Edit caps. The isolation Edit caps box now has a Cancel button to close it without saving changes.

Shared-pool protection and self-healing

A per-site pool can never take down the shared PHP server. Isolated sites are now fully independent — each with its own PHP-FPM process, PHP version, config, socket and resource caps — and can no longer interfere with the shared pool that other sites run on.

Boot-time self-heal. On startup WebDeck now checks each shared PHP master and automatically recovers it if a stray or stale per-site pool ever left it in a bad state — without touching anything it doesn't own.

Per-site resource isolation

Real per-site CPU, RAM, process and disk-I/O caps. Give any site its own capped PHP process so it can't starve the others — enforced by the Linux kernel, not just PHP. Set caps per site or per account, with an Isolation control centre for defaults and bulk actions. The whole thing runs with SELinux left enforcing — no need to disable it, and no CloudLinux required.

Notification bell, and a mobile menu fix

Notification bell. A bell in the header, on desktop and mobile, with an unread count. Click it to see recent alerts — services going down or being auto-healed, backups, low disk space, security events, updates. It works whether or not email notifications are set up. Your customers get their own bell showing alerts about their own websites.

Mobile menu now scrolls properly. On phones, the navigation menu couldn't be scrolled past the first few items, and dragging on it moved the page behind instead. Fixed — the menu scrolls on its own, and the page behind stays put while it's open.

Other improvements. Settings tabs are easier to swipe through on mobile, and the menu closes with the Escape key.

Email notifications, and security hardening

Email notifications. WebDeck can now email you when things happen on your server — a service going down (or being auto-healed), backups completing or failing, low disk space, security events, panel updates and new accounts. There's a Notifications tab in Settings with a toggle for each alert. Your customers get their own toggles for alerts about their own sites (SSL, backups, suspension) — you set the defaults, they can override their own. It works out of the box through the local mail server, with an optional SMTP relay for reliable delivery, a test-email button, and a built-in rate limit so a busy server can't flood your inbox.

phpMyAdmin sign-on hardened. The panel session token no longer travels in the URL when you open phpMyAdmin. Sign-on now uses a single-use, 30-second ticket instead.

Stronger two-factor. Two-factor login now rejects reused codes, and turning 2FA on requires your password — so a stolen session can't add an authenticator to your account.

Five more apps — 53 in total

Five more one-click apps — 53 in total. Typecho and Grav (lightweight CMSs), YOURLS (URL shortener), LinkAce (bookmark manager) and Chamilo (e-learning). Each installs the same way as the rest — database, permissions and SSL set up for you.

phpMyAdmin single sign-on, and several important fixes

phpMyAdmin single sign-on now works. Opening phpMyAdmin from the panel logs you straight in to the right database, rather than landing on its login screen.

Stored database passwords are kept safe. The encryption key for saved database passwords is now held independently, so it survives panel restarts and updates.

Update reliability. Updates now report clearly when something goes wrong instead of failing silently, missing dependencies are repaired automatically, and configuration is refreshed on in-place updates.

Other hardening. Closed a setup-page issue on misconfigured servers, tightened the WHMCS and login handling, and stopped database passwords appearing in the server's process list.

Security review — findings verified and fixed

Community security review. Following a review on the LowEndSpirit forum, five issues in the 2.0.x line were each verified against the real code and fixed: every server now obtains its own SSL certificate with its private key generated locally and never shared; panel updates are cryptographically signed and unsigned updates are refused; stored database passwords use proper authenticated encryption; network and licence errors are logged with their real cause; and the panel generates a strong, unique signing key on first boot.

Our approach. Invite scrutiny, verify every claim against the real code before responding, fix what's real, and say so plainly. That posture matters as much to us as any individual fix.

Free and Pro plans, with a 14-day Pro trial

WebDeck now comes in two tiers. Free gives you 2 hosting accounts and 4 websites with every feature included — account isolation, all 48 one-click apps, free SSL, DNS, mail, backups and the WordPress manager. Pro (pricing to be confirmed) unlocks unlimited accounts and websites, plus reseller accounts. A flat fee, however many customers you host.

14-day Pro trial. One click at install gives you every Pro feature for 14 days. No licence key, no card.

Your websites never go down. This is the rule the whole model is built around. If a trial ends or a subscription lapses, nothing is suspended, disabled or deleted — every website keeps serving and every mailbox keeps receiving. You simply drop to the Free tier limits, so you can't create new accounts or websites until you're back under them or you upgrade. A licence should never take a customer's website offline.

Free for VM6 Networks clients. Host with VM6 and you get the full Pro version at no cost, licensed automatically by server IP. Nothing to enter, nothing to renew.

Ten more apps — 48 in total — and an account cleanup fix

Ten more one-click apps — 48 in total. Joomla and Concrete CMS (websites), phpBB and Flarum (forums), Mautic and EspoCRM (marketing and CRM), LimeSurvey (surveys), phpMyFAQ (knowledge base), Chevereto (image hosting) and Pydio Cells (file sharing).

Deleting a website now removes its SFTP/SSH accounts. Previously the account was left behind with no website attached, showing as an orphan on the Isolation page. It's now cleaned up properly, along with its jail.

Account isolation, service logs in the panel, and a cross-platform overhaul

Account isolation. Every new SFTP/SSH account is now automatically confined to its own website's files and can't see other customers on the server. Resource limits cap CPU, memory and processes per account, so one customer can't exhaust the box. An optional process cage (bubblewrap) also hides other tenants' processes where the kernel supports it. A new Isolation page shows every account's status with one-click controls, and it self-heals if a mount or config is ever lost. Existing accounts are untouched — isolate them individually whenever you choose. No CloudLinux licence required.

Service logs, in the panel. Live Apache, MariaDB, PHP, mail, DNS and FTP logs straight from the Logs page — no SSH needed. There's also a self-heal activity feed on the Server dashboard so you can see exactly what the panel repaired and when.

Cross-platform reliability. A large chunk of this release was hunting down the differences between Debian-family and RHEL-family systems. Websites now configure correctly on Rocky and AlmaLinux, PowerDNS starts reliably under SELinux, PHP version selection only offers versions actually installed (and switches instantly), and the ionCube Loader installs correctly everywhere.

A more resilient installer. Transient package-mirror failures are retried rather than aborting the install, and the FTP server and process-isolation tools are set up for you automatically.

Security hardening. Every server is guaranteed a strong, unique signing key — the panel will never run with an insecure default. Rate-limiting now covers credential and expensive operations without getting in the way of normal use, and downloaded install scripts are verified before they run rather than piped straight to a shell.

Everyday improvements. Clear login errors ("incorrect username or password", not a confusing "session expired"), no forced password change right after setup, longer sessions, SFTP/FTP homed to the domain folder so private files can live outside the web root, and PHP module toggles that respond instantly and follow the selected PHP version.

Joomla, EspoCRM and phpBB are back. Their upstream downloads are working again, and they return in 2.0.1 along with seven more.

38 one-click apps, 65 PHP modules, and important app-installer fixes

Thirteen more apps — 38 in total. osTicket and GLPI (helpdesk), SuiteCRM, Dolibarr, Invoice Ninja, Akaunting, Firefly III, Kimai, Snipe-IT and Monica (business and CRM), wallabag and Shaarli (productivity), Pico and Bludit (websites), HumHub (community), and Piwigo (photo gallery).

Composer is now included. Several popular applications ship as source code with their dependencies missing — download them yourself and they fail on the first page load. WebDeck now installs those dependencies as part of the install, so Snipe-IT, Kimai, HumHub, Monica and Invoice Ninja actually run.

Apps stay current on their own. The installer asks each project what its latest release is at the moment you install, rather than relying on a version baked into WebDeck.

Fixed .zip extraction. WebDeck could only unpack .tar archives, so any app shipping as a .zip failed to install — this affected Grav, Matomo, OpenCart, PrestaShop and others. All install correctly now. Matomo and OpenCart were also being unpacked into the wrong place; both fixed.

65 PHP modules, up from 46. snmp, mcrypt, memcache, msgpack, amqp, oauth, uuid, zstd, brotli, smbclient, maxminddb, pcov, pspell, enchant, shmop and the SysV set — on every OS and web stack.

Joomla, EspoCRM and phpBB temporarily removed. Their download servers are currently returning errors. They'll return as soon as upstream is working — we'd rather remove an app than offer one that fails to install.

Status bar, cleaner navigation & per-site PHP settings

Per-site PHP settings. A new Edit PHP Settings button on every website lets admins, resellers and customers set memory limit, upload size, execution time, input variables and error display — per site, applied instantly, with no effect on any other site. Works on Apache, nginx and OpenLiteSpeed across every supported OS.

Server status bar. OS, kernel, load average and WebDeck version now show in the top-right of the panel. Load is colour-coded so you can spot a struggling server at a glance.

Cleaner navigation. The sidebar is now grouped into Hosting, Server, Tools and Configuration rather than one long list.

A dashboard that tells you what to do. The health card now lists each problem as its own item — which sites, what's wrong, and what fixes it — instead of one run-on summary line.

7-day free trial, PHP modules on every OS, licence management

7-day free trial. Install WebDeck on any host and start a free trial in one click at the licence step — every feature unlocked, including the free hostname and trusted SSL, with no key and no card. A countdown banner shows how long is left.

PHP modules on every OS and stack. Module toggles now work across Debian, Ubuntu, RHEL, Rocky and Alma, on Apache, nginx and OpenLiteSpeed. RHEL-family servers previously couldn't manage modules at all. Fourteen new modules added, bringing the total to 65.

PHP module self-heal. On boot and on demand, WebDeck now repairs broken module configuration — clearing orphaned files and neutralising entries that point at missing extensions.

Licence management. Settings → Licence gained a Refresh button and a Change licence key option. Both verify with the licence server before saving, so a bad key can't be saved.

Free panel hostname with trusted SSL, analytics, customer restore

A free hostname with a valid certificate. Every install is assigned a hostname like srv-a1b2c3.wd-server.co.uk with a browser-trusted HTTPS certificate — so the panel loads with a padlock from the very first minute, before you've pointed any domain at the box. No more "your connection is not private" on a fresh install.

Website analytics. Each site gets a privacy-friendly Analytics tab built from the server's own access logs — visits, top pages, referrers, 404s and errors. No tracking scripts, no third parties, nothing added to the site.

Customer self-restore. Customers can now restore their own sites from backups their host manages centrally — restore only, scoped to their own domains.

Licence keys for non-VM6 servers. VM6 clients stay licensed automatically by IP. Other servers activate with a licence key entered during setup.

Disaster recovery & login hardening

Rebuild a server from a backup. Restore an entire server — accounts, websites, databases, mail, DNS and panel configuration — onto a brand-new machine.

Backup self-test. Verifies that a backup can actually be restored, not just that it exists. An untested backup isn't a backup.

Login hardening. Configurable rate limits on panel logins and unauthenticated API requests.