v2.0.0-rc.4

Release candidate 4 for 2.0.0. It is not offered to boxes on a release; install it with clp-addons update --version=v2.0.0-rc.4 --allow-prerelease. A box already on a 2.0.0 release candidate is offered it by a plain clp-addons update.

DNS

• A pending zone's nameservers on a site's SSL/TLS tab sit side by side on desktop and stack on phones. Clicking a name or its clipboard icon copies that nameserver.
• The Change log card shows before anything is logged. Empty, it says so, and while DNS asks first it says that is why nothing has been written.

Panel Tweaks

• A site's Logs tab no longer turns each log line into a card on a phone. Its four controls sit two to a row, and an access log's date sits above its line so the line gets the full width.
• A phone's Desktop site mode keeps the Sites table instead of switching to cards. A narrow desktop window and a phone in its normal mode still get cards.

Instatic

• The create form has Back instead of Cancel. Opened from CloudPanel's New Site page it returns there; opened from Instatic it returns to the dashboard, even after a reload.

Addons page

• New and Changed badges belong to the exact release that set them, release candidates included. Updating clears older badges and their notes even if nobody opened them.

Full Changelog: v2.0.0-rc.3...v2.0.0-rc.4

v2.0.0-rc.3

Release candidate 3 for 2.0.0. It is not offered to boxes on a release; install it with clp-addons update --version=v2.0.0-rc.3 --allow-prerelease. A box already on a 2.0.0 release candidate is offered it by a plain clp-addons update.

DNS

• Ask first and Automatic. One switch for the whole addon replaces each profile's Report only / Enforce. Ask first, the default, reads Cloudflare and Mailcow and writes nothing; a bar above the sites counts what is waiting and offers Review and turn on Automatic. After that one review, every check keeps records in line, applies zone options and creates missing zones. An older policy file is read as Automatic only if every profile with sites enforced. (#203)
• A change log records every write: its time, sites, zone, value before and after, and what caused it. The page shows the latest 10, with up to 200 behind a disclosure. (#203)
• The token link always asks for Zone: Edit, and a refused zone create says so plainly. (#203)
• While a site's zone is pending, the site's SSL/TLS tab shows the nameservers to set at the registrar, each with its own copy icon. It promises an automatic certificate only when one was requested. (#204, #205)
• The server's addresses for the token's IP filter copy as ipv4 ipv6 in one click. (#193, #204)
• Mailcow's separate mail hostname field is gone: the hostname comes from the address, which may be a bare mail.example.com. Fill from SMTP Relay copies a relay profile's host and mailbox, never its password. The Mailcow connection can be removed, like Cloudflare's. (#193)

WordPress Tools

• Varnish and MainWP checks, installs, connects and cleanup run as background jobs, with per-site progress that survives a reload. (#195)
• A site offers Install only after it has been checked. (#195)
• CLP Varnish Cache is network-activated on multisite instead of skipped. (#195)
• With a Dashboard on this server, Connect selected and Connect all unconnected connect many sites to MainWP at once, without dropping sites on a large server. (#195, #202)

System Tweaks

• One change runs at a time: the other controls, the panel PHP picker and the reboot time included, wait with a visible busy state. (#194)
• The reboot time is saved once you stop typing and no longer jumps back to the default. (#194)
• With automatic reboot on, "reboot needed" says when the server restarts by itself, and that it is skipped while anyone is logged in if apt is set that way. (#194, #202)
• A plain hint replaces the warning about CloudPanel's PHP when updates were set up elsewhere. (#194)

Panel Tweaks

• Measure now runs as a background job: a refresh or leaving the page no longer stops it, and a second click follows the running one. (#199)
• With the CloudPanel mobile layout on, the tables on a site's certificates, databases, users, cron jobs and security tabs become cards on a phone instead of running off the screen. (#204, #205)

Addons page

• Opening an addon clears its New or Changed badge for every administrator and device, until a later release marks it again. (#192, #198, #202)
• Changelog links open the release being offered, pre-releases included. (#185)

Full Changelog: v2.0.0-rc.2...v2.0.0-rc.3

v2.0.0-rc.2

Release candidate 2 for 2.0.0. It is not offered to boxes on a release; install it with clp-addons update --version=v2.0.0-rc.2 --allow-prerelease. From here, a plain clp-addons update follows release candidates up to 2.0.0.

Three new addons: DNS, Security Keys and System Tweaks. Every addon page was rebuilt around its sites, WordPress Sign-In became WordPress Tools with CLP Varnish Cache and MainWP Child, and System Tweaks can move CloudPanel itself off its end-of-life PHP 8.1. It's 2.0 because WordPress Tools' command-line name changed.

Upgrading

• clp-addons update from 1.5 carries everything over, including WordPress Tools' settings and MainWP connections.
• WordPress Tools is wp-tools now, not wp-login: in clp-addons repair wp-tools, the installer's --addons= and its page address, /addons/wp-tools/. (#157)
• clp-addons upgrade and install --version are gone; use clp-addons update [--version=vX.Y.Z]. The installer's --install-docker is gone too: enabling Instatic installs Docker. (#158, #162)
• Updating doesn't add addons. Enable System Tweaks for automatic security updates and forged-IP blocking.

New

• DNS. Keeps each site's Cloudflare DNS records to a profile you edit, with Mailcow as an optional mail integration. A new site joins the default profile seconds after CloudPanel creates it. (#138, #163, #177)
• Security Keys. Sign in to CloudPanel with a passkey or a hardware key such as a YubiKey, instead of a password and two-factor code. Each user adds their own keys under Account → Security; administrators choose which roles may use them. (#146, #161, #164, #179)
• System Tweaks. Automatic security updates through the distro's unattended-upgrades, covering every PHP version CloudPanel ships and, by default, Nginx, with a choice of reboot timing. It blocks visitors who fake their IP with a header, on sites and on the panel, can run CloudPanel itself on a newer installed PHP, rolled back if the panel doesn't come up, and clears the temp files timed-out PHP requests leave in /tmp. (#145, #153, #154, #155, #160, #181)
• WordPress Tools can install CLP Varnish Cache on Varnish sites, and MainWP Child connected to a Dashboard on this server or ready for one elsewhere. Both are off until you switch them on. Behind CloudPanel's basic auth, sign-in offers to add your IP to the site's allowlist. (#128, #136, #179)
• Running clp-addons as root in a terminal opens a menu to enable and disable addons, check status, repair and update. (#141)

Rebuilt UI

• Every addon page was rebuilt around its sites: the list comes first, with a shared search and bulk actions, and the settings follow in a card below. (#165–#179)
• Pages repaint in place after a change instead of reloading, and messages appear as a toast that stays in view. (#142, #178)
• Every page fits a phone, in light and dark. On a phone, long lists show ten sites and a Show all button. (#147–#150, #163, #179)
• The Addons page lists enabled and available addons with a search, and marks what is new or changed in 2.0. (#164, #178, #179)

Changed

• The installer hands over to clp-addons install, which asks which addons to install and also preselects System Tweaks and Security Keys. Updates check release provenance themselves, without the GitHub CLI. (#156, #162)
• Cloudflare IP Access and PHP Resources handle a new site seconds after CloudPanel creates it. (#166, #170)
• SMTP Relay: each site's mail is relayed through a profile, not handled, or discarded, and Test reports whether it was delivered. (#175, #179)
• Stager: cloning is one form, and staging copies send no mail while SMTP Relay is on. (#167)
• Instatic: updates run as jobs with a live log, and selected sites update or restart together. (#171, #178)
• Maintenance Mode marks sites its Nginx check doesn't cover, and turns selected sites on or off together. (#173)
• Long actions no longer fail after 10 seconds. (#142)
• clp-addons update --allow-prerelease installs the newest release candidate, and a box on one follows them up to the release. update on a box that is already up to date says so and changes nothing. (#181, #183)

Fixed

• Stager: a clone that couldn't point its copy at its own database now fails and is removed, instead of finishing against the live database. (#177)
• A site user can no longer plant links in the lock directory that root follows. (#177)
• Git Deploy and Maintenance Mode forget a deleted site, so a recreated one starts fresh. (#173, #174)
• Cloudflare IP Access: one hand-edited vhost no longer stops every other new site from being protected. (#166)
• PHP Resources no longer reports drift that isn't there. (#170)
• Maintenance Mode works when /etc/nginx/global_settings is missing, says why it refuses an Nginx file, and no longer holds back an automatic Nginx update. (#144, #154)
• Running clp-addons serve by hand no longer takes the addon pages down. (#141)
• Uninstalling the last addon removes the panel identity file too. (#158)

Full Changelog: v1.5.2...v2.0.0-rc.2

v2.0.0-rc.1

Release candidate for 2.0.0. It is not offered as an update; install it with clp-addons update --version=v2.0.0-rc.1 --allow-prerelease.

Three new addons: DNS, Security Keys and System Tweaks. Every addon page was rebuilt around its sites, WordPress Sign-In became WordPress Tools with CLP Varnish Cache and MainWP Child, and System Tweaks can move CloudPanel itself off its end-of-life PHP 8.1. It's 2.0 because WordPress Tools' command-line name changed.

Upgrading

• clp-addons update from 1.5 carries everything over, including WordPress Tools' settings and MainWP connections.
• WordPress Tools is wp-tools now, not wp-login: in clp-addons repair wp-tools, the installer's --addons= and its page address, /addons/wp-tools/. (#157)
• clp-addons upgrade and install --version are gone; use clp-addons update [--version=vX.Y.Z]. The installer's --install-docker is gone too: enabling Instatic installs Docker. (#158, #162)
• Updating doesn't add addons. Enable System Tweaks for automatic security updates and forged-IP blocking.

New

• DNS. Keeps each site's Cloudflare DNS records to a profile you edit, with Mailcow as an optional mail integration. A new site joins the default profile seconds after CloudPanel creates it. (#138, #163, #177)
• Security Keys. Sign in to CloudPanel with a passkey or a hardware key such as a YubiKey, instead of a password and two-factor code. Each user adds their own keys under Account → Security; administrators choose which roles may use them. (#146, #161, #164, #179)
• System Tweaks. Automatic security updates through the distro's unattended-upgrades, covering every PHP version CloudPanel ships and, by default, Nginx, with a choice of reboot timing. It blocks visitors who fake their IP with a header, on sites and on the panel, and can run CloudPanel itself on a newer installed PHP, rolled back if the panel doesn't come up. (#145, #153, #154, #155, #160)
• WordPress Tools can install CLP Varnish Cache on Varnish sites, and MainWP Child connected to a Dashboard on this server or ready for one elsewhere. Both are off until you switch them on. Behind CloudPanel's basic auth, sign-in offers to add your IP to the site's allowlist. (#128, #136, #179)
• Running clp-addons as root in a terminal opens a menu to enable and disable addons, check status, repair and update. (#141)

Rebuilt UI

• Every addon page was rebuilt around its sites: the list comes first, with a shared search and bulk actions, and the settings follow in a card below. (#165–#179)
• Pages repaint in place after a change instead of reloading, and messages appear as a toast that stays in view. (#142, #178)
• Every page fits a phone, in light and dark. On a phone, long lists show ten sites and a Show all button. (#147–#150, #163, #179)
• The Addons page lists enabled and available addons with a search, and marks what is new or changed in 2.0. (#164, #178, #179)

Changed

• The installer hands over to clp-addons install, which asks which addons to install and also preselects System Tweaks and Security Keys. Updates check release provenance themselves, without the GitHub CLI. (#156, #162)
• Cloudflare IP Access and PHP Resources handle a new site seconds after CloudPanel creates it. (#166, #170)
• SMTP Relay: each site's mail is relayed through a profile, not handled, or discarded, and Test reports whether it was delivered. (#175, #179)
• Stager: cloning is one form, and staging copies send no mail while SMTP Relay is on. (#167)
• Instatic: updates run as jobs with a live log, and selected sites update or restart together. (#171, #178)
• Maintenance Mode marks sites its Nginx check doesn't cover, and turns selected sites on or off together. (#173)
• Long actions no longer fail after 10 seconds. (#142)

Fixed

• Stager: a clone that couldn't point its copy at its own database now fails and is removed, instead of finishing against the live database. (#177)
• A site user can no longer plant links in the lock directory that root follows. (#177)
• Git Deploy and Maintenance Mode forget a deleted site, so a recreated one starts fresh. (#173, #174)
• Cloudflare IP Access: one hand-edited vhost no longer stops every other new site from being protected. (#166)
• PHP Resources no longer reports drift that isn't there. (#170)
• Maintenance Mode works when /etc/nginx/global_settings is missing, says why it refuses an Nginx file, and no longer holds back an automatic Nginx update. (#144, #154)
• Running clp-addons serve by hand no longer takes the addon pages down. (#141)
• Uninstalling the last addon removes the panel identity file too. (#158)

Full Changelog: v1.5.2...v2.0.0-rc.1

v1.5.2

Maintenance coverage for all vhosts, PHP upload progress mitigation, automatic SSL, expanded CLI help, and streamlined installer defaults.

Fixes

• Maintenance mode now works with older CloudPanel vhost templates that do not include global settings. Checks survive CloudPanel regenerating a vhost; existing global-settings vhosts and intentional opt-outs are preserved.
• Per-site CLI maintenance status now reports when the global override is active.

Security

• Disable PHP session upload progress for installed PHP-FPM versions, including CloudPanel's own PHP. Configuration tests and reloads are checked, and failures trigger rollback.
• This mitigates the upload-progress path of CVE-2026-109619. It does not replace patched PHP or address CVE-2026-109618.

Improvements

• Panel Tweaks can request SSL automatically after native site creation.
• CLI help lists every addon's actions.
• Interactive installer defaults selection to Panel Tweaks, Maintenance Mode, and Terminal.

Full Changelog: v1.5.1...v1.5.2

v1.5.1

WordPress Sign-In works on sites in maintenance and on sites that redirect their home page.

• WordPress Sign-In offers to add your IP to a site's maintenance bypasses
  when the site is in maintenance mode, then signs you in. Fixes #133.
• Panel Tweaks links each SSL badge on the Sites page to that site's
  certificates page, including None.
• WordPress Sign-In posts to /wp-login.php, so it works on sites that redirect
  their home page. Fixes #132.
• WordPress Sign-In writes and removes its files as the site's own user, so a
  compromised site cannot redirect those writes elsewhere on the server. It
  refuses sites run by a system account or one sharing its uid with another
  site.

Full Changelog: v1.5.0...v1.5.1

v1.5.0

Two new addons: a shell for each site, and an SMTP relay for each site's mail.

New

• Terminal. Open a shell as a site's own Linux user, in its site root, in a
  window of its own. It opens from a Terminal link in each Sites row, a
  button at the end of a site's tabs, and Addons → Terminal. A reload
  reattaches to the same shell. Administrators only.
• SMTP Relay. Send each site's mail through an SMTP account chosen per site,
  using CloudPanel's own Postfix. WordPress and other PHP mail() need no
  plugin, and Node.js or Python apps that use sendmail are routed too. Postfix
  keeps each site to its own domains, and a Don't send profile discards mail
  from staging copies. See the setup guide.
• Maintenance Mode has global IP bypasses that apply to every site, and the
  overview has Add my IP too.

Changed

• Maintenance bypasses behind Cloudflare match the visitor's IP and work on
  sites CloudPanel proxies to a local backend, including WordPress.
• Git Deploy runs post-deploy commands in a login shell, so they get the site
  user's own PATH, including tools installed in its home.
• Instatic names a new site's user the way CloudPanel would,
  example-blog for blog.example.com, instead of addon-… with a hash.
• Site managers can create and manage Instatic sites from CloudPanel's New Site
  page, including creation progress.
• PHP Resources starts a new server with Lite, Standard and Pro categories (3, 8
  and 12 workers per site). Servers with saved categories keep them.
• Panel Tweaks fits CloudPanel's new-site and Admin Area pages to phone screens.
• The Sites page and site tabs shift less while they load.
• The maintenance bypass cards are simpler, and Save bypasses stays off
  until the list changes.

Fixed

• A Panel Tweaks switch that saved but couldn't be applied to the panel keeps
  its saved position.
• The maintenance count under the global override includes sites whose own
  setting couldn't be read.
• An Instatic update that can't reach the server no longer leaves the page
  disabled.
• Git Deploy's live progress stays connected for site managers. Git Deploy and
  Instatic hide administrator links from those users.
• Escape returns focus to the button that opened a row menu, and sorting keeps
  aria-sort accurate for screen readers.
• PHP Resources removes abandoned ImageMagick, PHP upload and WordPress
  download files from /tmp during its 15-minute upkeep. This cleans up
  leftovers that could otherwise accumulate and fill the disk.

Full Changelog: v1.4.3...v1.5.0

v1.4.3

Cloudflare IP Access: Select sites by row.
Maintenance Mode: Compact mobile fleet rows.
Panel Tweaks: Keep mobile navigation visible.
PHP Resources: Select sites by row.
Shared UI: Compact badges and row switches.

v1.4.2

Certificates that say who issued them, and a size scan you can watch.

• Panel Tweaks measures site sizes as soon as you enable it and streams the
  progress, so the Sites table fills in without a reload.
• An imported certificate is named by whoever issued it: CF Origin for a
  Cloudflare origin certificate, the authority's own name for any other. One
  with years left counts down in years.
• A phone's SSL badge carries the issuer beside the countdown — Let's Enc · 59d
  — instead of the bare number.
• A press on the category dialog's backdrop dismisses it; a drag that ends there
  no longer discards your edits.

v1.4.1

PHP resource presets that a whole fleet can use.

• The PHP Resources presets no longer reserve memory per site. Small site and
  Busy site run ondemand with ceilings of 3 and 8 workers, so a quiet site
  holds none. High traffic keeps a small warm pool — 2 workers at start, 1 to 3
  spare, 12 at most — for sites that need burst headroom, so assign it sparingly.
• Categories you have already saved are left alone. Edit or recreate them to pick
  up the new numbers.
• The Sites count badge on the Addons page is centred.