New: WAF 2.0 — Per-Site Engine Mode & Scoped Rule Exceptions
A substantial new security layer, adding fine-grained control on top of the existing ModSecurity foundation:
- Per-site WAF mode and scoped rule exceptions — override the WAF's behavior for individual sites, or carve out specific, auditable exceptions to individual rules, without touching vhost configuration directly. Protocol-integrity rules (request smuggling/splitting) are permanently protected and cannot be excepted, even with a force override — this class of rule stays non-negotiable.
- Custom rules builder — write and manage custom detection rules through the panel, compiled and validated before being applied.
- GeoIP blocking — block or allow traffic by country.
- Rate limiting — per-path request throttling with configurable windows.
- Caddy / Coraza sync — the same block/allow lists and custom rules now apply consistently to Caddy sites, not just nginx/Apache. Editing lists through the existing interface automatically propagates to Caddy sites too.
- Recent-hits dashboard and rule catalog — visibility into what the WAF is actually blocking, and a browsable reference of available rules.
This was merged carefully on top of the existing codebase — extracted precisely as the 60 functions genuinely unique to this feature (rather than a raw copy), avoiding a collision with an existing, unrelated Load Balancer status endpoint that a naive merge would have broken.
Security Hardening
- Domain names are validated before reaching shell commands or filesystem paths, across site creation, WordPress installs, and imported sites.
- The panel self-updater now rejects anything that isn't a genuine version tag before running git checkout.
- The terminal WebSocket now enforces the IP allowlist, not just the REST API.
- Disallowed IPs get a clean 403 instead of a 500. SESSION_COOKIE_SECURE is set for HTTPS deployments. /api/settings/webroot now requires authentication.
Full Multi-Distro App Store Coverage (Ubuntu, Debian, AlmaLinux, Rocky, RHEL, Oracle, CentOS Stream, CloudLinux, Fedora)
- RHEL/dnf-yum install paths added or corrected for: Apache (httpd), PHP (via Remi), Python, Node.js (via rpm.nodesource), Redis, Supervisor, DDNS (EPEL), MariaDB, phpMyAdmin. Fedora nginx now installs via the base repo correctly.
- Family-agnostic uninstalls for every app, working across apt, dnf, and yum.
- A service-name resolver so start/stop/status controls use the actual systemd unit for each distro (httpd, supervisord, mysqld, etc.) instead of assuming Debian's naming.
Correctness Fixes
- PostgreSQL database-listing crash; MongoDB create/drop; maintenance-mode vhost corruption with proper rollback; RHEL sudo group detection; CDN config-save crash; SSL www. handling restricted to apex domains only; Cloudflare's proxied flag now preserved with retry; DNS serial numbering made monotonic; Docker proxy cleanup on removal; HTTP/3 duplicate reuseport; correct default service user for Go/Node projects; PHP extension and php.ini paths corrected for RHEL; RHEL log-viewer paths; per-distro deploy web-user and unzip handling; AI feature disabled-guard.
WordPress / WP Toolkit
Includes the OpenLiteSpeed fixes from this session's work: correct lsphp binary detection, proper vhRoot/restrained vhost settings, lswsctrl reload instead of a generic restart, log-directory creation, and a corrected install path.