WinPanel 1.1.0

WinPanel 1.1.0 is a maintenance release. It fixes a hole in the sign-in audit
trail, adds recovery for processes left behind by a crashed site, and publishes
a checksum alongside the installer.

Upgrading is the same as installing: run the setup program over the top. The
database migrates itself on first start.

Fixed

Failed sign-ins are no longer erased by a successful one. Signing in
correctly deleted every failed attempt recorded against that address, so the
most interesting sequence on the Sign-in activity page — a wrong password
followed by a right one — left no trace at all. Failed attempts are now marked
as cleared rather than deleted. Rate limiting and IP bans behave exactly as
before, because they only count attempts that have not been cleared, but the
record of what happened survives.

The same applies when an owner unblocks an address: it can sign in again
immediately, and its history stays on the page.

Attempts recorded before this release cannot be recovered — they were deleted
at the time.

Added

• Orphaned process recovery. Starting, stopping, restarting or removing a
  service now clears any process it left holding its ports, so a site that
  crashed badly no longer has to be untangled by hand in Task Manager.
• SHA256SUMS.txt is published with every release, so the installer
  download can be checked against the file that was actually built.

Installing

1. Download WinPanel-Setup-x64.exe below and copy it to your server.
2. Run it as administrator.
3. Open the address it shows you and enter the setup code.

Nothing needs to be installed first — the installer carries its own Node
runtime.

Full instructions, including the parts your hosting provider has to do, are in
DEPLOYMENT.md.

Verifying the download

(Get-FileHash .\WinPanel-Setup-x64.exe -Algorithm SHA256).Hash.ToLower()

Compare with SHA256SUMS.txt. For this build it is:

f17bb2514e7be95bc9f4e92b2df8d786a8d74d0d93088e76cc2c764679ba2fa9

Getting help

Ask on Discord.

WinPanel 1.0.0 — first stable release

The first stable release of WinPanel: a self-hosted control panel for websites, DNS,
email and users on Windows Server 2025 — an alternative to IIS, Plesk and cPanel for
people running Node.js, ASP.NET Core and static sites on Windows.

Your apps run as ordinary Windows Services on loopback ports, with Caddy in front
handling HTTPS and domains. Mail is Stalwart, DNS is Cloudflare, and none of it needs
a web.config.

What's in it

• Websites — static, Node and .NET, from Git or managed by hand. Node and .NET
  sites get a standby slot, so a deploy that fails to start never takes the running
  app down.
• HTTPS — free certificates, renewed automatically. Connect Cloudflare and they
  are issued over the DNS-01 challenge, so the certificate authority never connects
  back to your server and domains behind Cloudflare's proxy keep renewing. Without a
  token, issuance falls back to needing port 80 reachable from the internet.
• DNS — Cloudflare records per site, with a plan you approve before anything
  changes, and a one-click "point this domain here".
• Email — self-hosted mailboxes with quotas and send-as aliases, MX/SPF/DKIM/DMARC/PTR
  checks that explain what each one proves, and webmail. The real certificate is copied
  into the mail server, so Outlook trusts it too.
• People — owner, administrator and customer accounts, each with website, disk and
  mail limits, enforced in the API rather than hidden in the interface.
• Security — two-factor sign-in, recovery codes, live sessions, a failed-attempt
  log and automatic IP blocking.
• Files — browse, upload, edit and download each site's files, with an enforced
  per-site disk quota.
• Server health — detects and fixes the Windows settings that quietly break Node
  hosting: IIS holding 443, missing firewall rules, a stopped time service, long paths
  disabled.
• Updating — the panel replaces itself in place, from your computer, a URL or a
  file already on the server. Sites, mailboxes, certificates and users are all kept.

Already running real sites: kitora.io,
diminished-studios.com,
taskbarlegends.com (Socket.IO) and
jean-kseafishing.com.

Installing

1. Download WinPanel-Setup-x64.exe below and copy it to your server.
2. Run it as administrator.
3. Open the address it shows you and enter the one-time setup code.

Nothing needs to be installed first — the installer carries its own Node runtime, and
the panel downloads Caddy, Stalwart and the rest itself. You reach it at
https://<your-server-ip>:8443, so no domain is required to start.

Windows Server 2025 or 2022. Full instructions, including the parts your hosting
provider has to do (unblocking outbound port 25, setting reverse DNS), are in
DEPLOYMENT.md.

Verifying the download

The installer is unsigned, so check it before you run it:

(Get-FileHash .\WinPanel-Setup-x64.exe -Algorithm SHA256).Hash.ToLower()

## Verifying the download

```powershell
(Get-FileHash .\WinPanel-Setup-x64.exe -Algorithm SHA256).Hash.ToLower()

c6fa8f3484aa2b54b9edfa7b493fbdeb7bc8f90d1c7a1e10bb8cda9ea8b06180  WinPanel-Setup-x64.exe

Worth knowing

• Your browser will warn about the panel's certificate the first time. That is
  expected — it is self-signed because the panel is reached by IP address. The
  fingerprint is shown so you can confirm you are trusting the right one.
• No PHP or WordPress yet.
• There is no rollback on updates. Take a copy of C:\WinPanel\data\panel.db and
  C:\WinPanel\data\vault.key before upgrading.
• Backups and alerting are not built in. The Health page will show you a failing
  service when you look at it; nothing pages you.