Latest Version: v1.14.9

Release Notes

Track the latest updates, improvements, and bug fixes for WisPanel.

v1.14.9

Oct 26, 2026

Dev Latest
  • Improved Web server configuration rewritten for all five modes (Apache, Nginx, Nginx + Apache, OpenLiteSpeed, LiteSpeed Enterprise) on the standard hosting templates. Custom configuration, redirects, pointers, hotlink protection, protected folders and per-IP default sites all use the same layout in every mode.
  • Improved An HTTPS site is written only for a domain with SSL turned on, and a subdomain gets one exactly when its domain does. A new domain keeps the SSL choice made in the form; the form starts with CGI unticked.
  • Improved No longer written into site configuration: the panel's own rules that blocked dot-files and .sql dumps, and the X-Frame-Options / X-Content-Type-Options headers. Add them in a domain's custom configuration if a site needs them.
  • New Admin SSL certificate queue: when automatic ACME provisioning is off, a new domain files a certificate request that the server retries on a schedule for up to a week. Administrators see the next retry in the SSL table; account owners see their pending requests and can retry or cancel them.
  • New OpenLiteSpeed with PHP-FPM, listeners on every IP of a domain (including IPv6), and per-site cache directories.
  • New Nginx: `nginx_proxy_buffering` option for the Nginx front.
  • Fixed LiteSpeed Enterprise: PHP settings of a domain were ignored β€” open_basedir, mail sender, session path and per-domain PHP options now apply, and PHP turned off for a domain stays off.
  • Fixed The www add/remove redirect had no effect, and forcing HTTPS behind a proxy such as Cloudflare could loop. Both now work in every mode.
  • Fixed /webmail returned 404 on Apache, Nginx + Apache and LiteSpeed; Roundcube styles failed to load on plain Nginx.
  • Fixed Bandwidth on Nginx counted only the bytes sent; incoming request bytes are now counted too. PHP requests on Nginx are protected against the HTTP_PROXY header (httpoxy).
  • Fixed A site redirect covered only the exact path; it now covers everything below it.
  • Fixed The web applications user could run PHP as any account; it no longer belongs to the shared access group.
  • Fixed WordPress: installing on the second or later domain installed onto the first one, and "Delete Files & Install" could empty the wrong site. Installing on a domain whose PHP is too old is now refused with a clear message.
  • Fixed SSL: Issue Certificate was disabled for new domains, www was left out for some host names, and the rate-limit check always failed.
  • Fixed Deleting a domain left its subdomains' records and certificates behind.
  • Fixed A new domain's index.html belonged to root, so it could not be replaced over FTP.
  • Fixed About 60 interface texts showed placeholder keys instead of real text; the e-mail Blacklist tab no longer shows to accounts.
c9321d4 22.63 MB

Stay Updated

Get notified about new releases and updates by following our documentation.