Security Encrypted backups made before this release were NOT encrypted. See the dedicated notice at the bottom — this affects every earlier version and matters if you store backups off-server (S3, FTP, Google Drive, …). Run `wispanel backup-scan` after upgrading to find affected files.

Improved Secret files are now blocked over HTTP on every web server. Requests for `.env`, version-control directories (`.git/…`), database dumps (`*.sql`) and other dotfiles now return `403` instead of being served. This closes a common credential-leak vector, but it is a behavior change: if one of your apps legitimately serves such a path over the web it will now be blocked, and can be re-allowed for that one domain through its custom vhost configuration — see the custom-vhost documentation for the exact directive for your web server. (We deliberately do not print a ready-to-paste rule here: a blanket copy-paste is the fastest way to expose a secret by accident.)

Improved Default maximum upload size is now 1024 MB, applied consistently on every web server. The cap is baked into every mode's generated configuration and re-applied on rebuild, so a `client_max_body_size` / `LimitRequestBody` value edited by hand outside the panel will be overwritten. Change the limit through the panel's upload-size setting instead of editing the web-server config directly.

Fixed Deleting or suspending one website could take the account's OTHER websites offline. In nginx and nginx+Apache modes the per-user configuration was edited with a faulty routine that, when removing one site's block, could remove the rest. It is now edited safely, one site at a time, and a built-in guard refuses any change that would remove an unrelated site. *If you were already affected, see `wispanel vhost-gaps` below.*

Fixed Suspension now takes effect on every web server, including OpenLiteSpeed. An over-limit or manually suspended account could keep serving its sites — on Apache/OpenLiteSpeed/LiteSpeed the suspended page did not show, and on OpenLiteSpeed specifically the suspension was written but the running server was never told to re-read it. Suspensions now apply immediately and uniformly, and a later configuration rewrite no longer silently un-suspends them.

Fixed OpenLiteSpeed and LiteSpeed install correctly on AlmaLinux / Rocky / RHEL 8. Switching to either web server on EL8 could fail to build; it now installs and serves on EL8, EL9, Ubuntu and Debian alike.

Fixed Switching the active web server no longer fails partway (for example OpenLiteSpeed → LiteSpeed) — the configuration rewrite completes cleanly instead of aborting midway.

Fixed Editing a domain's web-server configuration works in LiteSpeed mode. Saving a manual vhost edit returned an error on LiteSpeed and was not applied; edits now save and take effect. A malformed edit is still rejected safely — your live site is preserved unchanged.

Fixed Manual vhost edits and abuse IP-blocks now take effect immediately on OpenLiteSpeed (they were written to disk but not applied to the running server).

Fixed Creating or editing a domain no longer breaks its PHP on OpenLiteSpeed. A domain's configuration is rebuilt from the full record so PHP keeps working after a per-vhost custom-block change.

Fixed Clear message instead of a broken site on cgroup v1. Creating an account, domain or subdomain on a server still on cgroup v1 previously produced a site whose PHP silently failed (`502`); it is now refused up front with a clear reboot-to-cgroup-v2 message, and the account is still created.

Fixed HTTPS for domains without a certificate. A domain with no real certificate now serves a self-signed `:443` site on every mode, instead of some modes leaving no `:443` — where an `https://` visit fell through to the server's default site and showed the wrong content (notably behind Cloudflare Full mode).

Fixed Restore target and naming. The account a backup restores into is identified from the backup's *contents*, not the archive's file name — a renamed/migrated archive, or one with a duplicate `" (1)"` marker, restores into the correct account. Archives whose names contain spaces or parentheses now restore instead of erroring.

Fixed Restored domains adopt this server. A restored domain's IP and (when the source used a web server this box doesn't run) its web server are reconciled to this server, instead of keeping the source's values and failing to serve.

Fixed MySQL on RHEL/AlmaLinux is detected under the service name `mysqld` (previously could show as not installed), and MySQL 8 restores between accounts without leaking another tenant's data.

Fixed Vhost configuration is written safely. Every web-server config write is atomic, snapshots the previous version and rolls back automatically if the new one fails a validity check, and holds a cross-process lock so concurrent changes can't corrupt each other. A failed render now fails loudly instead of silently serving stale or wrong content, and switching modes cleans up the previous mode's leftover per-domain files.

Fixed Background build queue race fixed — the persisted job queue is written under a lock, so a burst of concurrent operations can't corrupt it.

Improved Consistent security headers (HSTS, X-Frame-Options, X-Content-Type-Options) on every web server mode, including the OpenLiteSpeed HTTPS vhost.

Improved One consistent, modern TLS cipher list across nginx, Apache and (Open)LiteSpeed.

Improved Each site's PHP runs on exactly the version it is configured for — the isolated PHP-FPM pool is provisioned from the domain's PHP version, not a raw fallback.

New `wispanel vhost-gaps` — lists any website that is configured but not being served (the fingerprint of the delete/suspend bug above); `wispanel vhost-gaps --repair` rebuilds them from your existing data, no backup required.

New `wispanel license-check` — read-only preview of what license enforcement would suspend.

New `wispanel backup-scan` — read-only sweep that finds `.enc` backups which are actually plaintext (see the security notice). Changes nothing.

New Backup encryption now genuinely encrypts — the option was previously a silent no-op (see the security notice); new encrypted backups are real, verify with `backup-scan`.

New Post-upgrade enforcement grace — the first 24 hours after an upgrade run license enforcement in detect-only mode with a clear warning and report file. A fresh install enforces immediately.

Improved Verified on AlmaLinux 8.9, AlmaLinux 9, Ubuntu 24.04 and Debian 12, across all five web-server modes — nginx, Apache, nginx + Apache, OpenLiteSpeed and LiteSpeed Enterprise — for PHP execution, static serving, HTTPS/TLS, secret-file blocking, upload limits, account suspension and configuration regeneration.

Improved OpenLiteSpeed / LiteSpeed configuration is not syntax-checked before reload (these servers have no reliable offline config test), so WisPanel applies changes and reloads gracefully — a bad change keeps the previous configuration running. The trade-off: a malformed *manual* directive is accepted onto disk and only surfaces on a later full restart. nginx and Apache edits are still validated before they are applied.

Release Notes

v1.12.0

Stay Updated

Installation Guide

Welcome back

Create your account