PanelDOCSv1.0.0

Release notes 1.0.0

Everything in HF Panel 1.0.0, the first production release, summarised by area: systems, hosting, email, security, billing, support, monitoring and the API.

HF Panel 1.0.0 is the first production release. This page lists what it brings, grouped by area. Pages for each feature are linked from Server Admin, the Reseller Panel and the Control Panel. Server Admin › Server › Updates › HF Panel updates shows the notes of a new version before you install it; see Updating.

Systems

Runs on Ubuntu 22.04, 24.04 and 26.04 LTS, Debian 12 and 13, and Rocky Linux and AlmaLinux 8, 9 and 10, CentOS Stream 9 and 10, and CloudLinux 8, 9 and 10 (64-bit Intel/AMD; ARM on Ubuntu and Debian). The whole server side is one program: the panels, Mail, Files and DB Studio no longer run on PHP (PHP stays for customers' websites).

  • Rocky Linux, AlmaLinux and CentOS Stream — the same install command and the same panels, with firewalld, SELinux kept on (labels, switches and ports are set for you) and the same folder layout as on Ubuntu and Debian. MongoDB databases, Docker, the web application firewall and newer versions from other sources under Software versions are not available there yet. See System requirements and Install on Rocky Linux or AlmaLinux.

What is new

  • Config history — every server configuration file the panel writes keeps the version it replaces, with when and who changed it, so you can compare and put an older version back.
  • Panel backup — each night the panel's database, settings and keys are packed into one file encrypted with your passphrase and copied to your backup storage. The dashboard shows its state.
  • Search the panel — the box at the top finds accounts, domains, mailboxes, databases, invoices, tickets, resellers and IP addresses as well as screens; resellers see only their own customers.

Accounts and bulk work

  • Bulk changes — pick accounts by filter, by ticking them or from a CSV file, change PHP, package, suspension, limits, backups, SSL and more, see a preview first, and follow each job. The Reseller Panel has it for resellers' own customers.
  • Server balancing — in a cluster, suggested or automatic moves of accounts to servers with room, with a backup first and a rollback when the check fails. Off by default.
  • Top accounts, Top websites and Capacity forecast — see which accounts and sites use the most, and when disk space, files or memory will run out.
  • Your panel address — a reseller serves their customers from their own panel address, with a live DNS and certificate check.
  • Team access — new roles Websites & DNS and Files only, and API tokens for team members.

Websites and apps

  • Visitor stats — visitors, page views, bots, top pages, referrers, countries and devices from the access log, without scripts, cookies or stored addresses.
  • Site checks — every website is crawled on a schedule for broken links, mixed content, certificate and redirect problems.
  • Cron jobs — a visual schedule editor in words with the next run times, and a job monitor with the last run, output, Run now and alerts for failed or missed jobs.
  • Firewall rules per website — allowed and blocked addresses, blocked countries and a request limit on login pages.
  • Staging, site templates and Git deploys — a staging copy for any website, new websites from templates, and the live branch deployed on every push.
  • More one-click apps — Moodle and Ghost join Joomla, Drupal, Laravel, Nextcloud and the rest; administrators can hide apps under Apps catalogue.
  • WordPress safe updates — automatic updates with a backup first, page checks and an instant rollback, plus a warning for plugins with known security problems.
  • Terminal and SSH keys — a terminal in the page and a key manager that checks, imports and makes keys.
  • Own backup storage — customers back up to their own S3-compatible storage or SFTP server and restore from it.
  • Malware quarantine — quarantined files can be put back exactly, and injected code can be cleaned in place.

Databases

  • Database tools — the slowest queries with an Explain and suggestions, maintenance, dumps and growth, for MySQL/MariaDB and PostgreSQL; administrators switch on the slow query log under Database tools.

Domains and DNS

  • IP addresses — each server's IPv4 and IPv6, IPv6 pools, and an IPv6 address of its own for a website or an account.
  • DNSSEC — the zone editor shows the signing status and, for domains bought through domain sales, sends the DS record to the registrar for you.

Email

  • Sending limits — emails per hour and per day for every account, from its package, a server default or its own value; mail over the limit is held and sent later.
  • Spam filters per mailbox and a guided domain email check that can write the SPF, DKIM, DMARC or MX record for you (Deliverability).
  • Server mailboxes — admin@yourdomain.com always exists, and one screen shows the server's own mailboxes and role addresses.

Security

  • Two-step sign-in policy — make two-step sign-in optional or required for administrators, team members, resellers and customers, with a grace period. Resellers can do the same for their own customers (Reseller Panel).
  • Abuse desk — complaints from abuse@yourdomain.com, spam-feedback reports and a public form, each read for the IP address, domain and web address involved.
  • Site firewall rules — the same rules for any website, and a country list to block by.
  • Names that are not web addresses — ftp., smtp., imap., mta-sts. and the nameservers answer a browser with "403 Forbidden".

Billing and business

  • Tax & currencies — exchange rates, tax outside the EU and the UK, and your own VAT number check.
  • Unpaid invoices — reminders with a pay-now link, card payments tried again, suspension after a grace period and automatic reactivation on payment.
  • Discount codes — percent, amount or free months, with dates, limits, packages and new-customer rules.
  • Affiliates — applications, referral links, commission rules, a hold period, fraud checks and payouts. Customers see Affiliate.
  • Domain sales — customers buy and renew domain names and SSL certificates in the Control Panel.

Support

  • Live chat — customers chat from every page of the Control Panel; an offline message becomes a ticket, and an optional widget works on your website.
  • Email to ticket, shared canned replies and Satisfaction ratings for tickets and chats.
  • Welcome wizard — a short setup list for new customers.
  • Your data and Data requests — customers download their personal data or ask for their account to be deleted, and you approve it.
  • Announcements with audiences, a banner and/or email, and send later.

Monitoring

Performance

  • hf-api starts in under half a second, large servers list 1,000 accounts in 0.16 s instead of 17.6 s, answers are compressed, DNS checks run in parallel, and the panels load their fonts from the server.
  • Speed defaults — page cache space, browser cache days and query-string caching for the whole server.

API and developers

  • OpenAPI 3.1 — the API explorer and GET /v1/openapi.json list every endpoint.
  • Idempotency keys and a request limit — a repeated POST gets the first answer; each token may make 600 requests a minute.
  • Plugins and event hooks — script and webhook hooks for events such as accounts created, backups failed, uptime changes and invoices overdue.
  • The API at https://api.yourdomain.com/v1, for programs only.

Earlier highlights of 1.0.0

Addresses and panels

  • Three separate panels — Server Admin, Reseller Panel and Control Panel, each with its own address, sign-in, look and app icon. They open on the panel port only: https://srv., cp. and rs.yourdomain.com:8443. The same names without the port send visitors to your website.
  • The API at https://api.yourdomain.com/v1, for programs only; a browser gets "403 Forbidden". The old https://cp.yourdomain.com:8443/api/v1 keeps working.
  • New names — DB Studio moves to dbs.yourdomain.com. The mail server has three names: mail.yourdomain.com (the MX and the reverse DNS), smtp.yourdomain.com and imap.yourdomain.com for mail apps. mx.yourdomain.com is no longer used and is removed once no domain needs it.
  • Port 465 for mail apps (SSL/TLS), next to 587.
  • Browsers get "403 Forbidden" on names that are not web addresses: ftp., smtp., imap., mta-sts. and the nameservers.
  • Files and DB Studio are apps of their own, opened from the Control Panel already signed in.
  • New interface — every screen of the three panels redrawn as one fast app: no full page reloads, errors next to the field, live logs in a dialog, a notifications bell, dark mode, keyboard shortcuts (press ?), a welcome tour and accessibility to WCAG 2.2 AA.
  • 21 languages for the panels, Mail, Files, DB Studio and their emails, including Arabic, Urdu and Persian laid out right to left.

Installation, updates and removal

  • Checks first — the installer checks the system, CPU, memory, disk and virtualisation before it changes anything.
  • 30-day trial: choose it in the browser setup, or install with --trial.
  • Company name — the installer asks it with the domain and email (--company).
  • "Your server is ready" email with the sign-in addresses, DNS records, reverse DNS and next steps.
  • DNS list — the installer shows the records your domain needs before it starts; hf-agent dns-setup shows them later and --check looks them up.
  • Automatic SSL for the panel's names within 5 minutes of their DNS pointing at the server, without running the installer again.
  • Installer without a keyboard — every answer can be given as an option.
  • Signed releases — the installer, the panel's updater and the server check the release's signature before anything runs.
  • HF Panel updates in the panel: see what's new, update in one click, or automatically every night. Restarts happen without a gap, so the panel stays reachable.
  • Uninstaller — one command, hf-agent uninstall, removes HF Panel and everything it set up, all data included (it asks for DELETE EVERYTHING).
  • The server command is hf-agent (it was hf-admin, then hf-server; the old names are removed on update, and cron lines are moved to the new name). hf-agent help lists every command.
  • admin@yourdomain.com always exists, and the role addresses (postmaster@, abuse@, dmarc@ …) forward to the administrator.

Accounts, resellers and staff

  • Feature lists — choose which tools each package has.
  • Team members — customers invite people with a role, their own sign-in and two-factor login.
  • Reseller privileges, pools and own brand — per reseller: what they may do, their account, disk and bandwidth pools, their own brand, panel address and nameservers.
  • Read-only staff logins, two-step approval for risky actions, and approval for resellers' deletes and restores.
  • Bulk actions — suspend, unsuspend, change plan, message or delete many accounts at once.
  • Staff notes and tags, a support PIN, and a customer activity log with CSV download.
  • Import accounts from full account backups, Move accounts between servers, and Import from another host for customers. See Migrating.

Hosting

  • Account isolation — a private view of the filesystem per account, a private /tmp, hidden processes and an optional jailed SSH shell.
  • Disk limits and usage graphs per account next to CPU, memory and processes.
  • Web server profiles — Nginx, Apache and PHP-FPM tuning for the whole server, tested before every apply.
  • MongoDB databases and PostgreSQL databases for customers, with DB Studio.
  • Web Disk (WebDAV) and share links in Files.
  • Incremental backups, more backup destinations (SFTP servers and cloud storage) and restoring chosen files, databases and mailboxes.
  • DNS tools — Dynamic DNS, DNS templates, zone import and export, DNSSEC and DNS clusters.
  • Website protection — hotlink protection, leech protection and the web firewall per website.
  • App installer with updates and dry runs, and the WordPress Toolkit with a security checklist and known plugin vulnerabilities.
  • Developer tools — Perl modules, PEAR, Composer and PHP extensions per account; Node.js, Python, Ruby and Docker apps.
  • Staging sites, copy a website, page cache, image optimiser, speed test, uptime monitor and maintenance mode per website.
  • HF Tunnel, also from the HF Local desktop app.

Email

  • Mail delivery log — search what happened to each message, for customers, resellers and administrators.
  • Calendars and contacts (CalDAV and CardDAV) for every mailbox, with a calendar in Mail.
  • PGP in Mail, Mail two-factor login, filters and forwarding, a daily spam summary and a "mailbox nearly full" warning.
  • Send-only mailboxes, the spam guard that pauses an account sending far more than usual, and a mail queue screen.

Billing and business

  • VAT rules, currencies, account credit and quotes.
  • Domain sales — sell domain names and paid SSL certificates.
  • Notifications centre — alerts by email, webhook and chat apps, with quiet hours.
  • Unpaid invoice reminders, discount codes and free trials, a referral programme, a knowledge base, announcements, monthly customer reports and a weekly summary for administrators.

Security

  • The File Manager can no longer be led outside the account's home by links, .. or swapped folders; saves never leave a cut-off file.
  • Database imports run as the database's own user, never with root rights.
  • Restores, deletes, Git, SSH keys and app installs no longer follow links a customer planted.
  • Customers' ~/logs folders are owned by root.
  • MariaDB listens on 127.0.0.1 unless an account allows remote database access.
  • Hidden files such as .env and .git/ are refused on every website.
  • Websites, parked domains and DNS zones can't take the server's own names.
  • Several fixes in Mail's HTML cleaner, sign-in and sign-out.
  • fail2ban protects SSH, FTP, Postfix and Dovecot logins; the installer opens the real SSH port before switching the firewall on.