89 capabilities in 13 areas. 57 of them run today and passed a drill on real infrastructure; the rest are labelled with when they arrive.
Every LIVE badge rests on a drill: a scripted run against our demo server that tries to break the feature and records what happened. These are the latest runs. The full transcripts go public with the beta.
60 PASS · 0 FAIL · 266 s · 2026-09-29
Per-account containers, networks and volumes under load and attack: OOM, fork bomb, disk fill, cross-account connections, reboot.
demo server, PlusPanel OS, SELinux enforcing
81 PASS · 0 FAIL · 487 s · 2026-09-30
Deploy, snapshot, deliberate breakage, rollback, a second account's access attempts, full quota, reboot.
demo server, XFS pool, SELinux enforcing
11 PASS · 0 FAIL · — · 2026-09-29
A signed PlusPanel OS image applied, rolled back and re-applied; unsigned and revoked access refused.
demo server, 10.1.0-rc.1 → 10.1.0
44 PASS · 0 FAIL · — · 2026-10-06
Issuance, renewal, imports, failures and policy changes on real sites, including one production Let's Encrypt certificate.
demo server, PlusPanel OS 10.3.5
24 PASS · 0 FAIL · 134 s · 2026-10-10
Two nameservers fed by the control plane: propagation, one nameserver down, DNSSEC, wildcard certificate via DNS-01, reboot.
two nameservers in two data centers
64 PASS · 0 FAIL · 695 s · 2026-10-11
MariaDB and PostgreSQL per account, bound into a site, phpMyAdmin one-time login, version upgrade, idle parking and wake, dumps at a full quota, another account's access attempts, reboot.
demo server, PlusPanel OS 10.4.3
88 PASS · 0 FAIL · 1028 s · 2026-10-11
File manager as the account's user, path-traversal, symlink and archive-bomb attacks, SFTP from the internet, a second account's access attempts, the web terminal, reboot.
demo server, PlusPanel OS 10.5.1
40 PASS · 0 FAIL · 15 s · 2026-10-12
Edition limits enforced by the platform; signed licences checked in, expired, in grace and revoked, evaluated by the deployed control plane.
staging control plane
57 PASS · 0 FAIL · 1 SKIP · 519 s · 2026-10-14
Encrypted incremental backups of a WordPress account, a deleted account restored, single files and a database restored, a WordPress update rolled back, an automatic restore test, an interrupted backup resumed.
demo server, PlusPanel OS 10.7.0-rc.2 (Preview channel)
steps 1–7 · all PASS · — · 2026-10-11
A plan's limits on a real server, an upgrade, a reseller over its allowance, a client's scope, invitations, impersonation, a per-account override, the login on a hoster's own domain.
staging control plane and the demo server
22 PASS · 0 FAIL · 105 s · 2026-10-12
A hoster's own name, colors, logo and wording, the login on its own domain, and a client launching WordPress and a database from its branded panel.
staging control plane and the demo server
76 PASS · 0 FAIL · — · 2026-10-14
AlmaLinux 9, AlmaLinux 10 with live sites, Rocky Linux 9 and a real Hetzner Cloud server converted in place; forced failures rolled back to the original system.
lab VMs and a Hetzner Cloud server, PlusPanel OS 10.6.0
64 PASS · 0 FAIL · 305 s · 2026-10-15
A site's WAF in detect-only, then blocking, then a rule excluded; a country refused by a site rule and by a server rule; SFTP brute force banned and lifted from the panel; 2FA, a passkey and a recovery code in a real browser; 1000 audit events, a row changed directly in the database, the write-once anchor, the exports.
staging control plane and the demo server, PlusPanel OS 10.9.0-rc.1 (Preview channel)
79 PASS · 0 FAIL · 1121 s · 2026-10-16
A disk filled and released, a container stopped and restarted, a marker searched in a site's access log, central storage switched on and off, another organization's access attempts, e-mail and signed-webhook notifications, the agent killed right after a reboot, and the audit log's IP addresses truncated after 90 simulated days.
staging control plane and the demo server, PlusPanel OS 10.10.0-rc.2
40 PASS · 2 FAIL · 1792 s · 2026-10-19
Six factory servers and the demo server updated ring by ring (internal, canary, 10, 50, 100 %); a release sabotaged on one server after its update, that server rolled back by itself and the rollout halted until resumed; a server outside its maintenance window waiting for it; an agent update across the fleet without a reboot; the 7-day cleanup; an express rollout.
srv1 factory servers, staging control plane and the demo server, PlusPanel OS 10.11.2 and agent 1.1.4
The structural differences: where the panel runs, how it talks to your servers, who can reach them.
A control plane in our EU cloud plus a minimal agent on your servers. One server or a hundred, managed from the same place.
The agent opens every connection outbound (gRPC over mTLS, inside WireGuard). Your server listens on nothing for management: no :2087, no :8443, SSH optional.
No remote shell. Every operation is an Ed25519-signed job with an addressee, an expiry and replay protection, verified by the agent before it runs.
mTLS with an internal CA, one certificate per server, automatic rotation, instant revocation.
A private network between agents and the platform. Management traffic never crosses the public internet in the clear.
If the platform is unreachable, sites, mail and databases keep running: systemd owns them locally.
The control plane, image registry, nameservers and backups run on Hetzner in Germany and Finland. Every supplier and its role is listed on the privacy page.
Every action recorded in one hash-chained log the panel's own database account cannot rewrite. A daily signed anchor goes to write-once storage for seven years, a change made directly in the database is detected and alerted, and each organization can export its log (CSV/JSON) or a bundle that can be verified offline. IP addresses in it are cut to their network after 90 days, and the chain still verifies.
The operating system you stop administering. It ships as a signed image and updates atomically.
Derived from AlmaLinux (bootc). Every server in the fleet runs the same image, bit for bit. No drift.
An update is a reboot into the new image; a failure boots the previous one. Measured: apply 44 s, rollback 28 s.
From an upstream CVE to a patched fleet: rebuild, Trivy scan, SBOM, cosign signature, rollout.
Stable · Production (default) and Preview · Early Access, chosen per server.
Internal → canary 2% → 10/50/100%. A server that fails its checks rolls back by itself and the rollout stops before it reaches your production. Agent updates need no reboot.
You choose when updates happen, per organization or per server; your clients are told beforehand. Critical security fixes get an express lane with the same checks.
Native image (ISO/qcow2/AMI) · in-place conversion of an existing AlmaLinux 9/10 or Rocky Linux 9, which rolls back to the old system by itself if the new one fails its checks · compatibility mode (agent only, on Alma/Rocky).
Dedicated servers, KVM VPSes, cloud instances. x86_64 at GA; ARM64 later.
Each customer account in its own box: containers, network, disk and kernel limits that are enforced, not advisory.
Rootless Podman with user namespaces: an account's processes do not exist for the rest of the server.
Accounts cannot reach each other: in the drill, another account's connections were refused on 6 of 6 targets. Egress is filtered.
XFS project quotas: the limit is a limit (EDQUOT/ENOSPC), with separate quotas for bytes and inodes.
Multi-Category labels put one more wall between accounts, even after a container escape.
One account's OOM does not touch its neighbours; a fork bomb stops inside the account.
OpenLiteSpeed (default for WordPress/PHP, LSCache included) · Apache for .htaccess compatibility · nginx.
PHP 8.2–8.5 per site (8.1 marked end-of-life), switched from the panel. A snapshot is taken first and a failed switch rolls back.
Deploy from the panel, inside the same isolated containers.
A terminal in the browser that opens inside the account's own containers, as the account's user, never on the host. Two sessions per account, closed after 15 minutes idle.
Scheduled tasks that run inside the account's containers.
Performance and safety for WordPress: every risky change has a snapshot behind it.
WordPress plus your predefined plugin and theme sets, per hoster and white-labelled. Measured: 30.4 s from API call to live.
Full-page cache from the first second on the OpenLiteSpeed stack.
Files and database, atomic. Measured on a 113 MB site: snapshot 6.7 s, rollback 8.8 s.
Taken before any core, plugin or theme update from the panel, with a one-click rollback. Measured: an update rolled back in 21.1 s.
Policies per site or plan (minor / all / none), a health check after the update and automatic rollback on failure.
The update runs first on an ephemeral clone with a visual before/after comparison, and is applied only if nothing breaks.
Fully isolated staging, its own database included; sync everything, files only, or chosen tables, with a safety snapshot.
Log in from the panel without a password.
Read-only filesystem except uploads, wp-config outside the webroot, limited egress.
Installed versions checked against vulnerability databases, plus malware scans; alerts with a fix button.
Update one plugin on 400 sites across every server, with a snapshot each, in waves, stopping on failures.
Port 25 problems become ours: mail leaves through managed relay pools, not your server's IP.
Stalwart (IMAP/SMTP/JMAP), multi-tenant; unlimited mailboxes on Pro.
Bulwark (JMAP, instant sync) by default; SnappyMail as an alternative.
Mail leaves through IP pools segmented by reputation, with warming, blacklist monitoring and scoring.
Sending goes through the WireGuard tunnel to the relay, so a cloud provider's port 25 block stops mattering.
Correct from day one, per domain.
For customers who keep their mail there.
Our own authoritative DNS and automatic certificates, from the same control plane.
PowerDNS on two nameservers in two data centers, fed by the control plane; zone templates; DNSSEC. A record change reaches both in under a second.
Let's Encrypt issuance and renewal, HTTP → HTTPS redirects, import of your own certificates. Measured: 62 s to a production certificate.
Issued by the control plane against our own DNS and delivered to the server as a signed job.
Use Cloudflare for DNS and proxying from the panel; analytics and page rules later.
Our own /24 announced over BGP from several locations.
Your database in your container, not a MySQL shared by 400 customers.
MariaDB 11.4, 11.8 or 12.3, PostgreSQL 17 or 18, and a Valkey cache (open source, Redis-compatible), each in the account's own container. Sites get their connection details without anyone copying a password. Measured: MariaDB ready in 34.6 s.
Opened straight from the panel with a one-time link that expires in 5 minutes, over HTTPS only; every session is audited. For MariaDB; a web tool for PostgreSQL comes later.
A snapshot first, then the upgrade; a failed upgrade puts the previous version back. Downgrades are refused. Measured: MariaDB 11.8 → 12.3 in 45.2 s.
Databases of sites without traffic for 24 hours free their memory and wake before the site serves its first request.
Browse, edit, upload and extract archives, running as the account's own user; paths outside the account, symlink escapes and archive bombs are refused.
Off by default, enabled per server. SFTP only, no shell and no FTP; password shown once, or SSH keys.
A backup nobody has restored is not a backup.
Encrypted on your server before it leaves (XChaCha20-Poly1305): the storage provider only ever sees encrypted data. Measured: after a 2 MiB change, the next backup uploaded 2.03 MiB.
A file or folder, one database, a site or a whole account; in place behind a safety snapshot, to a separate folder, or as a download. A deleted account can be brought back for 30 days.
The platform restores a backup into a sandbox and checks files, database and HTTP: monthly on Pro and Enterprise, every three months on Free.
Free keeps 7 daily backups; Pro and Enterprise keep 14 daily, 8 weekly and 6 monthly. When storage runs short, the oldest are thinned and backups keep running.
Standard (EU) · Premium geo-redundant (two providers) · Bring-your-own S3 (Enterprise).
Built into PerformanceShield (see WordPress).
Leaving cPanel, free of charge.
Accounts, sites, databases, email (password hashes kept, so users notice nothing), DNS.
cPanel archives, without access to the source server.
What moves and what needs attention, before anything is touched.
TTL lowered automatically, final delta sync, automatic post-migration checks.
Migrated onto identical Apache, or translated for OpenLiteSpeed.
In every edition, Free included. Fleet mode (bulk migrations) in v1.2.
Included, not sold as add-ons.
Coraza with the OWASP Core Rule Set in each server's web proxy. New sites start detect-only; switch a site or a whole account to blocking, exclude a rule from the panel, and your customers see the WAF log of their own sites. Security headers (HSTS, optional CSP) per site.
See what each server really exposes and confirm that no management port is open; IP allow/deny rules per server; country rules per server or per site (IP Geolocation by DB-IP); brute-force bans on SFTP that you can see and lift.
One account cannot saturate your uplink.
Authenticator-app codes, passkeys (also on your white-label domain) and recovery codes for every panel user, required for all users or only admins per organization; sessions you can list and sign out; e-mail on a new device.
From CVE to patched fleet without you (see PlusPanel OS).
Local-first: raw metrics and logs stay on your server unless you opt in.
Read from the server itself, with a log explorer for access, error and system logs. Central storage in the EU (VictoriaMetrics and VictoriaLogs, a separate store per organization) only if you opt in; opting out purges the raw data, and another organization gets nothing.
Fleet, server, account and site health, without installing Grafana.
Built-in rules with your own thresholds: a disk filling up (with when it will be full), a stopped container, an agent that exits right after a boot (its journal attached), and more. Notifications by e-mail and signed webhook; acknowledge with a comment.
Our own platform in public at status.pluspanel.net: control plane, server mesh, mail relay, DNS and registry, updated every 30 seconds, with incidents opened and closed by the probes. Also as JSON.
Every job with real-time progress in the UI.
One application for admins, resellers and end customers.
Admin / Reseller / Client through roles, not three products to learn. Clients see their own hosting: plan limits against use, sites, databases and files.
Wizards for the common jobs ("Launch a site"), object pages for experts, a command palette (Ctrl+K).
Your product name, logo, colors and wording in Romanian, English and Spanish, with the login on your own domain and its certificate issued automatically.
From day one; Romanian, English and Spanish translated by people.
The whole panel on a phone; installable as an app with push at GA.
Plus an approval device: confirm sensitive operations biometrically from your phone.
Read-only AI: answers from the docs and diagnostics from your own telemetry.
For hosting companies: the hierarchy, the billing and the integrations.
Admin → Reseller → Client, with hosting plans (disk, inodes, CPU, memory, sites, databases, PHP versions), reseller allowances, one-time invitations and audited impersonation.
Provisioning from the billing system you already run.
Invoice your customers from the panel; Romanian e-Factura and EU VAT/OSS.
Stripe, PayPal, Netopia, EuPlătesc · e-Factura/SPV, Oblio, SmartBill, FGO · ROTLD, Enom, ResellerClub, Namecheap — enabled from a catalog with your own credentials.
Full OpenAPI plus pluspanel-cli: everything the UI does can be automated.
Licences are signed and checked daily; a licence server outage never stops your servers, and an expired licence keeps working for 14 days of grace.