All Releases

5.0-beta.1

WISECP 5.0 is not an update. It is a new build from the ground up, with a redesigned admin panel, automation you can watch while it runs, separate Admin and Client APIs, a new theme engine and a far wider module family.

Beta Channel WISECP

Highlights

Architecture
  • The core was redesigned from the ground up: the codebase grew from 367,000 to over 1 million lines and was rewritten throughout in modern PHP.
  • The minimum PHP version was raised to 8.2, and the core is written on that version’s language features.
  • Four layers that had no counterpart in V3 were added: a REST API layer (158 files), an operation layer gathering every data change in one place (62 modules), a queue-based scheduled-job layer (111 handlers), and reusable interface components.
  • Core classes went from 18 to 63 and helpers from 15 to 48; the number of namespaced files rose from 494 to 1,451.
  • The module system grew from 12 types to 16. Each type comes with its own base class, configuration contract and language layout, and a module can add its own admin page, API endpoint and scheduled job without touching the core.
  • Extension points are documented: 1,016 hooks, each written down with when it fires, what data it carries and how its return value is used.
  • The REST API arrived with 820 endpoints; the admin and client sides pass through separate permission gates, and the definitions are generated from the source.
  • Scheduled work moved onto a queue: every job splits into discovery and execution, can be retried on failure, and records the outcome of each run.
  • Error logging moved from files into the database: the same error collects under one signature, its recurrences are counted, and sensitive data is masked at the moment of capture.
  • The template engine became a choice: themes can be written in Smarty, Twig or plain PHP.
  • Database access runs through a query builder, and every query is executed as a prepared statement.
  • The payment path was taken out of the monolith: in V3 the collection logic lived inside a single 4,308-line module class; in V5 the payment session, the gateway contract and the collection controller are separate pieces. Gateways went from 154 to 232, and each one implements the same contract.
  • The multilingual layer was redesigned: language packages went from 2 to 4, and the English package carries over 23,000 strings. Plural forms are resolved through 11 rule families covering 48 languages — so a count follows each language’s own rule rather than a single suffix. What each string means, where it appears and what its variables carry is written down in 504 context files, so translation is not left to guesswork.
  • The English reference language was reviewed and improved in full: terminology was unified, a writing convention was set for each type of surface, and variable usage was bound to a single style guide. Every other language is translated from that reference.
  • The encrypted surface is deliberately narrow: inside the core, only the licence chain is protected with ionCube — the bootstrap file, the entry point, the licence helper and the four classes embedded into them. Setting aside the add-ons sold separately, more than 99% of the codebase ships as readable source: of 4,640 files only 9 are encrypted. Business logic, modules, templates, helper classes and scheduled jobs are all open, so an operator can read, debug and extend the code on their own installation. Add-ons and store modules sold separately ship encrypted inside their own packages.
Admin Panel
  • The admin panel was rebuilt.
  • Each staff member picks their own navigation: a grouped menu on the left or a horizontal bar across the top, with the number of waiting items shown live beside each entry.
  • The dashboard is made of ten cards: order charts, best sellers, latest orders, pending tickets, upcoming invoices, clients and staff currently online, tasks, reminders and notes.
  • Every card follows the staff member’s privileges, and add-ons can place cards of their own.
  • Lists were rewritten: search returns as you type and columns sort without a page load.
  • Every action reports back in the corner of the screen, showing how long the message will stay.
  • Sales, support, cash and registration figures read at a glance from colour-coded cards.
  • The whole panel supports dark mode, offers a choice of 22 typefaces, and works in full on a phone.
Support Desk
  • The support desk was rebuilt.
  • The ticket screen became a single place to work: each message offers translation, copying and adding to a private note, while the ticket itself offers locking, splitting, merging and raising an invoice.
  • The average response time, the sender’s IP address and previews of attachments sit on the same screen; notes can be pinned and new messages arrive without reloading the page.
  • Hovering a row in the ticket list opens a preview of the latest message: who wrote it, when, and what it says — without opening the ticket.
  • Visitors open a ticket with just a name and an email, then follow it through a secure link and a PIN.
  • Customers rate both the ticket as a whole and individual replies.
  • On the operator’s side there are department-specific fields, access groups deciding which staff member sees which ticket, predefined replies sorted into categories, ticket statuses you define yourself, and encrypted information fields.
  • Incoming email turns into tickets on its own; closing, locking and scheduled jobs run in the background.
  • While a ticket is being written, related knowledge-base articles are suggested.
Bootstrap 5
The admin interface is built on Bootstrap 5 with Bootstrap Icons, in place of the admio, jQuery UI, DataTables, Font Awesome and Ionicons stack it used to run on.
Basic and WStyle
The Classic and Modern themes were retired and Basic and WStyle were designed in their place.
Theme Engines
Theme engines: build themes with Smarty, Twig or pure PHP.
Platform API
Admin REST API: 708 endpoints across 19 resources with Bearer or API-key auth, IP allowlists and rate limiting.
Client API
Client REST API: 112 endpoints across 13 resources for building on the client side.
Server Modules
The server module library grew to 50 panels and platforms.
Checkout Layouts
Checkout layout options: choose how the order summary is presented across the configure, cart and checkout pages, with rail (sticky side panel), card (in-page column) and stack (single column with bottom bar) layouts per theme.
Prorated Billing
Prorated billing can be enabled per product: the first term is aligned to a chosen day of the month and the customer is charged only for the days up to it. Renewals then run as full terms, so all of a customer's services can settle on the same billing day.
Purchase Experience
The configure step now guides the purchase: per-cycle savings with monthly equivalents, four ways to attach a domain (register, transfer, free subdomain or one you own), priced add-ons and a live order summary with renewal and tax notes.
Trust Score
Trust Score: an explainable 0 to 100 client score built from active services, total revenue, account age and ticket activity.
Badges and Summary
Relationship badges on client profiles (Loyal, Gold, Multi-Service, Experienced), and a client summary card that follows the client into the invoice, order, service and ticket screens.
Duplicate Check
Duplicate account check on the client profile.
Two-Factor
Self-service two-factor setup: authenticator app, SMS and email methods, each with its own setup flow.
JetPass
JetPass: passwordless login by email.
WKYC
WKYC addon: hosted identity verification writing the verdict straight into document verification records.
Virus Checker
Advanced Virus Checker addon: ticket attachments scanned through VirusTotal, Kaspersky OpenTIP or MetaDefender and labeled safe or unsafe.
Backup and Restore
Remote backup storage with FTP, SFTP, Google Drive, OneDrive, Bunny Storage and Yandex Disk destinations, plus a stepped restore that brings the database, files and uploads back.
Contact Center
Contact message center: a folder-based inbox where staff reply from the panel, see who has read each message, mark spam and turn a message into a support ticket in one click.
Trustpilot
Trustpilot integration: invite clients to review after a support rating at or above a chosen star threshold, and show your Trustpilot score on the website.
Whitelabel
Admin whitelabel, a paid package: apply your own branding to the admin interface.
Getting Started
A getting-started guide replaces the WBOT wizard. Each step answers "is this actually configured?" by reading the system rather than by a checkbox the operator ticks, and their order is a real dependency chain: an order that cannot be paid for, or confirmed by mail, is not a sale. The guide is reached from a dismissible band on the dashboard and from the Help menu.
Domain Lifecycle
An expired domain now moves through a grace period and then a redemption window. Each stage runs on its own schedule, and the client panel shows which stage the domain is in and how long is left.
Coupons
Coupon codes are no longer limited to the first order: they can apply to renewals of an existing service as well, either for a set number of cycles or for as long as the service runs.
AI Assistant
A long support ticket can be summarised in one click: the assistant reads the thread and states what the customer is asking for.

New Features

  • New panel modules: Enhance, FASTPANEL, Froxlor, ISPConfig, InterWorx, OpenPanel, PanelAlpha, SPanel, ServerAvatar, ZesleCP, aaPanel, Webuzo and Virtualmin.
  • Cloud reselling grew from one provider to six: DigitalOcean, Hetzner Cloud, Hetzner Robot, Linode, Vultr and Vultr Bare Metal, with plan import, margin control, cost sync and GPU plan families.
  • Virtualization and datacenter: Proxmox VE, SolusVM 2, SynergyCP and SolidCP.
  • Game hosting: Pelican, AMP and TCAdmin joined Pterodactyl.
  • Streaming and media hosting: AzuraCast, CentovaCast, Everestcast and MediaCP.
  • Email hosting: Mailcow and Zimbra.
  • New registrar modules: Freenom, OnlineNIC v4, TPP Wholesale and United Domains.
  • New payment gateways: Mollie, RazorPay, GoCardless, Authorize.Net, PosFix, UniPay, shurjoPay and PayU Hosted Checkout.
  • New mail and SMS providers: SendGrid and Verimor.
  • Requirement fields left empty during checkout can be filled in afterwards: the operator adds and saves them from the service page itself.
  • Registered domains are periodically synced with the registrar
  • The client panel shows how many days are left on a domain directly in the list, without having to open its detail page.
  • An invoice can be settled in parts instead of all at once: the customer enters the amount they want to pay, and the remaining balance stays open on the invoice until later payments close it.
  • Late fee automation: overdue invoices can accrue a percentage or fixed late fee with a minimum amount and cycle rule.
  • Metric pricing: usage-based billing with quantity modes, proration, cycle limits and automatic termination.
  • A discount can be defined on an individual service
  • A renewal invoice for a service or an addon can be raised straight from the admin panel, without signing in as the client.
  • An addon can be bought for a service after the fact: the customer picks it from the service’s own page, an invoice is raised, and the addon is attached once the payment settles.
  • The Lexware Office add-on hands invoices to the accounting service widely used in Germany; its connection settings are entered and tested from the panel.
  • Auto-renewals tab: services renewing automatically are listed and managed per record.
  • Auto-renew toggle on the service detail page.
  • Currency switcher in the client area header.
  • TOTP two-factor authentication with Google Authenticator, Microsoft Authenticator, Authy and compatible apps.
  • Email verification codes as a two-factor method.
  • Forced 2FA enrollment for clients and for staff at next login.
  • Two-factor authentication was extended: the customer chooses between an authenticator app and email verification, and a reminder can be shown in the client panel until a method is switched on.
  • Access to the admin panel can be limited to named IP addresses; sign-in attempts from anywhere else are refused.
  • Multiple accounts belonging to the same person can be spotted: a duplicate-account check runs from the customer profile and lists what it matches.
  • KYC verification fields: a reusable field pool (text, select, file and more) shared across filters and asked to the client only once.
  • KYC filter conditions: VPN or proxy use, total spending, IP and profile country mismatch, account age, service count, email provider and account type.
  • Customer identity can be verified through Didit. The outcome is stored on the account and can be seen from the admin panel.
  • Sub-accounts: clients add authorized sub-users; admins can log in as a sub-user.
  • Active sessions: every signed-in device is listed with location and IP; revoke one session or sign out everywhere.
  • API Credentials: clients create their own API keys with permission scopes, IP restrictions and request logs.
  • The client list can be narrowed with multi-criteria filters; the list runs server-side, with live search and sortable columns.
  • Cloudflare Turnstile and hCaptcha modules.
  • Customers are notified when their name, address or phone number changes
  • Attachments uploaded to a support ticket are scanned for malware before anyone downloads them. The scanning provider and its thresholds are managed from the module settings.
  • The support ticket list can be filtered by status, department, priority, assigned staff member, subject and date; it runs server-side with live search and sortable columns.
  • System status card: health state, last run, upcoming job and failed-job counters at a glance.
  • Run Self-Test: the automation system verifies its own setup and reports problems.
  • External automation triggers: cron, hosting panel, CLI, cURL or an external monitor URL.
  • Module Queue: every provisioning job is queued with attempt tracking, per-row retry and Retry All Failed.
  • Notification Queue: email and SMS deliveries are queued with channel filters, retry and cleanup controls.
  • Backup exclusions for paths and tables, compatibility check, disk-usage view, history and downloads.
  • Core updates can be applied automatically: the system notices a published release and starts the update in the background. It can be switched on for all updates or for security patches only.
  • Dark mode across the admin interface.
  • Admin panel font selection from 22 typefaces.
  • Media library with light and dark logo pairs per surface: website, client area, invoice and admin.
  • Client dashboard layout choice per theme: a modern hero layout or a classic account-rail layout.
  • Theme marketplace: install official and premium themes from the store, or upload your own; themes are versioned packages with their own settings, config schema and hooks.
  • Advanced filters on admin lists: combine product, billing cycle, server, client, quantity, IP, three date ranges and even custom order-field values in a single filter panel.
  • Installations running on a developer licence carry a permanent band
  • New gateway module types for developers: subscription, tokenized, merchant POS and third-party, each with a sample implementation.
  • OpenAPI specifications and API documentation generated from the source.
  • Documented hook system: 1,016 hooks spanning admin, client, billing, provisioning, domain, ticket and template events, plus theme-level hooks.
  • Database Query Logs: an IP-restricted query log for developer diagnostics.
  • Your customers can now add secondary email addresses to their accounts. This feature enables them to route different types of notifications, such as those for billing, support, and services, to specific, designated email addresses.
  • Account creation, sign-in and checkout can be opened only to selected countries, or closed to them. The visitor's country comes from their IP address, and at sign-up the country chosen on the form is checked as well; either one falling outside the rule refuses the request. Staff sign-ins are not affected.
  • The countries the proxy and VPN block applies in can be narrowed: it runs only in the selected countries, or everywhere except them. A visitor outside that scope is never queried, so the daily lookup quota is not spent on them either.
  • Saving a product with a changed price opens a dialog when services still renew on that product's catalog price, and asks what should happen to them. Keeping the current prices leaves every service renewing at the amount it already has, so the new price reaches new orders only. Each frozen service records the change in its own history.

Improvements

  • Card storage was rebuilt: cards are tokenised at the payment provider, and neither the card number nor the security code is ever held in the system. The Stripe Tokenized module ships with it.
  • Saved-card management was extended: customers add and remove their own cards, choose a default, and set which card automatic payments try first.
  • Subscription management was extended: subscriptions held at the payment provider (PayPal, Stripe Checkout, GoCardless, Mollie) are followed from a single screen, with customer, cycle, amount, next payment and status.
  • Account verification became a centre of its own: a verification tab with a progress indicator was added, and accounts caught by a verification filter cannot use their services until they finish it.
  • The department structure was extended: a primary technical department can be assigned for sensitive encrypted conversations, and a separate billing department for financial requests.
  • Scheduled jobs were gathered into an automation centre: a catalogue of more than 50 tasks, filters by state and time, and per-task manual run and pause.
  • Backups were extended: scheduled, recurring backups now cover the database, the files and the uploads.
  • Service transfers were centralised: transfer requests between customers gather in a single queue with bulk approval.
  • Contract management was extended: any number of contracts can be defined, and acceptance can be required at sign-up, during checkout or under account preferences. Until it is accepted under preferences the account can be held back, and each contract carries its own languages, background and SEO settings.
  • WChat live chat addon: website visitors and clients chat in real time, and conversations flow into the support system as tickets.
  • WTranslator addon: instant translation inside tickets and contact messages.
  • The AI Assistant was substantially improved (sold separately or included in the Business Plan): it can answer support tickets automatically, builds context from your own knowledge base and question-and-answer sets, and lets you choose provider and model from a catalogue. Drafting a reply, improving text and summarising a ticket all run from the admin panel in one click, and questions the knowledge base cannot answer are recorded as gaps.
  • Currency automation now supports six exchange-rate providers.
  • The invoice document was redesigned with share, print and PDF plus VAT, TIN and EORI fields.
  • Checkout became a three-step flow: configure, cart and checkout with order summary and promo codes.
  • Payment method commission can be exempted from tax
  • An upgrade can keep the service on its existing billing cycle, so a quarterly service moves to the new plan as a quarterly one.
  • Addons renew on the same invoice as the service they belong to. An addon whose own cycle differs from the service’s renews separately on its own schedule, so a monthly addon is not locked to a yearly service.
  • The invoice list gained a formalization status column, a View as Client shortcut and a separate refunded filter.
  • Invoice, cash, order and service lists can be filtered by payment method
  • The tax number and tax office fields are shown for company accounts, and can be switched on for individual accounts when they are needed.
  • Blacklist management moved into the client profile with add-to-blacklist and block-account actions, backed by the fraud module gallery and a banned-clients report.
  • Login records are enriched with country and city.
  • The access block on a service is kept as a field of its own, and every change is written to the service history with its previous and new value.
  • Color-coded KPI tiles for sales, tickets, cash and registrations.
  • Dashboard order trends are charted with month and quarter views and export to SVG, PNG or CSV.
  • Staff presence now shows which page each staff member is viewing in real time.
  • Recent orders carry inline WHOIS and DNS lookups; best sellers switch between weekly, monthly and yearly.
  • The plain header search became Smart Search, a categorized command palette on Ctrl+K.
  • Lists were rewritten: a skeleton shows while the page loads, search returns as you type, columns sort, and advanced filters are available.
  • Product creation was unified into a single wizard across hosting, servers, software and other services.
  • Admin order creation became a single-screen composer: pick the client, add multiple products with per-item billing cycles and price overrides, apply promotions and tax exemption, and generate the invoice as paid or unpaid with a live order summary.
  • Client creation became a four-step wizard covering identity, contact and address, preferences and password.
  • The client dashboard was rebuilt: welcome hero, needs-attention alerts, remaining-day indicators on services, live CPU and RAM on VPS cards and a pay-now banner for overdue invoices.
  • Account settings grew from 5 tabs to 11, adding an activity feed, notification preferences and a personal data tab.
  • Easy Import Tools: migrations run through a guided wizard with a connection test and an automatic backup before import, making it easy to carry your data in from popular billing platforms.
  • WAnalytics was rebuilt around report families for clients, services, invoices and support, with sub-reports such as by country, by language, high trade volume, clients with credits and banned clients, plus period-over-period comparisons.
  • Health check gained a score presentation with TXT and XML export.
  • Login was redesigned with a video scene, personalized greeting and Continue with Google.
  • Localized routing: the interface language now lives in the URL.
  • A themed 404 page and a fully responsive admin on mobile.
  • Clearing a customer's personal data covers the identity number and the phone as well: rather than being dropped, the values are masked so their trailing digits are hidden. The record stays intact while the data no longer identifies anyone.
  • When a reseller service is terminated, the packages the reseller created on the panel are removed from the server as well. Ownership is read from the panel itself, so only that reseller's packages are deleted and the operator's own are left alone. A problem during the cleanup is recorded rather than allowed to stop the termination.

Security

  • Password policy: minimum length plus required special characters and a periodic reset cycle.
  • Force Password Reset: invalidate all client passwords and sessions in one action for suspected breach scenarios.
  • Changing a password now signs the account out of its other sessions
  • A 2FA reminder can be shown in the client dashboard until a method is enabled.
  • Admin area access can be restricted to defined IP addresses.
  • Location verification and IP verification each gained a dedicated policy panel.
  • Session cookies are hardened with SameSite and HttpOnly.
  • Iframe clickjacking protection.
  • Form submissions on both the client and the admin side are validated against a session-bound token, so a request triggered from another site is refused.
  • Admin operations do not run outside the panel's own requests. A link pasted into the address bar or handed over from another page cannot trigger one, even while the session cookie is in place.
  • The attempts allowed per IP, and the temporary block that follows once they run out, can be set for sign-in, registration, password reset, the contact form and ticket creation. It stops fixed-IP abuse that a CAPTCHA gate does not.
  • Error records never keep sensitive data: stack argument values, cookie and session contents and query parameters are cleared against an allow list before anything is written, and the admin folder name is masked in every case.
  • A single IP, an address range or a network block can be blocked from the admin panel. A blocked visitor gets a system page explaining the situation rather than a blank one.
  • Non-essential cookies are not written before the visitor agrees. The choice is stored together with its evidence and is tied to the account once the customer signs in.
  • Uploaded files are served safely: type sniffing is off, anything outside the safe list downloads instead of opening in the browser, and the file is delivered under a policy that cannot execute script.
  • Uploads are checked against allowed and denied extension lists, and an image that looks small but exhausts memory once decoded is refused at upload time.
  • Every API credential is defined together with the endpoints it may call. The permission is checked at request time and the calls it makes are logged.

Bug Fixes

  • Stripe Checkout charged tax twice on bulk invoice payments
  • bKash and SSLCommerz rejected payments because of the amount precision
  • An open renewal invoice survived a plan upgrade and reverted the new plan
  • Namecheap rejected API calls when the visitor address was IPv6
  • OpenProvider domain registration failed with Method is not implemented

Changed and Retired

  • Service operations moved out of Orders into their own Services area.
  • Separate email and SMS marketing tools merged into Bulk Notifications; coupons and promotions merged into one screen.
  • Facebook Connect was retired and social login moved to the SocialAuth module family, which brings Apple and Microsoft alongside Google.
  • Selling SMS as its own product type was retired. The SMS service continues as the balance-funded International SMS panel, with sender-ID approval and per-country pricing.
  • WFraud moved from a dedicated blacklist screen into the fraud protection module gallery.
  • Standalone client-panel usage became the Only Client Panel switch under theme settings.

In This Release

Read the Upgrade Guide Send Feedback

We use cookies to keep you signed in, remember your language and currency, and improve the site. Cookie Policy