All Releases

5.0-beta.4

5.0-beta.4 is the fourth beta round of WISECP 5.0: Account Protection with risk-based sign-in codes, breached-password checks, attack mode and canary accounts, Telegram admin notifications, a client Account Statement, a Simplified Chinese language pack, the new WHost server module, Amazon S3 backups, over seventy payment modules that now book the amount actually collected, and hundreds of fixes.

3 November 2026 Beta Channel WISECP

New Features

Account Protection settings tab (Settings → Security → Authentication) gathers every sign-in protection on one screen, shows each one's current state and saves them with one button
Telegram joins mail, SMS and the bell as an admin notification channel: bot setup, group and personal chat linking, queued delivery, per-template settings and an admin API, in every shipped language
Clients now have an Account Statement tab that lists invoices, payments, refunds and credit movements with a running balance, downloadable as PDF or CSV and readable through the admin API
Simplified Chinese (zh) language pack: interface, website themes, notification templates and invoice PDF, shipped enabled
New WHost server module: account lifecycle, plan sync, one-click control panel sign-in, 17 hosting tools (phpMyAdmin, IP blocker, password change and more), traffic gauges and disk usage billing
Amazon S3 and S3 compatible storage (Wasabi, MinIO, Cloudflare R2 and others) can now be used as a remote backup destination.
Unpaid invoices of the same client can be merged into a single invoice from the panel and the API
Health Status now compares the database with the installed version's schema and names missing tables, columns and changed types or indexes; the check also runs after every upgrade
BotShield now counts attempts per form instead of per IP address: when a form reaches its threshold within the window, every visitor is asked for captcha on that form for a configurable duration
Account Balance: a new Allow Top-Ups switch turns off adding funds for clients, while balances they already hold keep paying invoices
Free Domain: the second offer option now also renews the domain free of charge while the service ordered with it stays active
ResellerClub and LogicBoxes domains can now be forwarded to another address, and the forwarding removed, from the client area, the admin panel and the API
Payment methods: each gateway can carry an estimated provider fee rate, and the payment gateway report shows the estimated provider cost
Exchange-rate ticker: an optional switch in Currencies → Settings shows the current rates beside the admin search field and next to the client area's quick actions (off by default)
Announcements and blog posts can also be emailed to clients who accept marketing emails
Modules can run their own migration right after a panel update, through the new action:module.updated hook
Currency names on the storefront now appear in the visitor's language
Footer payment logos can now be chosen in the Basic and WStyle theme settings, and theme multi-select fields are now a searchable box
Dashboard widgets can be switched between half and full width, and the choice is kept per staff account
Domain document fields can now be marked as required
Add-ons can now be added to selected services in bulk
Analytics reports gain an All Time date range; Services by Product adds Cycle and Status columns and Active/Inactive figures
Health Status now warns when Cloudflare ignores the version on CSS and JavaScript files
Notifications from a module can now lead to its own record: the bell row and the Telegram "Open in Panel" button
Marketplace products that ship as several directories are installed and updated together
New setting to require account verification before ordering
BTK Reports page for hosting providers in Türkiye is back in version 5
Blog posts, news and pages can be saved as a draft from the create form
Admin API: new endpoints list a client activity log and the emails and SMS messages sent to the client
WDNS: a package can now be earned through the domain's DNS Management addon
RealtimeRegister: DNSSEC keys can now be managed from WISECP
WDNS: Realtime Register Premium DNS can now be used as a DNS server
Domain-Bestellsystem: domains on the provider's nameservers can now get a standard DNS zone with web and mail records
Basic and WStyle themes: sections that show your own HTML content can now be shown without the theme frame, at full width

Improvements

Support tickets: e-mails about a ticket opened on the website or in the panel now carry the reference tag and Reply-To, so the customer's e-mail reply lands on the same ticket
Payment terms (how many days after creation an automatic renewal or metered invoice falls due) can now be set in Automation settings and through the admin API
The client service page and the client API now show the scheduled cancellation date: when it comes before the due date, the term band and the billing row count down to it
Refunding an invoice that was paid from the account balance now selects “Add as account credit” by default
Manual invoices for domestic clients are recorded in the local currency
Admin success notifications no longer dim and block the page; they appear as a short toast in the bottom-right corner, and saves that reload the page wait 1.5 seconds instead of 5
The setup and upgrade wizards have a new split-window design and stop only on settings that block them
Health Status now also reports SEO-friendly URLs, extensions bound to a missing registrar module, 3.x leftovers, a database table prefix and a fix package built for another version
The feedback dialog is now one compose box, and Bug reports attach the latest error records automatically
The setup wizard's opening screen now explains why the Start button does nothing when the wizard's script files cannot load
A notification is now marked read once its page has been viewed, in both the admin and the client bell
The Products & Services tab on the client detail page can now be filtered by service type
Activity Logs can be filtered by staff member
Service detail Billing tab now lists up to 10 related invoices instead of 5
Auto-renewal note on service and domain detail pages no longer speaks in the first person
Paid invoice items can be copied as a single line again from the invoice detail page
METUnic: imported extension prices cover every year up to the maximum term, .tr is offered by the module itself, the nameserver tab reads the provider's list and the connection test signs in for real
Payment module settings: a note explains why the card storage module stays listed for card payments while it is disabled
cPanel logins can open on the account's own address
Shipped Process Restriction thresholds now sit just below the BotShield attempt counts (captcha before the hard block)
Catalogue product cards now show the Discount (%) set on a term's pricing row as the saving badge and struck list price
Client detail: the Sign In as Client action in the client information card header now uses the same style as the other card header actions
ProxmoxVE resource usage and WIPAM IP pool usage alerts now ship in every panel language with the Ledger design and show the percent sign correctly
Images in Aurora notification emails now carry alternative text: the company name on the logo, a short description in the email's language on icons, and an empty alt on decorative copies
WChat no longer loads its stylesheet, script and boot request on pages where the chat widget is hidden for the visitor
The order page now lists the nameservers that will be applied under Default Nameservers
One shared check now decides whether a client may move a software licence to another domain
OVHcloud's daily cost sync now also refreshes the cost of the volume and snapshot add-ons
Menu Management no longer lists the Sidebar group
Module logos are now served under a file-stamped address, so a replaced logo, such as ResellerClub's new one, is no longer shown from the browser or CDN cache
Captcha provider and keys can be saved while Always Mode is off, as BotShield keeps using that provider, and the BotShield captcha duration is capped at 2 hours
BotShield Protection and Captcha Always Mode cards mark their ON state with a seal, and the Always Mode card no longer shows a warning tone while BotShield still protects forms
Pages, categories, products and home page blocks now keep the background images and gradients you set in your own HTML
The “URL Settings” link under an address preview now opens the exact field that sets that address
A one-time add-on can now be marked as completed from the add-on window and the admin API
Module logs now show which service and which module queue task a call was made for
Ticket emails can now be sent from the department's own address
The server module picker opens with a Featured shelf and a WHost banner on the Web Hosting tab
API key permissions: the client activity and sent-messages permissions now link to their developer guide article
WDNS: the DNSSEC card shows the DNSKEY below the DS record
Services by Product report: the register can be filtered by billing cycle, and the Avg. Service Value column was removed
Theme settings: the Home Page tab now warns when the active theme does not show home page blocks
'Report to the spam filter' checkbox now says that the sender's e-mail domain is banned too (public providers excepted)
The Help button on a module's settings page now opens that module's own guide (DomainNameAPI, TheSSLStore, Namecheap SSL, ResellerClub SSL, Realtime Register SSL)
Admin status bands no longer squeeze their button or their text: the button stays on one line and moves under the text on phone-width screens
Client dashboard: the small label above the greeting and the status line under it were removed
Domain-Bestellsystem: the help line under the User Name setting now explains the three account formats in a full sentence

Security

Paid product files could be downloaded by their direct address without a purchase; they are now kept in a protected folder and existing files are moved during the update
Plesk: on an imported subscription, cancelling the service, changing its password or opening the control panel could act on an unrelated account with the same login
A new hosting account no longer attaches to another customer's control panel account that already uses the same username; 5 to 7 letter domain names now also get a random suffix
Cancelling, terminating or suspending a hosting service no longer removes or suspends a control panel account that the server shows serving another domain
Over seventy payment modules now book the amount the provider actually collected, so a short payment, or one opened before the invoice grew, no longer closes the invoice in full
2Checkout and Akbank payment returns can no longer close an invoice for more than was charged: 2Checkout books the total it reports, and an Akbank return must be signed and match the order sent
Module logs no longer store the card security code: Garanti logged the CVV of every payment in plain text, and the update also masks the codes older logs hold
Ziraat: card details are no longer kept in the customer's session or sent back and forth through the browser during a 3-D payment
PayTR: a card used to pay through a shared invoice link is no longer saved to the invoice owner's stored cards, and a customer's Save card choice is now respected
Shared invoices: with "mask personal details" on, the formalized document (e-invoice PDF) was still handed to anyone holding the share link
Staff without the ticket delete permission could delete tickets through bulk actions, the admin API or by deleting a ticket's only message; delete buttons now show only with the permission
Re-authentication: changing the e-mail or phone, managing API keys or saved cards and revealing a licence key now ask for the password or a 2FA code, valid for 15 minutes
Risk-based sign-in: risky password and JetPass sign-ins ask for a one-time code, trusted browsers are remembered for 90 days, and an address that hits 5 accounts is blocked for 60 minutes
Canary accounts: bait client accounts can be planted in the client list; any sign-in or reset attempt on one is answered like a wrong password, logged and alerted as a sign of a leaked list
Breached-password check (Have I Been Pwned): a password found in a known breach is refused wherever a password is set, and the current one is checked at sign-in at most once a week
Auto-protect: accounts caught in a multi-account sign-in from one IP address are signed out everywhere and sent a one-click "secure my account" e-mail
Security Events: suspected account takeovers and attack-mode changes alert the operator by e-mail and are listed under Tools with sign-out, 24-hour IP block and ASN watch actions, also in the admin API
Attack mode: an hourly task compares failed sign-ins and multi-account IP addresses with the installation's own baseline; above it the sign-in forms require a captcha and risk thresholds tighten until two calm hours pass
Every sign-in attempt (password, JetPass, passkey, social, SSO; client and staff) is now recorded with its result and listed under Tools > Sign-in Attempts and the admin API, kept for 90 days
Clients are now emailed and shown an in-panel notice when their account is signed in to from a device or location that is not in its sign-in history
Location verification now also guards an account's first sign-in on this installation: without a stored sign-in row the check compares against the address kept on the profile
Password history: a new password can no longer repeat any of the account's last N passwords (default 5, configurable 0-24)
Client API: the mobile phone number can no longer be changed through PATCH /me; like the e-mail address it is an account recovery channel and changes only in the client area
A form on another website can no longer sign visitors and staff out by replacing their session cookie
Module admin pages no longer run an operation requested from a link on another site
Downloads the panel makes itself (theme and add-on installs, core update probes, package transfer) now require https, verify the publisher's sha256 checksum and check every redirect
Module outbound requests stay with their provider: Pterodactyl/Pelican uploads refuse private addresses, cPanel no longer follows redirects off the server, CoinPayments and Duitku accept only their own hosts
Server API keys (access hash) are now stored encrypted, also when imported from WHMCS, and are no longer printed into the server edit page or the cloud server settings windows
Customer themes now give every inline script a per-request nonce and send a report-only Content-Security-Policy
Two-factor sign-in: the authenticator app code is now compared in constant time
iyzico: the amount charged to the card is reported and an instalment surcharge is booked onto the invoice, so a short payment no longer closes it in full
Paysera: a notice of an unfinished payment no longer marks the invoice paid, and a short payment no longer closes it in full
Auto-payment: a stored-card charge is booked at the amount the payment module reports, so a short charge no longer closes the invoice
Authorize.net: a partially approved or held-for-review card payment no longer closes the invoice in full
Tripay: an invoice in another currency is no longer charged as the same figure in rupiah; it is converted when Converting Currency is IDR and refused otherwise
RazorPay: with Payment Action set to Authorize, Razorpay's signed return no longer marks the invoice paid; the invoice waits for your confirmation until you capture the payment
PayFast: the amount PayFast collected is reported, and an invoice in another currency is no longer charged as rand
RavePay: a payment is accepted only for its own reference and in the order currency, and the amount Rave collected is recorded
Admin API: a currency's name, prefix and suffix are now cleaned as in the panel form, and the currency format list printed into storefront and admin pages is escaped
Everestcast panel login no longer puts the stored login code in the address
Web access self-check now verifies TLS and reports an unmeasured run with its reason instead of a clean result; the probe no longer takes its target from the request host
PayFast: the debug log is written to the protected log folder instead of the module folder
Captcha providers now verify the answer they return: reCAPTCHA v3 checks the score (default 0.5), the action and the hostname, while hCaptcha and Turnstile check the hostname
WChat guest contact form now passes the spam filter and is rate-limited per IP
An unused Google reCAPTCHA key pair was removed from the default settings, and the update removes it from existing installations
Core update refuses a release offer that is not newer than the installed version (or carries no readable version) before downloading it
Customer DNS records: adding or editing accepted any record type, TTL and priority, so out-of-range values were sent to the registrar
Customer resources: a single ticket message, saved cards, contacts and API keys had no count limit
Client API orders: a quantity add-on could be ordered outside its own minimum, maximum and step
The hosting SSL tool now prints provider-supplied certificate values as plain text and marks the details a provider does not report with a dash
Tool actions no longer keep a module's password-confirmation field or edited file contents in plain text in the service history
Software product page: the view counter stored visitor IP addresses in plain text and its de-duplication file grew without limit

Bug Fixes

Remove from Server no longer deletes a hosting account that another active service uses or one already removed; it starts off on new installations and waits for confirmation after a 3.x upgrade
Members are no longer locked out of their account when an identity verification add-on is turned off or lapses, or when Date of Birth is off while still marked required
Account Balance payments now move the client's balance correctly when recorded, marked paid, refunded to credit or deleted; the cash book no longer counts them twice and no other commission is taken
Card payments through Yapı Kredi, Ziraat, Akbank (Payten) and iyzico V2 complete again: the 3-D Secure page opens and the bank's return is matched without the browser session
Payments through GoCardless (one-off and subscription), Paysera, Paysafecard, Checkout.com and WebMoney complete the invoice again
Updating no longer resets a module's saved settings, such as Flutterwave keys, or the panel settings kept in language files: custom URL slugs, product group SEO and domain page content
Renewal invoicing, the admin dashboard and the services report work on MySQL 8 when invoice items carried over from 3.x have an empty options field; the update repairs those items
With tax-inclusive prices, clients who pay no VAT (tax-exempt, or in a country without a tax rule) paid the net price on the order but the full price on every renewal
Paying a renewal no longer moves a service's or add-on's end time to midnight, and the renewal invoice keeps the exact end time as its due date
One-time addon options bought with an order were saved with the product's billing cycle and could be invoiced again every period
Add-ons the new plan already includes are no longer carried over on a plan change; they are cancelled and their unused term is credited
Add-ons defined as a product were sold at their hidden own price on existing services
Order invoices: a coupon, client group or reseller discount on a product with a setup fee is no longer cut back to the period price
The payment method commission now follows the method actually used: unfinished or declined payments, manual payments and a changed method or rate no longer leave a wrong commission on the invoice
Payment commission on discounted invoices was charged on the amount before discounts
Under tax-inclusive pricing, a percentage discount or a fixed-amount coupon no longer takes more than its value off a renewal
Changing the Tax Rate or the Tax-Free status of an unpaid invoice now recalculates its tax and total
Paying with the account balance charged VAT again although it had already been charged on the balance top-up
Reseller program: automatic activation at the first tier now runs, its conditions are enforced, and closing the program or a reseller account removes the discount from unpaid invoices
Updates no longer overwrite notification subjects, SMS texts and email bodies edited in the panel, and edits lost in an earlier update are restored from the copies kept on the installation
LogicBoxes, ResellerClub and sister registrars: WHOIS contacts no longer come back empty, overwrite the saved ones or get recreated with a new registrant on every save
Import from an earlier WISECP: invoice numbers are kept, the tickets, affiliates and invoices steps finish, and imported clients no longer get another client's details on new invoices
The "subscription payment failed" e-mail is now sent when the payment provider reports a failed charge; before, it never reached the client
Domain renewal: a term ending on the registry's ceiling day is accepted, automatic renewal no longer bills beyond the maximum period, and a renewal paid twice renews every paid year
A domain is no longer marked expired, nor sent the domain-expired notice, before its unpaid renewal invoice's due date
Creating an order in the admin panel locked up in a loop when an automatic coupon could not be combined with the selected coupon
Admin panel stylesheets and scripts returned 404 on Plesk (nginx in front of Apache), so sign-in failed with an invalid CSRF token
Sign in with Apple could not complete: the provider's form post reached the site without the session
Signing in no longer fails from in-app browsers that send a long user agent
A shared invoice paid by card with 3-D Secure sent the payer to the login page instead of the bank verification step
Metered billing: MB readings are converted to GB before billing, disabled metrics and implausible readings are not billed, and a changed maximum reaches the hosting panel
Client hosting tools: backup and file manager buttons work again, new folders appear in the destination lists at once, and saving a file keeps its LF line endings
Uploads in the client area File Manager failed with a session-expired error
A service moved to another client kept sending its previous owner's billing address to its module
Clicking an order, invoice, service or client notification in the admin bell now opens that record instead of only marking it read
A database error while reading add-on renewals no longer stops service renewal invoices, and the error is shown in the automation job result
Bulk and newsletter emails no longer hold back invoice and payment emails in the delivery queue
Updates page downloaded the wizard stylesheet twice
Language, currency and cookie choices are no longer reset by another installation on a parent domain or by a cross-site return without the session cookie
Checkout payment step stayed on 'enter your billing details' for guests when no payment method could be offered to them
Prices saved as 12, 24 or 36 months are sold as yearly terms instead of monthly
Synergy Wholesale extension import stored zero costs when the module's cost currency was not AUD
Tax office and tax number fields stayed visible on the registration, account and checkout forms after being turned off in the tax settings
Changing an invoice's currency through the admin API did not convert its amounts, and marking an invoice tax free left no entry in its history
Payment gateways that print their own form, such as Payssion, now reach the provider from the Pay button (payment continues on the pay page)
Currencies hidden from clients were still assigned to visitors automatically
Extension prices were saved as 0 when the registrar cost could not be converted
Saving registrar settings changed the cost currency when it was not an active currency
Add-on option prices showed as 0 on the edit page and were lost on the next save
Payment method settings saved through the admin API or a module's own settings form no longer reset the fields that were not sent
Changing the payment method or the paid date of a paid invoice now moves its cash book entry as well
Bulk invoice actions wrote nothing to the admin activity log, so a bulk-deleted invoice left no trace of who deleted it
Editing an invoice dropped the seconds from its dates even when they were left untouched
Products priced only through their add-ons (0.00 base price) were missing from the admin order catalogue
The invoice summary now follows the payment method the customer picks
Reseller revenue and sales count now include renewals: service, add-on and domain renewals on reseller-discounted invoices are counted
The service page showed an Auto-Renew switch on one-time services, which are never renewed; it is now hidden there, as in the services list
Invoices created manually from the admin panel or the admin API now use the client's tax rate and tax exemption instead of always applying the local rate
Invoice PDFs with certain numbers of line items no longer end with an extra blank page
A payment method limited to accepted countries was hidden on invoice payment when the account country differed from the billing address
The pay page offered the card form again while a payment the shopper had returned from was still awaiting the provider's confirmation
Reordering payment modules by drag and drop moved the card storage module to the top, making it the default method for new customers
At checkout, a payment method the customer never picked stayed selected after the billing country changed, instead of the first method in the new list
Incomplete menu, domain price and TLD data no longer causes warnings, and an invalid decimal-places value from a hook no longer breaks pages
PagBank Pix payments are now created with the current Orders API structure (Pix inside charges), which PagBank's integration review requires
Refunding an invoice with "Add as expense" wrote nothing to the cash book: the payment's income was removed and no expense was booked
Forcing a refunded invoice back to Paid now takes the refund back: the added account credit leaves the balance and the refund row is removed; a second gateway refund is refused
The Converting Currency setting is now applied by bKash, SSLCommerz, shurjoPay, PayFast, RavePay, CoinPayments, NOWPayments and WebMoney
Payeer and Coinbase Commerce are deprecated: their payment services can no longer be reached, and neither module can be switched on where it is not already enabled
The invoice page told customers whose card or wallet payment awaits provider confirmation that their bank transfer was received
The admin invoice page showed an inactive-currency invoice's totals in US dollars after loading
PostFinance Checkout, Svea, Worldpay, Payflow Pro, Revolut and PayMongo: a saved Converting Currency value no longer switches off the underpayment check
Admin panel number fields accept a decimal typed key by key again, such as a PayTR commission rate of 3,26 or 3.26; the separator used to drop, turning 3.26 into 26
A payment now shows on the admin dashboard right away instead of after up to five minutes
PayPal subscription checks no longer log PHP warnings when PayPal returns a plan without billing cycles
A payment reminder sent from the invoice page now counts as a reminder and fires the reminder hook
Cycle Auto-Terminate now closes client renewal on domains too, while a renewal turned off by the system stays open
Invoice lines of domains carried over from 3.x showed the domain group name in the language of the old installation
After the automatic exchange-rate update, converted prices could keep showing the old rate for up to an hour
The German refund message for a payment that settled several invoices no longer splits the sentence with a dash
Payment method pickers on admin detail pages listed payment modules that are not enabled
Tax-free invoices were listed as Not Official instead of Tax-Free in the admin invoice list
The domain pricing window no longer shows the previously opened extension's prices for an extension that has none
The Paysera payment module triggered a PHP 8.4 deprecation warning each time it was loaded
Financial > Currencies list: the country flag next to each currency was drawn as a pill; it now uses the panel standard flag box (20x15, 2px corners)
Registrar modules written with the older positional signature received an empty domain name on renewal and registration
Premium theme cards in Theme Settings never showed a purchased theme and printed broken buy links and prices
Custom-price services keep their price on renewal, are quoted in their own currency and are no longer rewritten into the invoice currency
The Currencies page failed to open with "addSelect(): Argument #3 ($options) must be of type array, null given" on a system with no enabled payment method
Add-ons added to a service from the admin panel could get a start and renewal date one day off, depending on the browser's time zone
Realtime Register: TLD import and Price from Cost failed with "Status Code: 404" when the customer handle was empty, and Test Connection did not notice
Admin and client API: a refused module method, tool action, management change, connection test or gateway refund now answers 422 with a code instead of a 500 server error
Notification queue: the client's name in the recipient cell now links to the client profile and is no longer written twice
Admin API: updating the currency settings no longer switches the automatic rate sync off or resets the update period when those fields are omitted
PayU Hosted Checkout: the pay page no longer opens in error mode, the payment carries PayU's payment number, and a module saved without the sandbox setting no longer logs a warning on every payment
RazorPay: the pay page shows a short message instead of an error dump when the order cannot be created, and the payment records Razorpay's payment ID
CCAvenue: the CCAvenue tracking number is recorded on the payment
PayFast: subscription renewals are charged at most once a day in rand and close the renewal invoice, cancellations read PayFast's answer, and the transaction number is recorded
CoinPayments: payments are confirmed again in the order's own currency with the transaction number, and an underpaid invoice stays open for the remainder
Paysafe: payment notifications sent in the event envelope format did not find their order
Service details: while the Pricing Type is Linked to Product, the disabled amount field and the billing summary now show what the next renewal bills, instead of the amount stored on the service
Welcome window: the money step now refuses to switch off a currency that is still in use, as the Currencies page does, and the refusal names what keeps a currency in use; before, the window deactivated it silently
Admin API: sending amount to PATCH /services/{id} now switches the service to custom pricing and pricing_type is accepted; before, the service kept renewing at the product's price
Stripe Checkout: no new catalog product is created on every payment, add-ons appear as their own lines, and an empty Payment Methods field offers the methods enabled in Stripe
Grace and redemption: saving the window without changes no longer turns the periods off, fee lines use the client's language, and a period without an enabled currency is flagged
WHMCS import: prices come over in every currency, services renew at their WHMCS amount and show their latest invoice, and configurable options and add-ons keep their cycles and totals
Invoices: a missing currency falls back to the client's, a currency change converts flat line discounts, and negative lines no longer print or save as 0.00
PayPal subscriptions: the first charge is no longer billed a second time on installations behind UTC
Official invoice documents: the e-mail attaches the uploaded document, uploading can notify the client, files are saved under plain names and deleting the invoice removes them
Admin API: creating an upgrade or downgrade with a missing or foreign price, an ineligible target, an already scheduled downgrade or another open record now returns 422 instead of a server error
Mollie: a customer record created in test mode no longer blocks payments after switching to the live API key
Invoice numbering: an invoice created as paid takes the Proforma series when Paid Invoice Numbering is off
The admin API ignored product taglines and erased them when a language was updated
Ticket bulk actions and the panel single delete counted ticket IDs that do not exist as processed; unknown IDs are now skipped
A setting missing from an older configuration file now falls back to its default: consent records are no longer exposed to deletion and backups no longer switch off
Deleting an office or social media row in General Settings now enables Save Changes
Saving a product category or special group through the admin API no longer erases its FAQ and table columns or adds empty entries for languages it does not have
Cron safe mode now tells an outage from a database restore and holds queued jobs instead of deleting them
Order-detail picture of a product is now read over both owners on the Other tab, so a picture carried over by the 3.x upgrade is visible, replaceable and deletable from the panel
A failed profile or address write during sign-up, Create Client or the admin API no longer leaves a half-created account behind
Deleting a client who had a service whose module is not installed stopped halfway and left the client and the service behind
Website: an address with no record behind it that only another language's links matched showed the not-found page in that other language; the page now opens in the visitor's language
WHost: removing a database user from its only database is refused instead of deleting the user, a suspension reason reaches the account, and the capability probe sends no real-looking password
ResellerClub-family registrar modules said only "The answer could not be solved" when the provider's reply was not readable
Backup settings no longer accept a new folder that cannot be protected
The admin panel no longer fails when cron is down and the host has disabled mail()
Uploading a theme, addon or module reported success even when its files could not be moved into place
Opening a ticket through "log in as client" no longer marks the staff replies as read for the client
The DNS package dialog now explains backups correctly: an empty or zero limit means the customer cannot take backups
Linking an existing hosting account to a service from Management → Settings no longer fails
A category page laid out as category cards or a plain plan list never showed its External HTML Code, and neither did a product group page with nothing listed yet
A moved installation's admin panel could not be reached on its new address
Reporting a website message as spam blocked the sender's IP but never the sender's domain; the domain is now taken from the e-mail address, with public mail providers (Gmail, Outlook, Yahoo and the like) left out
An upgrade continued from the browser no longer stops at Moving files into place when the web server cannot find the php command; the health check uses the PHP CLI beside the running PHP
The trust-this-device box could not be ticked in time: the last digit of the verification code submitted the form on its own
Failed licence checks kept the automation warning up after the licence was verified again
The password generator on the admin password reset page opened under its backdrop and could not be used
An admin activating an order whose service cannot be set up now sees the reason, and the order is no longer marked complete
The failed admin sign-in email button opened the client login page
A failed admin save could show “SaaS API connection failed: dns” instead of the actual cause
Notification emails no longer print a leading dash when the sign-in location has no city
The client service page no longer hangs on every visit while the hosting panel is unreachable
Server modules now stop waiting after 10 seconds when the hosting panel or provider API cannot be reached
Searchable dropdowns opened underneath the cookie notice on phones, so their options could not be tapped
Staff sign-ins no longer switch on client attack mode or raise the multi-account risk signal
Spam Protection's IP rules no longer block a signed-in client from opening a ticket or sending a live chat message
Add-on actions no longer load an add-on's class file a second time, which failed with a class redeclaration error
The client list balance hint now says it adds up only positive account balances
WStyle and Basic: order pages, sign-in and account forms, client area pages, dialogs, badges and code boxes now use one compact type scale instead of printing at the full site size
The admin API saved the invoice special note as the text "Array" and the Taxation page stopped opening
The Currency related to country help text said the currency is shown to visitors from those countries; it is picked from the region in the browser's language settings
Settings: when two requests save the same new database setting at the same moment, the second one no longer fails with a "Duplicate entry" error
Module queue: unsupported cancel or suspend steps no longer fail, a step the service can no longer take fails with its reason, and a task for an uninstalled module fails at once
Invoices show one tax line per rate, including named rates such as CGST and SGST, on the client invoice page, the PDF, the cart summary and the APIs
Tickets: assigning a guest ticket to a client now moves the guest's own messages to that client, and a staff account can no longer be the target
WKYC: a switched-off provider no longer starts verifications, a refused start shows Could Not Start with the reason, and Sumsub return addresses are sent in the right fields
English email subjects for new invoices, orders, ticket replies and contact form replies now read correctly
Notification queue: Retry and Retry All Failed now send the notification again; the automation matched the retried item to the finished job of its earlier run and set it back to failed without sending
Refunding one invoice of a payment that settled several invoices: the refusal named the payment method by its internal code; it now uses the name shown in the panel
Menu Management: a refused save no longer leaves part of the changes saved, and placing a new item under another new item no longer fails
Notifications: a message for a delivery channel the system does not know is no longer queued only to fail on every cron run
Bulk notifications: the never-purchased option said include but narrowed the list; skipped scheduled sends left no trace
Module queue: a job that cannot succeed now shows its real try count, and retrying it gives back all three tries
Paymentwall: refund requests named the latest payment attempt's amount, not the attempt the customer paid
Payment page: a long bank account holder name (a company title) now wraps inside the bank transfer card on phones instead of running past it; IBAN, account number and SWIFT stay on one line from 576 px up
Invoice detail: a paid invoice keeps the item's product logo or icon when the row is hovered or tapped; the glyph faded out for the edit pencil even where no pencil is shown, so the box went empty
Domain pricing window: an enabled year no longer opens with its renewal or transfer field locked, and the cost column is translated
Turkish bank gateways: Garanti and seven others apply Converting Currency, İşbank refuses a foreign-currency invoice without it, refunds return the lira collected and PayTR adds instalment interest after conversion
Saving a product no longer turns off search indexing or erases SEO keywords set through the API, and saving with Indexed off no longer erases the SEO title and description
Module mail templates, such as the ProxmoxVE and WIPAM alerts, take the module's new wording after an update, while an operator's own edit is kept
Website Management lists returned an empty response on search and paging once they exceeded 500 records
Home page Featured Software shows a changed pick at once instead of after up to an hour, and its product list searches every software product and keeps saved picks beyond the first 30
An old page address under a language prefix (for example /de/old-slug) now redirects permanently to the page's own address in that language instead of opening another language's content
Pasting a new licence key into the pre-filled key field produced a wrong key
Theme uploads and add-on downloads: uploading a theme into the folder of an installed theme now stops with a clear error instead of reporting success, and an empty leftover theme or add-on folder is filled
Captcha providers saved their settings with an empty Site Key
Shared Telegram chats received staff notifications in the site's default language instead of the language of the staff member who linked them
Notifications for a guest ticket left the requester's name empty
Saving cookie preferences wrote a warning to the error logs when a category was sent as a nested list
Typing the refreshed security code no longer hides the error message on the contact, support ticket and customer feedback forms
A cache file removed by another process while it is being read no longer leaves a warning in the error log
Software product pages now show the FAQ entered on their category (or the software group FAQ) instead of a fixed sample FAQ
Terms of four years or longer show their length instead of 'Annually'
Client email and phone verifications were missing or nameless in the client's Activity Logs
An error raised inside a database transaction that was then rolled back left no record in the error log; such records are now kept
Activating a domain with empty contact details fills them from the client's account, and a registrar that still refuses names the missing WHOIS fields
A checkout field rejected by the server now shows the server's reason under it instead of the empty-field hint
Client profile, sign-up, guest checkout, admin forms and both APIs now refuse a mobile number that is too short or not valid instead of saving it as typed
The sign-up form now states the real password rule (minimum length and required characters) instead of a fixed 8-character hint
3.x to 5 upgrade: the two fixed 3.x agreements are carried over as contract pages, and old agreement addresses and menu links open them instead of a 404
A licensed premium addon whose files are missing can now be installed from the Addons page
Service pages show a server module's new limits, plan and settings, and a saved server's details, at once instead of after up to five minutes
A second rich text editor in the same block attached itself to the first editor's frame and the editors after it never loaded
The new client form no longer says the welcome email includes login credentials, and the welcome email no longer tells clients created by staff that they set their password at sign-up
The Never Suspend and Never Cancel client settings now describe what they actually do
Many messages and labels now follow the panel or page language instead of English: client action, permission and upload errors, document verification, GDPR, blacklist and SMS screens, and the Google sign-in button
The document verification filters page no longer says that clients who have not verified cannot use their account at all
The blacklist band and its details dialog no longer label a staff member who cannot be found as "Admin"
Upgrade wizard: it warns about 3.x languages and registrar modules that 5.x does not ship, explains an expired session instead of showing raw code, and centres its phase rows
Domain documents: choosing the first option of a dropdown field is no longer treated as an empty answer
Account verification: an answer of 0 is no longer saved as empty or rejected as a missing required field
Domain detail: opening the Billing Profile picker now collapses the current profile, as on the service detail page, instead of leaving it visible above the picker
Analytics reports: no empty grey cells in the figure strip, toolbar buttons stay together on phones, and the date range is no longer cut off in right-to-left panels
Multilingual forms: a save that arrives without the list of open language tabs now stores the changes it carries for secondary languages and leaves a language sent empty untouched
DNSSEC: for registrars that take a DNSKEY record, the client and admin forms now ask for the public key and key flags instead of DS digest fields, and logs keep the registrar's key tag
Default images: the placeholder logo of a module without one, the cover of a theme without one and the Garanti 3D Secure loading image were missing from new installations and showed as broken images
KeyHelp and SPanel: clearing the quota of a limited mailbox now shows a clear error; before, the window said it was updated and nothing changed
Domain-Bestellsystem: phone and fax numbers were sent to the provider in the wrong format and read back without their country code
Registration form: the city can be entered before a state is picked, a missing city is reported at the field, and the code box no longer keeps the previous verification code
Admin panel on narrow phones: on screens narrower than 360 px, pages no longer open pushed to the right with a wide empty area on the left
External verification fields: the Workflow ID box no longer accepts an address, and a refusal from the module now stops the save instead of saving the field without its settings
Client dashboard: when a summary card is hidden, the remaining cards now share the row instead of leaving an empty column
MutluCell SMS module: messages containing &, angle brackets or quotes (a link with a query string, a name with &) are delivered instead of being rejected as malformed XML
Bulk notifications: the Service Status filter now counts and reaches clients by the status of their services, instead of matching only clients whose add-ons had that status
A failed social sign-in or sign-up no longer shows the visitor the database error text
Checkout no longer strips non-English letters from a new customer's first and last name (Günaydın was saved as Gnaydn; Cyrillic, Arabic or Greek names blocked the order)
Service management and Webmail texts no longer promise one-click or automatic sign-in to the control panel
Sub-account permission and Restrict Access texts no longer promise one-click sign-in to the control panel
Product catalog: a two-segment category address (the 3.x form) now redirects to the category it names instead of showing its parent page
Hosting service passwords: a change replaces the old password in the access card and activation mail, entries are saved in full and follow the panel's rules, and an empty one is refused
International SMS: group settings appear on the International SMS page and open with their title filled in, and a delivery report no longer fails when the sending module was removed
Updates page: an inactive license is now explained in the panel language with a link to the license page, and the version is no longer reported as up to date when the release list could not be retrieved
Social sign-in: when no account matches, the message now says so and shows the address used instead of "no linked account"
A tooltip whose text looks like JSON, such as a mail provider error, no longer stops the admin panel's forms, tabs and other tooltips from working
Proxmox VE tool errors now name the field as the module's own form shows it; before, 16 fields appeared under their internal English names
Setup wizard now says the server is not keeping the setup session instead of silently returning to the agreement
Over-long or non-Latin text in sign-up, checkout, client and contact forms, such as a long postal code or company name, is refused with its field and limit instead of a database error
Panel texts and notification e-mail subjects now show apostrophes, quotes, ampersands and angle brackets instead of HTML entity codes
Help buttons in the admin panel opened a missing documentation page when WISECP was installed in a subdirectory
Keyboard focus ring now shows on file drop zones and code editors
The slider list logged a PHP deprecation for slides without a link
The contact form required a phone number but showed no phone field when the phone was set as mandatory
The trust score settings no longer state as a fixed rule that an account without support requests scores 0
The personal data request screens now name the service count as active or suspended services
Category pages, plan features, FAQs, support hours and the registration agreement placeholder now appear in the visitor's language in every shipped language, also after an update; operator edits are kept
The service name now follows a product change unless the operator customized it
The OVHcloud pricing page's verdict strip shows its headline again
Sending a bulk notification to a very large list no longer risks running out of memory
Domain screens and SynergyWholesale no longer offer or report the example.com placeholders as a domain's name servers
Hetzner Cloud cost sync summary missed add-on cost changes when only some language rows were outdated
Aurora email design now shows Instagram, YouTube, Pinterest and other social icons
Suspensions, cancellations and expirations made by the cron now appear in the client's activity log
The IP field no longer shows “UNKNOWN” for entries written by the system
Server modules written for 3.x now load their settings, language and pages in 5.0, and records left on a 3.x module spelling are linked to the installed module again
A domain added from the domain search no longer stays "Configuration Required" while the hosting offer is on; its cart line links to the hosting offer instead
The scheduled tasks alert on the dashboard came back after being dismissed while the proxy alert was also shown
cPanel import suggested account creation dates with the day and year swapped
Links to the site's own pages in page, category, product and knowledge base content were marked nofollow
Services by Product, Cancelled Services and Tickets by Service counted a service without a catalogue product many times over
Updating a software product through the admin API reset its licence settings
An automatic coupon that applies to none of the products in the cart no longer blocks the automatic coupon that does, so the discount appears in the cart
Language sitemaps listed pages, articles and categories that had no translation in that language
Bulk action bars on the client detail page only offer the actions the staff member is allowed to run
Services with unreadable stored settings no longer lose their module features in the admin panel, the client area and the API
Opening the forwarding section of a domain without forwarding no longer logs a warning, and the protocol and redirect type come back filled in
The BotShield list no longer shows a bare "beta-request" row; the update removes form settings that do not belong to the product
Articles keep embedded HTML5 videos
With the cookie notice switched off, a visitor who already answered keeps the cookie preferences link and can withdraw consent
WHOIS contact forms in the admin panel and the client area now have a second address line, and the client API carries it
Links to the Hosting and Server product groups ignored a custom URL Structure: menus, the canonical tag and the language switcher kept the default address, which then opened in another language or returned 404
A notification template that a module installs now shows its own name in the panel and in the admin API
An addon that is already enabled now receives the notification languages a core update brings, without being switched off and on
Saving a notification template in the visual editor moved table-row variables and conditions out of their table
Customers without a billing profile were taxed at the default rate in the cart and on admin orders
The SMS verification template's email note no longer falls outside the content table in the Aurora design
Billing period cards on the order page now show the Discount (%) set on the product's pricing row
Home page blocks: Platform Logos can be reordered by dragging and saved in any language, removing a logo in one language keeps the shared image, and an empty title stays empty
Bank Transfer settings now warn when the method is hidden from clients because no active bank account exists
Services: an immediate status change with 'Apply on module' on a service whose module is not installed now shows a clear, translated reason instead of a technical error
After a nameserver change the domain kept its order-time nameserver list with the old hosts
A different WHOIS contact on the order page opened on the first country of the list and the +1 phone code
Links to a module's admin page built outside the panel (a website or API request) pointed to an address that does not exist
The server-add card's guide link now opens the article for every documented module, including Pterodactyl, Pelican and Proxmox VE
shurjoPay: an unreadable verification answer no longer breaks the return page
Hosting and VPS category pages no longer promise a 30-day money-back guarantee, a 99.9% uptime SLA or free migration on the installing company's behalf; badges and notes you edited are kept
Add-on changes made through the admin API now appear in the service history
Software categories and admin API pages can no longer take an address that a page, theme page or product category already uses
Product galleries and cards follow the image order set on the Images tab, and the order detail image from the Other tab appears on the client's service page
Closing and reopening a language tab no longer changes that language's page address on save
Domains and services whose stored module name differs only in letter case keep their module (WHMCS import, Linux servers)
The client detail page opens for clients with very long billing histories
The AI field assistant now writes its result into code editor fields
Opening a client no longer builds the whole account statement
The Automation page now names the PHP a refused command line cron runs under, even while an HTTP cron keeps the automation running
A header background uploaded under Theme → Backgrounds or on a product group's settings could keep showing the old image or disappear
Menu badges carried over from WISECP 3 logged a warning on every page view in the WStyle and Basic themes
SSL certificates tool: Let's Encrypt, AutoSSL and self-signed certificate types now show their translated names instead of the raw type code
When a cancellation request is accepted or a service is reinstalled and the server account is kept, the message now explains what to do on that screen
Top-level creation_info and config in the admin API service management update now reach the server module
SonicPanel radio controls now refresh the service usage gauges right away
A cancelled or expired service no longer keeps its old suspension or cancellation reason after it is reactivated
The affiliate payout button stayed active while a payout request was still pending
Languages > Edit and Find and Replace no longer open a broken page
Service tool data no longer leaks between services handled in the same process, and a list read again after a tool action is no longer stale
A secondary language whose package was left unprefixed shared every address of the default language
Report Issue button now appears on installations without any store module
hreflang: a page's own-language entry uses its canonical address, and categories and not-found pages no longer list alternates for untranslated languages
Client pickers find a client by part of the e-mail address and no longer select a client on their own while the auto-match is still running
Backup downloads from the hosting tools work again in the admin panel and the client area
The ProxmoxVE private network attach and detach buttons and the file restore download button work again
Add-on definitions created or updated through the admin API keep their option ids
Server account import refuses an account a service already manages or a product not linked to that server, also through the admin API, and the Import button waits for a client and product
Service history rows of hosting tool actions now record who performed them: admin API calls are no longer attributed to the customer, nor impersonated actions split between staff and customer
A service or add-on cancelled outside its cancellation request no longer leaves the client's request pending: the request is closed and the service history records who cancelled it and through which channel
Customers can no longer file a cancellation request for a one-time service
The custom port button on the server form no longer pushes past the screen on narrow screens
Resource gauges on the service management overview share the card evenly, no longer overflow narrow columns and follow the dark theme
Bulk notifications: the opted-in recipient total counted only legacy consent values and ignored the current per-category consent
WStyle and Basic themes: Greek, Russian, Ukrainian and Arabic headings now render bold in the theme font
Collapsed sidebar: an open sub-group's counter showed between its child items
SolusVM 2: a root password set from WISECP did not work on the server; the password WISECP shows and saves is now the one SolusVM applies
DirectAdmin: a hosting limit of 0 was applied as unlimited
Services (By Country) report: sorting by Revenue or Avg. Service Value now orders the amounts numerically
RealtimeRegister: domains registered on the yoursrs nameservers no longer get sample DNS records, and the DNS template and service can be set in the module settings
Products: a product can no longer be saved with a Product Type that does not match its Product Group, which kept it off the website; the form keeps both fields in step and flags old ones
METUnic: contacts for non-.tr domains are no longer refused when the address is longer than 50 characters
Virtualmin: setting a mail or FTP account's quota to 0, or leaving it blank, now makes it unlimited; before, the account kept its old quota while the dialog said it was updated
Plan cards: hourly, daily and weekly plans no longer disappear from catalogue pages, Compare Billing Options shows only when there is something to compare, and no warning is logged per view
Product licensing: the copy button on the licence.php row now copies the whole file; before, it copied only the word "key"
Admin API: editing a language or switching it on or off no longer adds an internal key field to that language's package file
Server form: an API token is enough where the panel connects with one, and a server can no longer be saved or tested without the credentials its module needs
SSL product modules: Test Connection now checks the environment the catalogue uses, the Realtime Register SSL catalogue import works, and the admin API test receives the settings sent
Admin panel on phones: scrolling a dropdown list (such as Predefined Reply on a ticket) no longer opens the side menu, so an option can be picked
Module queue: the client's name in the service cell and in the task details window now links to the client profile
Pterodactyl and Pelican: an administrator client API key on the server record now drives the customer's game server controls; existing panel accounts keep their password and panel reCAPTCHA no longer breaks provisioning
Admin API: document verification fields now accept the field types that modules add (such as WKYC external verification) together with their settings, and run the same checks as the panel
METUnic: nameserver changes on generic extensions were refused before reaching the provider, and generic extensions were capped at five years
Captcha settings: the provider section no longer runs into the form list below it
Updates page: release rows fit narrow phone screens, and a reloaded tab of a hand-driven upgrade counts down and then continues the run by itself
Heleket: two installs sharing one merchant account could mint the same order reference
Addons page: the update mark clears once the update is installed and opens the update dialog even after postponing, and re-uploading an addon keeps its settings
News: an item created with Display on Website unticked is saved hidden, and one shown only to signed-in clients is no longer emailed to newsletter subscribers
Client API orders: requirements a product marks as mandatory were not enforced and were listed as optional
Product stock: an order created as Active from the admin panel or the admin API now takes its units from stock
Health Status: Web Access Protection now also checks the temp, storage and configuration folders and explains the Plesk setup
Closing a language tab left its rich text editor showing the removed translation
The server connection form no longer shows the address, username, password and access key labels wrapped in quotation marks before a module is chosen
The show/hide password button on client theme forms now keeps its tooltip and screen reader label in the page language after it is clicked
The bulk Activate window in the product list no longer says that hidden products will become visible
The blacklist restriction texts now describe what actually happens to services
The Arabic help text of the new client marketing switch now matches what the switch controls
Top-level menu items now show the icon and badge set in Menu Management
The product form's download file help text now says the client can download it while the service is active
The notification settings API now accepts a layout update that sends only some parts, such as the footer
In WStyle, the popup window opened as soon as the page loaded although its setting says it appears after a delay; a Delay (seconds) field now sets when it opens
Find and Replace found nothing for text that lives in site settings (company details, support hours, product group pages)
Emails now carry a plain-text version alongside the HTML one with every mail provider: SMTP, Amazon SES, Mailgun, SendGrid, Postmark, Mailjet, ZeptoMail and the rest
In the rich text editor's code (HTML) view, the Save button stayed disabled while typing and the first click did not save
The development license notice in the admin area follows the panel language, and the free developer license confirmation no longer says the website carries the notice
The software product field labelled “Short Description” is now named “What's Included”, and its help text says where the lines appear
The License Transfer Ended email no longer shows a broken icon
The group color in Hosting and Server group settings opened as black
Home page blocks and the domain page's included-features text now appear in the visitor's language; most languages used to see them in English
Help links on the ticket piping, spam protection, PayPal and SendGrid settings open the right guide page directly
Installment previews of Turkish bank gateways no longer log an undefined array key warning on every card number typed
Browser and server IP labels stayed in English in Turkish Aurora emails
The username row on the hosting account card no longer takes the server form's admin label
Turkish suspension SMS messages now include the suspension reason, and a typo in four Turkish SMS texts was fixed
Dashboard greeting: the comma between the greeting and the administrator's name now follows the panel language
Virtualizor: the product's Node setting now describes the automatic option correctly: the module picks the node with the most free RAM and skips locked, offline and full nodes
API: an on/off field sent as text ("false", "off", "no") is no longer read as on
Settings: the Sign-up card no longer says visitors can create an account while 'Require a purchase to register' keeps the sign-up page closed
Order page: a quantity add-on's billing cycle label now follows the selected cycle

Theme structure changed in this release. Review the diff before updating a customized theme. Review the Diff on GitHub

In This Release

Read the Upgrade Guide Send Feedback

Released: 3 November 2026
Theme Changes: View the Diff