Release notes

What changed in each release of HF Panel, grouped by area. Server Admin › Server › HF Panel updates shows the notes of a new version before you install it. See Updating.

1.0.0 — first production release

Runs on Ubuntu 22.04, 24.04 and 26.04 LTS and Debian 12 and 13. The whole server side is now one program: the panels, HF Mail, HF Files and HF Studio no longer run on PHP (PHP stays for customers' websites).

Addresses and panels

Three separate panels — Server Admin, Reseller Panel and Control Panel, each with its own address, sign-in, look and app icon. They open on the panel port only: https://server., panel. and reseller.yourdomain.com:8443. The same names without the port send visitors to your website.
The API on port 2087 — https://api.yourdomain.com:2087/v1, for programs only; a browser gets "403 Forbidden". The installer and the update open port 2087. The old https://panel.yourdomain.com:8443/api/v1 keeps working.
New names — HF Studio moves to db.yourdomain.com. The mail server has three names: mail.yourdomain.com (the MX and the reverse DNS), smtp.yourdomain.com and imap.yourdomain.com for mail apps. mx.yourdomain.com is no longer used and is removed once no domain needs it.
Port 465 for mail apps (SSL/TLS), next to 587.
Browsers get "403 Forbidden" on names that are not web addresses: ftp., smtp., imap., mta-sts. and the nameservers.
HF Files and HF Studio are apps of their own, opened from the Control Panel already signed in.
New interface — every screen of the three panels redrawn as one fast app: no full page reloads, errors next to the field, live logs in a dialog, a notifications bell, dark mode, keyboard shortcuts (press ?), a welcome tour and accessibility to WCAG 2.2 AA.
21 languages for the panels, HF Mail, HF Files, HF Studio and their emails, including Arabic, Urdu and Persian laid out right to left.

Installation, updates and removal

Checks first — the installer checks the system, CPU, memory, disk and virtualisation before it changes anything.
14-day trial from the installer: type T at the licence question.
Company name — the installer asks it with the domain and email (--company).
"Your server is ready" email with the sign-in addresses, DNS records, reverse DNS and next steps.
DNS list — the installer shows the records your domain needs before it starts; hf-panel dns-setup shows them later and --check looks them up.
Automatic SSL for the panel's names within 5 minutes of their DNS pointing at the server, without running the installer again.
Installer without a keyboard — every answer can be given as an option.
Signed releases — the installer, the panel's updater and the server check the release's signature before anything runs.
HF Panel updates in the panel: see what's new, update in one click, or automatically every night. Restarts happen without a gap, so the panel stays reachable.
Uninstaller — hf-panel uninstall keeps websites running; --purge deletes the accounts; hf-panel delete removes everything.
hf-admin is now hf-panel; the old name still works. hf-panel help lists every command.
admin@yourdomain.com always exists, and the role addresses (postmaster@, abuse@, dmarc@ …) forward to the administrator.

Accounts, resellers and staff

Feature lists — choose which tools each package has.
Team members — customers invite people with a role, their own sign-in and two-factor login.
Reseller privileges, pools and own brand — per reseller: what they may do, their account, disk and bandwidth pools, their own brand, panel address and nameservers.
Read-only staff logins, two-step approval for risky actions, and approval for resellers' deletes and restores.
Bulk actions — suspend, unsuspend, change plan, message or delete many accounts at once.
Users online, staff notes and tags, a support PIN, and a customer activity log with CSV download.
Import accounts from full account backups, Move accounts between servers, and Import from another host for customers. See Migrating.

Hosting

Account isolation — a private view of the filesystem per account, a private /tmp, hidden processes and an optional jailed SSH shell.
Disk limits and usage graphs per account next to CPU, memory and processes.
Web server profiles — Nginx, Apache and PHP-FPM tuning for the whole server, tested before every apply.
MongoDB databases and PostgreSQL databases for customers, with HF Studio.
Web Disk (WebDAV) and share links in HF Files.
Incremental backups, more backup destinations (SFTP servers and cloud storage) and restoring chosen files, databases and mailboxes.
DNS tools — Dynamic DNS, DNS templates, zone import and export, DNSSEC and DNS clusters.
Website protection — hotlink protection, leech protection and the web firewall per website.
App installer with updates and dry runs, and the WordPress Toolkit with a security checklist and known plugin vulnerabilities.
Developer tools — Perl modules, PEAR, Composer and PHP extensions per account; Node.js, Python, Ruby and Docker apps.
Staging sites, copy a website, page cache, image optimiser, speed test, uptime monitor and maintenance mode per website.
HF Tunnel, also from the HF Server desktop app.

Email

Mail delivery log — search what happened to each message, for customers, resellers and administrators.
Calendars and contacts (CalDAV and CardDAV) for every mailbox, with a calendar in HF Mail.
PGP in HF Mail, webmail two-factor login, filters and forwarding, a daily spam summary and a "mailbox nearly full" warning.
Send-only mailboxes, the spam guard that pauses an account sending far more than usual, and a mail queue screen.

Billing and business

VAT rules, currencies, account credit and quotes.
Domain sales — sell domain names and paid SSL certificates.
Notifications centre — alerts by email, webhook and chat apps, with quiet hours.
Unpaid invoice reminders, discount codes and free trials, a referral programme, a knowledge base, announcements, monthly customer reports and a weekly summary for administrators.

Security

The File Manager can no longer be led outside the account's home by links, .. or swapped folders; saves never leave a cut-off file.
Database imports run as the database's own user, never with root rights.
Restores, deletes, Git, SSH keys and app installs no longer follow links a customer planted.
Customers' ~/logs folders are owned by root.
MariaDB listens on 127.0.0.1 unless an account allows remote database access.
Hidden files such as .env and .git/ are refused on every website.
Websites, parked domains and DNS zones can't take the server's own names.
Several fixes in HF Mail's HTML cleaner, sign-in and sign-out.
fail2ban protects SSH, FTP, Postfix and Dovecot logins; the installer opens the real SSH port before switching the firewall on.

Updating
FAQ