⚠️ This product is in Beta — not production ready. Looking for testers — please apply →  ·  🐞 Report a bug →
Spec sheet — no hidden pro tier

Everything ships in v1.5.45. Free.

This page is the full catalogue, grouped by module. It mirrors the release changelog — every item below is in the product today, not on a roadmap. Bug fixes are deliberately left out; this is what the panel does. New in v1.5.45: Karnak Builder gains a template gallery with live previews (75 templates, 9 styles, blog), and customer PHP runs in a systemd sandbox.

🎨Karnak Builder — drag-and-drop website builder NEW IN v1.5.45

Your clients can build their own website without filing a ticket.

  • Build a site at a domain root or in a folder — starting blank or from a template gallery of 75 templates in 10 categories (trades, food, health, business, creative, tech, travel, community, shops & retail and more). Each card shows its colours, style, page count and font, and the list filters by category.
  • Preview before you pick: a template opens as a live, click-through copy at desktop or phone width; "Use this" selects it.
  • Nine site styles (Aurora, Vivid, Glass, Midnight, Bold, Editorial, Soft, Retro, Luxe) with a second accent colour for gradients and one-click Quick looks in the Theme dialog.
  • The editor autosaves, keeps a history you can roll back to, and has desktop / tablet / phone views.
  • Private preview link before publishing. Publish a site, take it offline, put it back online.
  • Images uploaded in the editor go straight onto the page; gallery and template photo boxes take a picture with a double-click. Blocks for FAQ, photo slider, social links, opening hours, team and price list.
  • Blog built in: posts at /blog/ with dates, tags, drafts, tag pages, paging, an RSS feed and sitemap entries — plus Latest posts, Post list, Post date and tags blocks.
  • One editor at a time per site: a second tab can take over the edit lock.
  • Published sites are plain static files. Publishing never overwrites files it did not write, and refuses to write into a folder the builder didn't make (such as an installed app's). Pages are cleaned on the server — no scripts, and only YouTube, Vimeo and OpenStreetMap embeds — and images are re-encoded.
  • Runs inside the tenant: all builder file work runs as the account's own user. Domains and Subdomains show a pill for each published builder site (more than two fold into one "Builder ×N" pill), and the Dashboard has a Karnak Builder quick action.
  • Packaging: accounts with no package can use it straight away. On packages the limit starts at 0 (off) — set "Karnak Builder sites" on each package (or reseller allocation) to switch it on for those customers.

🌐Websites & PHP

Unlimited sites, each isolated, each fast.

  • Unlimited addon domains + subdomains, each with its own docroot, vhost and per-domain PHP 8.3 / 8.4 / 8.5 pool (8.3 default); the panel itself runs on PHP 8.5.
  • Free Let's Encrypt SSL per domain with auto-renewal, force-HTTPS on issuance, and self-signed fallback for LAN-only servers. New subdomains get a certificate automatically, and the Subdomains tab has an SSL column with an Issue SSL button.
  • Subdomains page (📂): create a subdomain under one of your domains — it gets its own site, docroot and A record, and removal refuses while the docroot still holds files. The Domains page has Domains | Subdomains | Redirects tabs, and every subdomain row gets the same rewrite-rules editor as a top-level domain.
  • Subdomain SSL in the background: a new subdomain's certificate is requested while you keep working, its row shows a spinning "Issuing SSL…" badge and reloads when the certificate lands, and the Domains list shows SSL days left per certificate.
  • Redirects (↪️): 301/302 redirects from a path to a full URL, per domain, stored with the same rewrite engine as imported .htaccess rules.
  • Per-domain bot shield — on by default, toggleable per site.
  • Maintenance-mode holding pages, parked (alias) domains, and unguessable preview URLs that work before DNS moves.
  • Per-domain error logs, php.ini editor + OPcache toggle, branded landing page, and expiry tracking with alert bands.
  • Over-quota sites go offline cleanly (pool suspend + FTP lock) and self-heal when usage drops back under quota.
  • Per-account PHP truth: the panel converges switch / create / delete so every domain stays on its intended version.
  • PHP extensions (Admin → PHP extensions): install or remove imagick, redis, memcached, soap, gmp, bz2, sqlite3, pgsql, mongodb, imap, ldap and ssh2 on every PHP version at once, in the background. Each version's status is shown with missing ones in red, new PHP versions get the same set automatically, and removal is refused when it would take other PHP packages with it.
  • Customer PHP runs in a systemd sandbox: the system is read-only to PHP except the folders sites write to, a worker sees only its own account's processes, PHP gets its own /dev/shm, and setuid file creation plus low-level calls (mount, ptrace, raw I/O, kernel modules) are blocked — mail() keeps working. Applied automatically on update; a PHP version that won't start with the sandbox is put back without it, and fpm-sandbox.sh off turns it off as root.
  • Rewrite-rules editor for OpenLiteSpeed (RewriteCond / RewriteRule), plus a one-click .htaccess importer that converts what OLS understands and reports every skipped line with its reason.

✉️Email

A complete mail stack, not a checkbox.

  • Unlimited virtual mailboxes on Exim + Dovecot + SpamAssassin, with SMTP/IMAP and Roundcube webmail under enforced TLS. Webmail runs the current upstream Roundcube release (pinned checksum + signature), not the distro package, so security fixes arrive as KarnakPanel updates.
  • Mailbox import (Email → Manage → Import): copies every folder from another IMAP account — Gmail, Yahoo, iCloud, Zoho or any TLS IMAP host — into a mailbox here, in the background with progress. It is one-way (the old account is never changed), mail already here is kept, and running it again fetches only new mail. The remote password is never stored or put on a command line, only TLS with a valid certificate to public hosts is allowed, and the mailbox quota is enforced.
  • Mailbox management: set the quota on create and edit (capped by the account's disk allowance), set your own password, a usage bar with a percentage, a domain filter, and row actions in one Manage menu so the table fits a phone.
  • Forwarders including catch-all and plus-addressing: keep a copy in the mailbox of the same name, and edit a forwarder in place.
  • Vacation autoresponders — one reply per sender per 7 days — with optional start and end dates, editable.
  • Server-side sieve filters — file into folder, forward, discard — matching contains, is or starts with, checking Cc and the spam score, with pause, resume and edit.
  • Managed mailing lists with subscribers-only posting, per-list posting caps, and many members in one paste.
  • Deliverability scoring out of 100 (SPF / DKIM / DMARC / MX / TLS), DKIM wizard, SPF hard-fail option, and a strictness hint on the mail score.
  • Deliverability autopilot: once enough aggregate reports show your real mail passing, the panel suggests the next step — DMARC none → quarantine → reject, MTA-STS testing → enforce. You click each step; nothing changes on its own.
  • DMARC and TLS aggregate reports: reports sent to your domains are collected and shown per domain — who sends as you, and how often they pass. MTA-STS and TLS-reporting policies publish in testing first, then enforce once checks pass.
  • Mail guard (on by default): a mailbox that looks hijacked — sending from many networks, hammering its hourly cap, or causing mass bounces — has its outgoing mail held automatically, its queued mail frozen for review, and the owner and admin alerted. Reset PW restores sending; an admin can release a false alarm.
  • Mail to a non-existent address at a hosted domain is refused while the sender is still connected, instead of being accepted and bounced later — no backscatter to forged senders. postmaster@ and abuse@ always reach someone.
  • Per-mailbox spam thresholds, per-mailbox + global SMTP rate limits, and mail-client autoconfig for Thunderbird + Outlook.
  • Queue viewer with flush, plus queue tools: thaw frozen, delete frozen, delete-all with DELETE confirmation.
  • Mail queue browser: paginated per-message list with sender-auth badges, per-message view / retry / delete, search filter, stuck reasons, spool totals, failing destinations and next-retry times.
  • Per-domain mail handling: Local ↔ Remote toggle per domain — remote routes inbound by public MX while local mailboxes, forwarders, lists and autoresponders go dormant and reactivate on toggle-back.
  • ClamAV malware rejection and an optional weekend spam-scan skip (malware rejects, rate caps and relay policy always still apply).
  • Per-host mail certificates: each domain's Let's Encrypt certificate is served for its own mail hostnames over IMAP and SMTP submission, with the box certificate as fallback.
  • Mail on subdomains, fully: SPF, DMARC, MTA-STS and TLS-report records publish in the parent zone under the subdomain's name, the first mailbox/forwarder/list adds its MX + SPF records automatically, DKIM publishes when the zone is hosted here, and a subdomain without its own DMARC shows as covered by the parent's. The mail presets (Google, Microsoft 365, this server, DMARC) are offered for subdomains too.
  • The Email page is split into tabs — Mailboxes · Forwarding & rules · Authentication · Server (admin: sending limits, mail guard, spam scanning, SMTP relay) — with deep links like /email#auth; without JavaScript every section still shows on one page.
  • Authentication tab: one card per domain with SPF, DKIM, DMARC, MTA-STS and report status, a score with a readable checklist, and Check and Sign side by side. New domains get DMARC (p=quarantine) beside SPF and are DKIM-signed when created; Sign adds any missing SPF or DMARC record.
  • Server tab: queue, frozen, held-mailbox, outbound and guard tiles, plus held mailboxes from every account with a Release button. Pills stay neutral unless something is wrong.
  • Blacklist monitor: every night the panel checks the server's mail IPs (IPv4 and IPv6) and every hosted domain on Spamhaus, SpamCop, Barracuda, PSBL, GBUdb, UCEPROTECT, SURBL and URIBL. The admin gets an alert and an email only when a listing appears or clears, never every night, and a Blacklists card on the Mail queue page shows each list with its removal link and a Check now button. Lists that refuse this server's DNS resolvers show as "can't check", never as clean.
  • SMTP relay (smarthost) option for networks that block outbound port 25, with a test-mail check.
  • DMARC column in the email authentication view, plus a registrar copy-block (SPF / DKIM / DMARC values) for domains on external nameservers.

🧭DNS + DNSSEC

Authoritative DNS done properly.

  • Authoritative BIND9 with a full zone editor: A, AAAA, CNAME, MX, TXT, NS — plus CAA, SRV and SSHFP records with strict validation.
  • One-click DNSSEC signing with registrar DS output, automatic NS glue + SPF defaults, and zone validation before every reload (BIND rejections roll back instead of poisoning future rebuilds).
  • DNS secondaries per domain, import-from-disk, and reset-to-defaults.
  • New zones use the server's nameservers (ns1/ns2 of the panel domain), so customer domains no longer each need registrar glue — with a one-click "Use server nameservers" switch for existing zones.
  • Quick-setup templates (Google, Microsoft 365, local mail, DMARC, CAA), paste-import of zone text, zone export, a record-type filter, wildcard hosts, and a delegation check.
  • Redesigned DNS page: a searchable zone list with record counts (subdomains marked with the zone that holds their records), and the open zone as a tabbed editor — Records, Quick setup, Nameservers, Import/reset, Security, Zone file — with colour-coded record types and long DKIM values folded.
  • DNS at the registrar notice: a nightly check asks public resolvers where each domain's nameservers point. When they're with the registrar instead of this server, the DNS, Email and Domains pages say so — records added here aren't public — and the Email page gives SPF and DMARC records to copy across.

📁Files & FTPS

Browser editing with guardrails, FTP without plaintext.

  • A real code editor (CodeMirror, bundled): syntax highlighting by file type, line numbers, bracket and tag matching, auto-closing, find and replace, go to line, Ctrl+/ comment, wrap and font size, Ctrl+S to save — plus a Visual mode with a formatting toolbar for plain .html files. The editor runs in a sandboxed frame and each file keeps its own line endings.
  • File manager upgrades: dotfiles (.htaccess, .user.ini, .env) can be created, edited and renamed; delete goes to a 30-day Trash with restore; copy/cut/paste across folders; multi-file drag-and-drop with per-file progress bars and chunked uploads so big files aren't capped; extraction of .zip, .tar, .tar.gz, .tar.bz2, .tar.xz and packing to .zip/.tar.gz; breadcrumbs, sortable columns, permissions/owner column, subfolder search and image preview.
  • Upload webshell block plus upload-time antivirus — hostile files never land on disk.
  • Chrooted TLS-only FTPS (plaintext refused): main login plus extra jailed logins per user, FTP quota locks over disk quota, panel-synced passwords.
  • The FTPS page shows the exact host to connect to — the name on the FTP server's certificate — with port and TLS mode, and explains that any other name or the IP gives a certificate mismatch. Self-signed servers get a trust-the-certificate-once note.

🗄️Databases

MariaDB without the ceremony.

  • One-click MariaDB database + user + grants wizard, per-user resource caps (queries / updates / connections), and MySQL query caps on app-installer databases.
  • Admin-adjustable per-database-user limits on the Databases page — connections per hour, queries, updates and simultaneous connections (0 = no limit) — with an apply-to-all-existing option. The panel, API, app installers and importers all use the same settings.
  • Password reset with one-time display, delete with user cleanup, and gated phpMyAdmin.

🧰Apps — 1-click installs

Fully automatic, tracked in the panel.

  • One-click WordPress with admin provisioning and a per-install auto-update toggle (minor core + plugins via mu-plugin; themes and majors stay manual, off pins core updates).
  • One-click phpBB, one-click Flarum, one-click Vvveb CMS — all CLI-completed with hardened defaults, no browser wizard.
  • One-click Joomla 6 (domain root or any folder, PHP 8.3+): database, site and admin account all made by the panel with no web wizard — a failed install removes what it unpacked and its database.
  • One-click Drupal 11 (domain root, PHP 8.3+): ships the Article (tags, comments, image) and Basic page content types, the admin account is made in the panel, and Drupal's .htaccess protections are applied as server rules since OpenLiteSpeed ignores .htaccess.
  • One-click PrestaShop (pinned + checksummed, full CLI install with back-office URL reported).
  • WordPress staging clones: password-locked, mail-gated, hidden from search — with refresh, files-only or full-DB push (divergence warning + automatic restore points), snapshot restore and destroy. Cloning a WordPress whose setup was never finished is refused up front, leaving no staging domain or DNS record behind.
  • Fleet Updates for WordPress: nightly scan of every panel-installed site, one-click core and plugin updates per site or "update all safe", a restore point taken first, automatic rollback on failure, and an optional nightly schedule.
  • Redesigned Software page: app catalogue cards say what each app needs (domain root only, PHP version, admin created here or finished in the browser) and unavailable apps say why. The install form adapts to the chosen app — folder and admin fields only where they apply, domains on the wrong PHP version disabled with the reason, a live preview of the final URL, and the database limit checked before you start.
  • Installs report real progress — "Installing…" while running, then the page refreshes; a failed install shows the reason, and a second install on the same domain/folder is refused while one runs. Installed apps list Open site + Admin links (phpBB "Finish setup" while its installer is still there, PrestaShop's renamed back office), the WordPress auto-update switch and a Staging shortcut.
  • Installed apps can be removed. The Remove button deletes the app's files and, if "and its database" is ticked, its database too (only a database tracked under the same account). Removing an app from a domain root keeps Karnak Builder sites, other apps' folders, SSL validation files and autodiscover, and puts the "coming soon" page back. Flarum and PrestaShop web-server rules are removed with them. Removal is refused while the app has a staging copy or another site lives inside its folder.

💾Backups

Backups you can actually restore from.

  • Full account backups (sites, mail, databases) plus incremental daily snapshots with hard links, on a controllable schedule (set the time, disable/enable per account).
  • Selective restore — single file, mailbox, database or path — with browse-before-restore, and nightly runs that auto-register so nothing restores stale.
  • AES-256-CBC per-user encryption, transparent on every restore path, with key-loss warnings and a decrypt example on the Backups page.
  • Encrypted offsite mirror: S3-compatible (AWS / B2 / Wasabi / Hetzner / R2 / MinIO), SFTP, or local path via rclone behind a crypt wrapper — providers see ciphertext only. Nightly sync, one-click fetch-back into the normal restore UI, failure notifications.
  • cPanel full-backup importer: files, databases with WordPress credential recovery, mailboxes, stored mail, forwarders. Account delete clears snapshots so nothing lingers.
  • Opt-in incremental snapshot engine (restic): per-account file and database snapshots with 14 daily / 8 weekly / 6 monthly retention, a weekly integrity check, a monthly restore check, and a snapshot browser with database restore and file download.
  • "Create backup now" runs in the background — the page returns at once, shows "backup running" until it's done, and the backup appears in the list. The API POST /api/backups/create starts it in the background too.

⏱️Automation, daemons & cron

Scheduled work with proof it ran.

  • Per-user cron synced to system cron, wrapped execution with per-job run history, and dead-man monitoring with overdue + recovery mails. Admins can also see the read-only system schedule.
  • Cron page in plain English: schedules read as "every 5 min" or "daily at 02:00", a common-schedule picker fills them in, and each job's last run shows ok or failed with its output. The admin's System schedule is grouped and explains every job.
  • Supervised always-on daemons with watchdog auto-recovery, disk alerts, stale-tick banners on Services + Notifications, and an optional external heartbeat URL for dead-cron detection. Daemon and cron denylists block known-abusive patterns.
  • Bandwidth auto-suspend with monthly reset, so one viral site can't bankrupt you.

📊Monitoring & stats

Know something's wrong before your clients do.

  • Server stats (load, memory, processes, history graphs), per-domain traffic stats with bots / referrers / agents, and per-service status with uptime + one-click restarts.
  • Redesigned Stats page: a domain picker with Today / 7 / 14 / 30 / 90-day ranges; headline tiles for visitors, requests, data served (with the change against the previous period), share of real people vs bots, server errors, scanner probes and the busiest day; a daily chart splitting people from bots plus by-hour and by-weekday charts; response-code breakdown; visitors' devices, browsers and systems; top pages (successful page loads only) and outside referrers; bots grouped by name; scanner probes (.env, wp-login, phpMyAdmin…) in their own list so "Broken links (404)" shows real broken links; heaviest IPs flagged when they look like scanners; and the time span the log actually covers.
  • Account usage on Stats: bandwidth and disk tiles with quota bars, pace and disk-full estimates, 30-day bandwidth and disk charts, bandwidth per site this month — admins see the owner of the domain being viewed or can pick another account.
  • Downtime DOWN/RECOVERED mails with configurable recipient, cron dead-man watches with recovery mails, and domain + SSL expiry watch (30/14/7/1-day bands, reading the parent domain).
  • Nightly malware scans with quarantine, and a live abuse board (5s refresh): server tiles (load, CPU, RAM, swap, processes, customers over limit), per-user CPU/RAM bars with a 5-minute trend line, rows that flash when a customer is over the alert limits, a per-customer process list (command, RAM, running time) with Kill / Kill all, and customers' running MariaDB queries.
  • Services page redesign: summary tiles (running count, server uptime, watchdog, downtime alerts) and services grouped by role — Web & PHP, Mail, DNS & databases, Files & access, Security & system. Each tile says what the service is for and its ports, shows uptime, memory, tasks and crash auto-restarts, and refreshes live every 10s. Restart (with a warning for the web server, MariaDB, Exim and SSH), Reload, Start when down, Stop for FTP / spam filter / ClamAV, a "Restart everything that's down" button, and log links.
  • Dashboard redesign: account tiles (domains / mailboxes / databases / FTP against package limits, disk, bandwidth), a Quick actions grid of the most-used pages plus admin shortcuts, and a "Needs attention" card — expiring/expired SSL and domain registrations, accounts near disk quota, stopped services, a large or frozen mail queue, and nightly backups that stopped.
  • Admin live server panel: refreshes every 5s with real CPU %, network in/out rates and sparklines, compact service chips with restart, top processes, a 24h load + memory chart, and a "This server's hosting" card (account, domain, SSL-coverage, mailbox and database totals + heaviest accounts). Domains show SSL days left.
  • Usage alerts at 80% and 95% of disk space and monthly bandwidth — before the 100% limits lock FTP or take sites offline. The customer gets a panel notification and an email, their reseller gets a notification; one alert per level, re-arming below 75%, with bandwidth alerts resetting each month.
  • Firewall page redesign: status pills and live tiles (banned now / serious / bans today / never-ban / open ports), a live "Recent bans" card (when, IP, plain-English reason, the usernames tried, the actual log lines) with one-click Unban from every jail, a "Never ban" list for an IP or network (no wider than /16, applied instantly and kept across restarts), and IPv4+IPv6 rule twins shown as one row.
  • Telegram phone alerts for box-level urgents (off by default, with quiet hours and an in-panel connect guide), and update-available banners — red for security releases — with a daily probe.
  • Disk usage viewer: per-account breakdown (site files, mailboxes, databases) with click-to-drill-down folders and cached refresh.
  • Plain-language log viewer names, certbot renewals logged to the viewer, and disk quotas with bandwidth accounting.
  • Per-account usage graphs: 30-day bandwidth and disk bars against quota, a month-pace projection, and a "full in ~Nd" hint when the trend is genuinely rising.
  • Fail2ban card on Services shows live jail and ban status.

🏪Accounts, resellers & packaging

Sell hosting, not server access.

  • Admin / reseller / user roles with separate dashboards, packages with enforced disk, bandwidth, domain and mailbox limits, suspend/unsuspend, and fully logged login-as support sessions.
  • 🔑 Reset PW: admins (any account) and resellers (their own customers) set a new random password shown once — it changes the panel login and the FTP/system password and logs the user out. 📵 Reset 2FA switches two-factor off for users who lost their authenticator, so they can log in and set it up again.
  • Reseller branding (Reseller Center → Branding): panel name, logo, accent colour, support link and support email, shown to the reseller and all of their clients — branded clients see the reseller's support link instead of the KarnakPanel / HostBMS ones. Admins set it by logging in as the reseller.
  • Accounts page tidy-up: roomier rows with an avatar, username and email together, role badges and disk bars; actions trimmed to Login as + Suspend/Unsuspend + a "⋯" menu (email, role, reset password/2FA, delete); search in the header; stacked cards on phones. You can't suspend or delete your own row.
  • Packages: edit and delete plans; resellers only see their own plans.
  • Reseller client usage at a glance (domains / disk / bandwidth / sent-today) with package labels, per-user usage columns on Accounts, and pagination on all list pages.
  • One-click client plan changes with allocation + downgrade guards, and guarded admin role changes (last-admin / self / client-holding refusals, live sessions killed).
  • Dashboard server IP + panel version, FTP default-login display, database delete button, red reboot button with confirmation, and alert-email + malware-schedule settings.

🔌API, integrations & panel UX

Click it, or script it.

  • Role-scoped, hashed API tokens with optional IP pinning — including a WHMCS provisioning API (create / suspend / terminate / password / usage / packages) with a server module and setup card.
  • HostBMS billing platform — our companion self-hosted WHMCS alternative with a KarnakPanel server module built in. Accounts are created, suspended, unsuspended and deleted on your panel automatically. Learn more →
  • Token API with full resource coverage: domains, DNS records, mailboxes and forwarders, databases, backups and SSL issuance, under the same role scoping and IP pinning as the panel.
  • API tokens with optional expiry (30 / 90 / 365 days, or never), and a last-used time and IP on every token.
  • Version-gated two-phase server-transfer tools (export/import) for moving accounts between boxes.
  • cPanel migration hub: remote import (host + login + API token) and root import (SSH pkgacct + scp), both with live progress on the Migrate page. Sub and addon domains, autoresponders and user filters are included.
  • HestiaCP import on the Migrate page (root SSH or an uploaded backup .tar): every web and mail domain, site files with .htaccess rewrites converted for OpenLiteSpeed, the PHP version, MySQL databases with names/users/passwords, mailboxes with folders and passwords, forwarders, auto-replies and custom DNS records re-pointed at your server. Cron jobs arrive paused for review; anything unsupported (PostgreSQL, private dirs…) is report-only.
  • HostBMS billing module — a self-hosted billing platform with the KarnakPanel module built in. Accounts are created, suspended, unsuspended and deleted on your panel automatically, out of the box. Sidebar button under Support in the panel. Learn more →
  • Search everywhere: accounts, domains, mailboxes, SSL, DNS zones + records — plus a first-run setup checklist that ticks itself off.
  • Notifications center with per-row delete and delete-all, live dashboard stats (15s refresh), abuse-board refresh, persistent 2FA nudge with scannable QR, and a reordered sidebar that puts daily tools first.

🔧Updates & maintenance

Updates that can't brick you.

  • One-click cryptographically signed self-update: snapshot, lint, migrate, atomic swap, health check, auto-rollback — with Ed25519 verification that refuses downgrades, replays and unsigned tarballs. Roll back to any kept release.
  • One-click system package upgrades with reboot detection, an OS safety trio (release upgrades pinned off, apt-sources integrity watch, dist-upgrade warning), and disk cleanup tools.
  • Daemon keeper with autostart, phpMyAdmin gate-password management, file-integrity re-baseline from the Update page, and an Ubuntu 22.04 end-of-life notice in the installer for new builds.
  • Fresh installs run on Ubuntu 24.04 LTS or Debian 13; Ubuntu 22.04 is refused for fresh installs (existing 22.04 panels keep receiving updates). On Debian, PHP comes from the Debian PHP repository with the signing key pinned in the installer.
  • Release upgrades (e.g. 22.04 → 24.04) are console migrations with a full backup — never a panel button.
  • Panel housekeeping: old web server config backups from panel switches are pruned (newest 3 kept), and a PHP runtime switch ends the old panel process.
  • Installer checks each release against a signature from the KarnakPanel build host before anything runs, runs a health check at the end, and supports unattended installs.

🔑SSH & access management

Root access without the foot-guns.

  • Rebuilt SSH page: live status, add-key form, keypair generator, keys-only toggle with lockout guard, and a 60-second how-to.
  • SSH-key-first hardening (passwords only disabled on explicit key), TOTP 2FA with admin/reseller enforcement, session manager, and brute-force throttling with attempt logging.
🛡️

A hosting panel controls root, so we treat it like it.

Signed updates, enforced 2FA, breached-password checks, bot shields, integrity watches — the security story is a page of its own.

Security code scanned by Semgrep GitHub — StuBlueUK/karnakpanel
Read the security story → Compare with other panels →
🐞 Report a bug