2.0.14

Released on October 15, 2026

💡 New​

• New opencli user-report <USERNAME|--all>: health report for a user with everything the interface warns about (disk, containers, PHP, SSL, DNS, WAF, databases, emails, cron jobs, security and more), with --section to run only some parts and --json to save it to /home/<context>/user_report_status.json, or for --all to /etc/openpanel/openpanel/user_report_status.json.
• OpenPanel > WP Manager and other app managers > Security: Scan for Malware now warns when files from that site are in quarantine, with the first five files listed and a link to the Quarantine page.
• opencli websites-secure has two new WP Manager rules: wp_manager_disable_wp_admin blocks /wp-admin and wp_manager_mitigate_spam_logins drops login and comment POSTs without a same-site Referer. Also available in WP Manager > Security. #1167
• OpenPanel > Malware Scanner: new Scan Logs page with past scans and what they found, for scans started from the panel, the API and the automatic opencli files-malware_scan cron scans. Also available as GET /api/malware-scanner/logs.
• New mysql_enforce_username_prefix option in openpanel.config: when set to yes, new MySQL databases and users get the <context>_ prefix everywhere they are created (Databases, Users, Wizard, API, app installs).
• OpenPanel > MySQL > Configuration: suggestions are now based on actual usage (data size, redo writes, PHP-FPM workers, table cache misses), can also lower oversized settings, include three new settings (table_open_cache, table_definition_cache, innodb_flush_log_at_trx_commit), list problems a setting cannot fix (MyISAM tables, tables without a primary key, large WordPress autoloaded options, fragmented tables, slow queries), and the previous configuration is restored automatically if the database fails to start with the new one.
• opencli sentinel now starts a user's MySQL/MariaDB when they have databases, and stops it when an account older than 2 hours has none. Databases are read from the data volume on disk, not by connecting to the user's MySQL.

💅 Polish​

• OpenPanel > Containers: web server, PHP, cron, backup and other containers without a health check no longer show as starting forever.
• opencli sentinel no longer adds a new info entry on every run when the same container or service keeps getting restarted, repeats within 24 hours update one entry with a count instead.
• OpenPanel > File Manager: UX improvements to the File Manager page.
• OpenPanel > Malware Scanner: the scan spinner now shows next to the number of files scanned, and a scan stops when the page is closed instead of running on in the background.
• opencli user-list now shows RAM, CPU, disk and inodes usage in orange over 80% and red over 90% of the limit, a green dot for online users and suspended users in red.
• Cloudflare-only setting for admins and cloudflare module for users #1165

🐛 Bug Fixes​

• Dropdown menu for actions on email account #1189
• Websites on Nginx and OpenResty saw every visitor as the same internal 10.x IP address, so PHP's REMOTE_ADDR, access logs and per-IP rate limits all used the container IP instead of the visitor's. The container network is now trusted for X-Forwarded-For, existing users are updated on upgrade.
• OpenPanel > PHP > Options now warns when disable_functions lists exec, shell_exec or ini_get_all, PHP-FPM needs these to start.
• opencli sentinel no longer starts the stopped cron, backup and docker-proxy containers of users who don't need them on every hourly check only to stop them again, which also emailed users that those services were restarted.
• opencli sentinel no longer keeps cron running for users whose cron jobs are all disabled, never starts the MySQL type an account isn't using, and lists each user once in the restarted containers summary.
• Bug: Mailserver ports blocked when mailserver is installed after initial CSF setup #1184
• OpenAdmin > Web Firewall Rules: the REQUEST-901-INITIALIZATION rules set can no longer be disabled, every other rule depends on it and with it off all requests to domains with WAF on were blocked.
• Setting email quotas not working with latest DMS (after dovecot 2.4 upgrade) #1183
• freezes #1167
• Matomo auto install fails if domain not pointed to the server #1169
• opencli sentinel no longer clears SWAP on every run when it fills right back up. It now clears SWAP at most once a day and sends a single High SWAP usage! alert instead. #1172
• opencli update no longer fails with Update process is already running after a previous update: the restarted OpenPanel container kept the update lock open forever. Updates are now stopped after 30 minutes and older locks are deleted.
• opencli sentinel no longer skips all checks indefinitely because of a stale update lock.
• opencli sentinel reports an issue again (new notification, email and crashlog) once its unread alert is older than 24 hours, instead of staying silent until the admin reads it.
• opencli sentinel can no longer hang forever on a stuck podman command: podman calls have timeouts, checks are stopped after 10 minutes and the whole run after 15, with an alert to the admin.
• opencli sentinel now detects OOM kills on servers without /var/log/syslog or with classic syslog dates, by reading the kernel log with journalctl every hour instead of once a day.
• opencli sentinel webhooks no longer fail when the message has backslashes, tabs or quotes in the title, and long messages are cut to fit Discord's 2000 character limit.
• opencli sentinel no longer lists a domain under high traffic from an IP that only partly matches the attacking IP.
• opencli update now updates OpenAdmin again: opencli update --check and other nested opencli update calls made during an update re-ran the update instead of doing their own job.
• opencli websites-secure <domain> --list-active-rules no longer freezes, and active rules are no longer listed twice. #1167