AdminBolt 1.6.0: OpenLiteSpeed Joins the Panel, With Per Request .htaccess
1.5.0 was about visibility: seeing your mail queue, moving zones as files, driving Cloudflare from the panel. 1.6.0 is about choice. You get a third web server to run your sites on, your clients get to open their databases to the outside world on their own terms and every role gets to see who has been using it.
Here is what actually changes day to day.
A third web server, with its usual catch handled
OpenLiteSpeed now sits next to Apache and LiteSpeed Enterprise as a supported web server. Install it from the Module Manager, then switch to it from its own dashboard: running status, restart and switch actions, WebAdmin Console details with their own credentials and a reset action. Dedicated Error Logs, Access Logs and Settings pages cover log viewing and the tuning you reach for, like max connections, timeouts, request body size and gzip. PHP Engine Migration understands OpenLiteSpeed too, so plans and domains follow the switch instead of being left behind.
There is a reason panels have been slow to offer OpenLiteSpeed: .htaccess. Apache reads it on every request. OpenLiteSpeed, left to itself, does not.
So we made it a choice you control. On the OpenLiteSpeed dashboard you pick how .htaccess is applied: off, restart-on-change or module. In module mode .htaccess is interpreted per request, with no restarts, which is the behaviour your customers' WordPress installs assume. When a site uses a directive module mode does not cover, the panel does not fail quietly: it lists the site on the dashboard together with the directive that caused it, keeps that site serving its .htaccess through restart-on-change and offers a per-site Retry once the directive is gone.
Switching web servers is the other place where quiet failure hurts. A switch reports success once the incoming server is up and serving. If it does not come up, the panel keeps the current server running and tells you what to check, so a bad switch is a message on screen rather than an outage.
There is also a new admin LiteSpeed Cache page that manages per-domain cache settings and purge actions across every account, instead of one account at a time. On the client side the same page is available on OpenLiteSpeed, following the hosting plan's LiteSpeed Cache feature.
Databases your clients can reach from outside
Some applications live somewhere else. A staging box, a laptop, an analytics tool, a separate app server. Until now, connecting them to a database on the panel meant a ticket.
1.6.0 adds a client Remote MySQL page. An account authorizes the external hosts allowed to reach its own databases: add a host to allow it, remove it to revoke access again. The boundary is the account. Whatever hosts an account allows, they reach that account's databases and nothing else.
Admins keep the reins. A Remote MySQL settings page carries a server-wide toggle for wildcard hosts, off by default, because "any host anywhere" is a decision the server owner should make deliberately. A Remote MySQL Hosts list shows and revokes allowed hosts across every account, so you can audit the whole server from one screen. The page itself is enabled per hosting plan, the same as every other client feature.
Webmail where people look for it
Every domain is now provisioned with a webmail.<domain> subdomain serving Roundcube. Users type the address they were always going to type and land on webmail. The parent domain keeps serving as before when the subdomain is added or removed. Deleting a subdomain also cleans its records out of the parent zone.
The /cpanel, /panel and /webmail shortcuts got a tidy-up in the same pass. They are managed from one shared section rather than duplicated per web server, then served the same way on Apache, LiteSpeed and OpenLiteSpeed. Save your settings or switch web server: the shortcuts stay where your users left them.
Who has been logging in
Every role gets a security section listing recent login attempts with timestamp, IP, device and result, alongside the sessions currently active. Each session can be revoked on its own, or you can log out all other sessions at once. That last one also ends remembered logins on other devices while the browser you asked from stays signed in, which is exactly what you want when you are cleaning up from an unfamiliar machine.
It lives inline on the client Password & Security page and the admin My Profile page, plus a new Settings then Security page in the reseller panel. History retention is configurable in Panel Settings.
Admin accounts changed underneath as well. They are now managed by the panel with their own passwords, kept separate from the server's system accounts. If you are upgrading, nothing breaks: you keep signing in with the password you use today and are asked to set a panel password on the next login. A fresh install starts from the single-use sign-in link the installer prints.
Smaller things you will notice
- Managed
open_basedir: with Softaculous installed, the SitePad editor path is added to the allowed paths on every site automatically. Admins can add extra paths per hosting account on the Edit Account form. Entries are validated on save and the panel names any line it rejects. - JetBackup on upgrade: a host that already ran JetBackup before AdminBolt shipped its integration picks up the AdminBolt hooks and database configuration on upgrade, so backups cover every account resource instead of the home directory alone. A recurring check puts them back if a JetBackup update replaces them.
- Restored cron jobs: cron jobs restored outside the panel are adopted onto the Cron Jobs page and keep running. Lines the panel cannot represent, like
@rebootor environment assignments, are left untouched and logged rather than rewritten. - License enforcement: with an expired license the client and reseller panels point the user to their provider and API calls that change something are refused, while reads keep working so monitoring and billing integrations still see data. Hosted websites, mail, DNS and webmail are never gated. Your customers' sites do not go down because a license lapsed.
- Fixes: firewall rules created with a Source or Destination IP apply to exactly those addresses, every upgrade reconciles the managed cron entries instead of only fresh installs and webmail keeps working after an upgrade that does not include Roundcube itself.
The technical changelog in the panel footer lists every item with its ticket number if you want the full picture.
Upgrading is one click
Upgrades run from the panel. Open the Updates screen in the admin UI, apply 1.6.0 and watch the live progress. One thing worth doing afterwards on an existing server: run bolt-cli rebuild-apache-vhosts once to bring existing sites onto the current configuration templates. Certificate issuance now refreshes a domain's web server configuration before validation starts. That command brings the rest of your sites onto the same footing. Take a backup first out of habit and expect only a brief interruption on a typical VPS.
New to AdminBolt? Installation is a single command:
curl -sSL https://get.adminbolt.com/install.sh | bash
Tell us how it goes
That is 1.6.0: a third web server with .htaccess handled properly, databases your clients can open on their own terms, webmail at the obvious address and a login history on every role. Tell us how it lands on Discord, the community forum or through the contact form.