AdminBolt 1.7.0: Backups Your Clients Can Restore Themselves

1.6.0 was about choice: a third web server, databases your clients could open on their own terms. 1.7.0 is about the days when something goes wrong. Getting a file back after a bad deploy. Knowing which admin changed a DNS record last Tuesday. Cutting off a mailbox that started sending 40,000 messages an hour before your IP range pays for it.

Here is what actually changes day to day.

Backups that live in the panel

There is a new Backups section. You register a storage destination, write a backup policy and attach it where it belongs: to a hosting plan, to a reseller or to a single account. From then on one dashboard tells you the state of every account's backups, the size, the last run and the error if there was one. Backups run on the server without holding up the panel. Older snapshots are removed on the retention you set. A failed run raises a notification instead of sitting quietly in a log nobody opens.

The part your support team will feel is on the client side. Accounts get their own Backups page: a snapshot picker, a searchable file browser and a restore that goes either in place or as a copy that leaves the live files untouched. Most restore tickets are one file or one folder. This is the version of that ticket where nobody has to open it. There is a Backup now button with a daily limit for the client who wants a snapshot before touching something.

You decide how far that goes. Self-restore is granted per policy, so accounts that should not have it do not get it. An account can be opted out of backups entirely. Admins and resellers can start a backup or a restore for any account they manage. Every run records who asked for it.

When a restore has to rebuild the account

Restoring an account that no longer exists in the panel used to leave you finishing the job by hand. Under JetBackup it now completes end to end. The system user JetBackup creates is adopted, then the domain, DNS zone, quota and cron jobs are provisioned around it. Site and mailbox ownership is put back the way the panel expects, so restored sites serve and restored mail is delivered. Cron jobs are reconciled as soon as the restore finishes rather than on the next sweep. The admin JetBackup page reads the license, version, storage and last-backup figures from JetBackup itself, so you are not checking two places to see whether last night ran.

A second step on every login

Admin, reseller and client accounts can add a second step to their login with an authenticator app or a passkey, with single-use recovery codes for the phone that ends up in a river. Changing the second factor, regenerating recovery codes or removing a passkey asks for a fresh code first. An admin resetting someone else's second factor confirms with their own.

Who changed what

The new Logs then Activity Log page records who changed what and when across hosting accounts, domains, DNS records, email, databases, FTP accounts, cron jobs, certificates, firewall rules, hosting plans, API keys and the panel's own accounts. Each entry opens on the previous and the new value. The list filters by event, object type, actor role, date and impersonated actions only.

Impersonation is the case worth calling out. An action taken while impersonating names both the admin who started the session and the account they acted as. The start and the end of every impersonation are recorded even when nothing changed in between, so "I only had a look" is on the record too. Resellers get the same page scoped to their own accounts. Passwords, tokens and keys are recorded as changed without keeping the value itself.

Mail that cannot run away with your reputation

One compromised WordPress install can put a shared IP on a blocklist in an afternoon. Email Settings gets a Sending Limits tab: hourly and daily limits per mailbox and per domain, values per hosting plan and overrides for a single mailbox or domain that has a reason to be different. The Email then Sending Limits page lists every rejected message with the account, domain and mailbox it came from.

With automatic suspension on, a mailbox over its limit loses SMTP login until its rate drops back under the limit. IMAP and webmail keep working meanwhile, so the customer can still read mail while you sort out what happened. An admin can suspend a mailbox by hand as well. A manual suspension is never lifted automatically. The page tells you whether the limits are actually being applied, so a server that is deferring outbound mail instead of metering it does not look the same as one that is enforcing. Mail sent by site scripts now carries the site's own sender address, so it is delivered and counted against the right domain. An upgrade applies that to sites already on the server.

On the incoming side there is a SpamExperts page in Email Settings. Clients whose plan includes the feature get a per-domain filtering toggle and one-click sign-in to the Spam Panel. Enabling registers the domain on the cluster before the MX records are rewritten, disabling restores them first, so mail keeps flowing either way. A scheduled sync retries unfinished changes and repairs a domain whose delivery route has drifted. Outgoing mail can also go through an external relay now, configured from the panel or the CLI. Forwarded mail leaves with a rewritten envelope sender, so it passes the receiving side's checks.

LSPHP without changing web server

Install mod_proxy_lsapi from the Module Manager and plain Apache serves LSPHP, with a pool per account and PHP version carrying the hosting plan's memory, CPU and process limits. LSPHP then shows up next to the other PHP providers on the domain, plan and PHP Engine Migration screens. The module refuses to uninstall while a domain still uses it and points you at the migration page.

Real visitor addresses behind a CDN

Servers behind Cloudflare or another CDN can name the header that carries the visitor address and the proxies allowed to set it, from both the Apache and the LiteSpeed settings pages. A one-click Cloudflare preset fills in the published ranges. Visitor statistics, access logs, the IP Blocker, login protection and REMOTE_ADDR then read the visitor's own address rather than the proxy in front. The client Access Logs viewer gains a Remote Host column.

Smaller things you will notice

• cPGuard: cPGuard joins Imunify360 in the Module Manager as a server security suite, with one of the two active per server. Install it from the module wizard with your license key, follow status and license on the admin page and hand the client page to accounts through the hosting plan feature.
• Firewall: rules can be created for ICMP, ICMPv6 and IPv6 addresses, the ping rules that used to be fixed become editable and the page tells you when the firewall service is down or the live ruleset is empty.
• CloudLinux: install without an activation key to use an IP-based license, see which precheck checks failed before an installation starts and watch a running job report elapsed time instead of looking stuck. CageFS daemons are listed on the Services page.
• Usage history: accounts get Disk Usage History and Bandwidth History charts from a daily snapshot, with a day the panel could not collect drawn as a gap rather than smoothed over. The reseller dashboard shows real totals and trends across its accounts.
• Certificate alerts: the panel warns before a certificate expires, warns again when a renewal fails and reports one that has expired, over email, webhooks and the admin bell, with the reason the issuer gave.
• Fixes: a database created with capital letters is addressed under the same name everywhere, saving an account with SSH enabled re-applies its access on the server and a failed action tells you why it failed instead of showing a generic message.

The technical changelog in the panel footer lists every item with its ticket number if you want the full picture.

Upgrading is one click

Upgrades run from the panel. Open the Updates screen in the admin UI, apply 1.7.0 and watch the live progress. Take a backup first out of habit and expect only a brief interruption on a typical VPS. The first page after the upgrade also loads faster than it used to, because the panel's framework caches now ship in the package instead of being built on your server.

New to AdminBolt? Installation is a single command:

curl -sSL https://get.adminbolt.com/install.sh | bash

Tell us how it goes

That is 1.7.0: backups your clients can restore themselves, a second step on every login, a log of who changed what and mail that cannot quietly burn your IP reputation. Tell us how it lands on Discord, the community forum or through the contact form.