AdminBolt 1.9.4: REST API Coverage, Your Own Temporary Domain and Server Security Warnings

AdminBolt 1.9.4 is out. The REST API now covers much more of the admin, reseller and client panels. You can give the temporary domains of new accounts your own domain. Health warns about root password login over SSH and about websites served with a self-signed certificate.

REST API coverage

If you connect AdminBolt to a billing system, a customer portal or your own scripts, this release gives you more to work with.

The client API now covers mailing lists. For domains it covers redirects, maintenance mode, custom error pages, hotlink protection, directory indexes and private directories. It manages Redis, LiteSpeed Cache and Cloudflare for the account. Clients can manage their cron notification email, Git repositories and Git SSH keys. They can export a zone file and import a zone after a preview. On servers with cPGuard, they can run cPGuard scans of their home folder. They can also manage AI bot blocking for each domain. Access logs and the disk usage of each folder can be read too.

The client API follows the same rules as the client panel. A request for a feature the hosting plan leaves out is refused with a 403 answer and the reason. So is a request made with a suspended account's own API key.

The reseller API covers account actions, reseller settings, landing pages, IP assignments and reports, with the same rules as the reseller panel. Resellers can manage the feature lists of their hosting plans.

The admin API edits the same hosting account fields as Edit Account. An unknown field is refused by name and nothing is applied. Reseller limits, overselling and the reseller's mail server can be set through the API. A single-use link signs you in to a reseller's panel. The admin API also manages DNS templates, secondary DNS servers, the DNS cluster settings and global DNS zones. It manages the server's cron jobs, with a separate permission on the API key and every change in the activity log. Modules and their updates, PHP-FPM, MyApache and ModSecurity settings, configuration profiles and web server repairs are covered as well. On CloudLinux, the admin API also sets LVE limits and covers MySQL Governor (CloudLinux Only). The activity log and the server logs can be read with the filters of their pages. Sensitive values in log text stay masked.

Your own temporary domain

Until now, Create Account suggested temporary domains under myboltip.com. In Settings > General > Branding you can now set your own domain for them. The domain needs a wildcard DNS record that points at the server. When that record is not ready, the panel tells you which record to add or change. The admin API offers the same setting.

The free temporary domain stays available. Email Accounts, the Zone Editor, the client dashboard and onboarding now warn your customers that mail sent from it may fail SPF and DKIM checks at receiving servers.

Server security

Health and the Dashboard's Needs attention card warn when root can log in over SSH with a password. The warning links to SSH Access. It clears at the next check after the setting changes, wherever you change it. Health also warns when an active domain is served with a self-signed certificate.

On a server with a public IP address, the panel opened by that address now shows a trusted certificate once one is issued. This works on new installs and on upgraded servers. When the certificate cannot be issued, Health shows the cause.

For new servers, install.sh --ssh-key installs root's SSH public key during installation and can turn off password login for root. In the client panel, a certificate's private key stays hidden until the account owner clicks Show private key. Each view goes to the activity log.

Databases

New installs get MariaDB 11.4. The installer's --mariadb-version option picks another series. Existing servers keep the one they have. A migration between nodes whose target MariaDB cannot take the databases stops and tells you why. MySQL Governor installs on MariaDB 11.4 and 11.8 (CloudLinux Only).

When Database Settings cannot save a MariaDB or PostgreSQL value, it names the field. If MariaDB refuses a new value, the panel tries to put the previous settings back and tells you what happened.

Migrations between nodes and DNS

With secondary DNS checks on, a migration between nodes now reports completed once every active secondary nameserver serves the migrated zone. A secondary that still serves the old records is named. Accounts with PostgreSQL databases keep their database owners.

For each domain that is not healthy, DNS Health names the cause and the next step. DNS templates accept SRV priority, weight and port. Applying a template reports the result for each domain.

WordPress and websites

The WordPress installer checks the target folder at the start of the wizard and names conflicting files before anything is installed. A failed or blocked install shows the reason and the next step on the wizard page. When single sign-on to WordPress fails, Login to Admin (SSO) says why.

LiteSpeed Cache caches on LiteSpeed Enterprise. The Not Found URLs card on Metrics > Visitors and Domain Statistics now opens the list of those URLs.

Smaller things you may notice

Panel updates upgrade AdminBolt's own software. Roundcube, phpMyAdmin, Adminer, Softaculous and other third-party applications are upgraded from their own page, from the Updates tab of Module Manager or by their automatic updates. When a reboot interrupts the work after an upgrade, it resumes on the next start.

Accounts that enter CageFS get the default alt-php extensions (CloudLinux Only). Redis works on alt-php next to AccelerateWP Object Caching (CloudLinux Only). Client pages for features outside the hosting plan stay closed. Imunify360 and Private Directories follow the Feature List. Existing plans keep both on upgrade.

How to update

Upgrades run from the panel. Open Settings, then System Updates under System, check for updates and start 1.9.4 from there. New installs are one command:

curl -sSL https://get.adminbolt.com/install.sh | bash

Tell us how it goes

Tell us how 1.9.4 works for you on Discord or the community forum.