3.9.4

A security and IPv6 release, and the first where every install, clone, backup and restore of an application works on a host-services server. Read Before you update first.

Before you update​

Suspended sites: only an administrator can lift an older suspension​

A customer could lift a suspension the administrator made - for abuse, malware or an unpaid bill - by pressing Unsuspend in their own panel, because both panels ran the same command and nothing recorded who had suspended the site. From 3.9.4 the record is kept, and the customer's panel can only lift a suspension the customer made.

Sites that were suspended before this change carry no record of who suspended them, and 3.9.4 treats every one of them as suspended by the administrator. Only an administrator can lift them - from HiTechAdmin > Domains, or with hitechcloudcli domains-unsuspend <domain> - including any a customer had suspended themselves. There is no way to tell the two apart after the fact, and letting a customer lift an abuse or non-payment hold is the worse of the two mistakes.

Suspension pages: the translations are machine-written​

Suspending a website now takes a reason - DMCA, abuse, billing, other or a custom message - and the site shows a page for that reason, in the visitor's language. The pages ship in the panel's seventeen languages. The English text was written by hand; the other sixteen were machine-written and have not yet been reviewed by a translator. Each page is editable in HiTechAdmin > Domains > Domain Templates if a wording needs correcting before that review.

Security​

• A banned IPv6 client came straight back. Bans and rate limits were keyed by the exact address, and an IPv6 client owns a whole /64 — four billion billion addresses — so it moved to the next one. Limits, bans and the IP Blocker now key IPv6 by its /64, and the firewall's IPv6 half is switched on (the update does this on servers where the firewall is on, and puts the old file back if SSH over IPv6 would not be accepted).
• The file manager followed a customer's symlink as root. A link pointing at a system file could be read or written through the panel. It no longer follows links it did not create.
• Mail and FTP passwords could be guessed without limit. Only SSH and the panel had fail2ban jails. Postfix (including SASL failures, which the stock filter does not count), Dovecot and Pure-FTPd now have them, for IPv4 and IPv6, on new and existing servers.
• A customer could lift a suspension the administrator made. See Before you update.
• The root terminal in HiTechAdmin is Super Admin only.
• The webmail's OIDC sign-out could run a javascript: URL taken unchecked from the provider's discovery document. It must now be https.
• Server backup credentials are taken out of every file an account can read (step 4 of the update), and the AI provider key is readable by root only.
• Login monitoring was blind to IPv6, and treated 10.0.0.1 as a known address because 10.0.0.12 had logged in before.
• The webmail's dependencies: four advisories (three high) fixed.
• WAF rule 4006 fires on command substitution, not on every jQuery call; customers can add exceptions from a blocked request.

New​

• Cloudflare only, per website. Only Cloudflare's addresses reach the site; a direct hit or a forged CF-Connecting-IP gets 403, and visitors are logged with their real address. Certificates keep renewing. Cloudflare's ranges are refreshed daily and a bad download is refused.
• A CAPTCHA with no third party. A proof of work on the 2083 sign-in and password reset and the 2087 sign-in, single-use, bound to the form and the address, with a no-JavaScript fallback. reCAPTCHA and Turnstile still work.
• Suspension reasons. DMCA, abuse, billing, other or a custom message, for a site or a whole account; the visitor sees a page for that reason in their own language.
• The login's country comes from a local database (DB-IP Lite), so signing in no longer waits up to 5 seconds on an outside service. An online lookup for unknown addresses is an admin setting.
• Installs and long tasks run in the background. All 15 CMS installers, WordPress, n8n, Node.js/Python/Ruby/Java/PHP apps, Composer, snapshots, file compression — and CMS and WordPress clone, backup and restore, which before this release did not work at all on a host-services server (they dumped the database inside a container that does not exist). A page can be closed and reopened; one job runs per account at a time.
• Mailbox storage is a plan figure, enforced; the customer's Usage page shows it.
• AI and MCP are sold by plan, with per-plan limits enforced per account.
• OpenResty as a WebEngine, and OpenLiteSpeed sites get the config editor (behind an allow-list, like nginx and Apache).
• Backblaze B2 as a backup destination; every destination and credential field says what goes in it; customers download their own recovery key.
• Bulk actions on sixteen list pages, including bulk domain delete as a job.
• Dashboard: layout kept per account, Lock/Reset, Favourites, and an Applications widget chosen by the admin.
• A new site shows the panel's page, not the web server's 403/404, on every WebEngine (existing sites get it when the update re-renders their vhosts).
• IPv6 throughout: Dynamic DNS writes AAAA (it wrote IPv6 into an A record, which stopped the whole zone loading), the DNS cluster accepts IPv6 peers, migrations rewrite AAAA records, per-account addresses keep an IPv4 and an IPv6 side by side, mail identity checks the IPv6 PTR, blocklist checks work for IPv6 senders, HAProxy listens on IPv6, and links built from an IPv6 host work.
• The webmail is HiTechCloud Webmail: show-password button, sign-out that also ends the identity provider's session (and back-channel logout, opt-in), .eml download and AI actions per message in a conversation, printing a whole conversation, profile photos in the admin's user list; "Done" in GTD no longer deletes a message whose only copy is there.
• user-list --detail with plan, disk, domains, status, last login, email, 2FA, IP, RAM/CPU, inodes and notes. Plain and --json output are unchanged.
• Billing modules: a new WISECP module (with account import). WHMCS and ClientExec no longer report a refused domain as created; WHMCS's usage sync wrote nothing before and now reads the panel's figures; WHMCS gets Server Sync. HostBill and Paymenter could not sign in or suspend at all — fixed. The Blesta module now loads in Blesta. FOSSBilling syncs an account.
• The CLI's commands are named for what they do (snapshots, zone, webfirewall, vpn…); the old native-* names keep working.

The container stack is retired​

New installs are host-services only; PODMAN_INSTALL.sh refuses and points to the migration tool. Servers still on the container stack are told how to move off it by the update check and a banner in HiTechAdmin.

Fixed​

• The upsell message named a plan that did not raise the limit reached.
• Restarting or rebooting from HiTechAdmin reported success before the service or server was back.
• CLI database calls could hang forever; every call now has a time limit.
• The daily submodule sync had failed since 26 September.
• Every panel route is answered on every stack; routes that only exist on the host-services stack show the retired-stack page elsewhere.

What the update does​

version/3.9.4/UPDATE.sh, after the binaries are replaced:

4. takes the server's backup credentials out of files an account can read;
5. rewrites the webmail's sudoers rule for the new command names; 6–7. keeps AI on every existing plan that had it, and makes the provider key root's alone;
6. gives existing plans their mailbox storage figure;
7. switches on the firewall's IPv6 half where the firewall is on (with rollback);
8. adds the fail2ban mail and FTP jails, and HAProxy's IPv6 binds;
9. installs the scheduled jobs, fetches the country database once, and re-renders every vhost.

Each step prints what it did, never fails the update, and prints the command to run by hand if it could not finish.