4.0.3

Added​

• Complete cPanel Jupiter theme layout overhaul on port 2083 with top-bar pill search, notification and user quick actions, deep indigo sidebar navigation, section category icons, and 3-column inline tools grid.
• Complete DirectAdmin Evolution skin overhaul on port 2083 with royal blue banner headers, Evolution icon grid, search pill, "Your Account" overview, and status check indicators.
• General Information and Account Info widgets displaying Current User, Primary Domain, Shared/Dedicated IP, Home Directory, Last Login IP with flag, and hosting details.
• Standalone theme packages synchronized across theme directories.

Security​

• Strict VirtualHost configuration isolation: prevented cross-user directory access, directory traversal, and unauthorized PHP-FPM socket hijacking.

Improvements​

• Multi-path WAF decision log auto-discovery (Caddy Coraza, Nginx Coraza, HiTechCloud WAF) and domain log selector.
• Complete Vietnamese translation coverage for new dashboard and UI elements.
• Clean pass for all automated safety guards, template tests, and accessibility benchmarks.

Security audit​

• Per-account feature overrides moved to root's /etc/hitechcloud/hitechcloud/user_features/; a customer could write the old ~/features.txt and grant itself every feature.
• The php.ini editor parses the account's file as data (php -n), no longer loads it as root; application systemd units re-check every field before root writes them.
• Every root file operation in a home (PHP pool rebuild, my.cnf, backups, restore, git deploy, SSH keys, CMS installs, n8n, FTP, file manager, trash, malware quarantine, WordPress tools, site scan) walks with O_NOFOLLOW or runs as the account; root database clients never read the account's my.cnf.
• Webservers: nginx disable_symlinks if_not_owner, Apache SymLinksIfOwnerMatch with a narrower AllowOverride, OpenLiteSpeed owner-match links; the vhost editor checks every statement and refuses expressions, proxying, handlers and PHP_VALUE.
• Domains: --apex can no longer claim another account's name; DNS refuses $INCLUDE; dynamic DNS tokens are server-generated and rate limited.
• Databases: imports and exports run as the account in the client sandbox; PostgreSQL databases revoked from PUBLIC; MSSQL imports with -X; phpMyAdmin SSO never falls back to root and tickets are single use.
• WordPress actions that change a site are POST only (CSRF); the cron log shows only the account's own jobs.
• Admin (2087): raw webserver config is Super Admin only; resellers are held to their own plans, quotas, features and servers.
• Mail: sender maps stop one account's scripts sending as another's domains; the Dovecot master login is limited to local networks; webmail SSO links are single use.

Fixed​

• FTP accounts could not be created with the default directory (the web root itself); FTP directories are handed to the account safely, plan FTP limits are enforced.
• Admin automatic backups now run on the configured schedule on the native stack, with a chosen time and day; new accounts receive the default schedule; timers follow account renames and deletions.
• Mailbox send/receive suspensions take effect; aliases and catch-alls are no longer refused by quota-status; mail log lookups work; deleting a mailbox removes its data.
• DNSSEC zones are re-signed on edit; external CNAME/MX targets are no longer suffixed with the zone; the SOA serial never goes back; AutoSSL replaces self-signed certificates.
• Admin: CSF saves, Manage SSL custom certificates, editing a user keeps its reseller, plan edit keeps AI settings, swap resize, SMTP settings and test.
• Webmail: thread archive/delete/move act only on the viewed folder and never on drafts; forwarded messages are one .eml attachment; the plain-text part keeps its formatting.
• The cPanel and DirectAdmin themes no longer scroll sideways on phones.

Also added​

• A layout per theme set by the administrator (panel_layout_<theme> = standard, compact or boxed) and a stylesheet per theme (custom_code/themes/<theme>.css).
• Admin alert email and webhook accept up to ten recipients each; an option to hide the admin sidebar's Recent pages.