4.0.4

Updates in one run​

• An update now finishes in a single run: the new version installs itself, brings the server's configuration up to date, records the version and only then restarts the panels. The admin's Updates page shows the new version straight away instead of offering the same update again.
• Versioned migrations are gone. Every update (and hitechcloudcli update --repair) re-applies the current configuration - mail, FTP, web server, PHP pools, backup schedule, jail - whatever version the server came from (4.0.1 or later).

Themes​

• The four customer-panel themes (default, cPanel, DirectAdmin, Plesk) share one template set; the full per-theme template copies (5 MB each) and two duplicate CSS copies are gone. Each theme is its own stylesheet plus a theme.json.
• Dashboards on 2083 and 2087, every theme: the information column (account details, usage, system information) stays beside the tools from 1024px up and narrows with the screen; the tools column is always the wider. It used to drop under all the tools below 1280px.
• The administrator can set a layout per theme (standard, compact, boxed) and a stylesheet per theme from 2087 (Settings and Custom Code).

Added​

• Admin user page: a Recommendations card from the account's resource profile, with an "over plan" badge.
• FTP logins are pure-ftpd virtual users running as the hosting account: uploads belong to the account, count against its quota and are editable by its PHP and file manager. Existing logins are converted, passwords kept.
• Admin alert email and webhook accept lists (up to ten each).
• Incremental backups: choose Full or Incremental per account (2083) or as the server default (2087). Incremental runs store only the files that changed, and a database only when its contents changed; a new full backup starts every week, month, N days or N backups. Restore to a date, and a status strip with the last full and incremental backup, chain size and next run.
• Live chat on 2087: the administrator can answer customers from a chat window like the customer's widget (conversation list, unread counts, replies in place).
• Office documents in webmail: open and edit Word, Excel and PowerPoint attachments and Drive files in a self-hosted Collabora Online (hitechcloudcli webmail office).

Fixed​

• Webmail: the composer could not save drafts (and so could not send) - a duplicate column in the draft upsert failed every save.
• WAF page on 2083 said "The firewall service is not running (active)" on every server; the status now reflects the service, and a rule reload no longer shows an outage.
• Restoring a backup by name could pick the oldest chain's full archive; it now uses the newest chain unless one is given, and checks the chain for gaps before extracting.
• 2087 themes: Server health and Resource usage cards, the Applications grid and the 2083 "Search Tools (/)" header button no longer break their layout.
• Admin live chat replies failed (missing CSRF token).
• Meet: background blur and image backgrounds cut out the person with a self-hosted MediaPipe selfie segmenter (GPU, CPU fallback) instead of a fixed oval, so the background applies everywhere around you.
• Webmail composer: text typed while a draft was saving counted as saved and could be lost; a failed Save draft now says so.
• Webmail Docker image: Meet could not use the camera or microphone (Permissions-Policy); the 11 MB segmentation runtime is cached.
• 2083, DirectAdmin theme: primary buttons (New Record, Reset Zone, New Domain...) were white on white; coloured notices keep their colours.
• 2083 dashboards: the 2FA, How-to and admin custom (Links) cards are themed like the other cards; the admin message box has padding.
• 2083 File Manager and Domains: page links are styled buttons instead of a stacked list; the file table scrolls inside its column on phones; list toolbars and form pages fit at phone width.
• HiTechCloud theme: sidebar sub-items clear the guide line again; the top-bar search label meets contrast.
• 2087, every theme: dashboard tiles no longer break labels mid-word, info-column titles wrap instead of being cut off, the Load/Mem/CPU/Disk bar is no longer hidden under the sidebar, button rows, backup tabs, WebEngine rows and tables fit or scroll inside their cards instead of being clipped; muted text, badges and primary buttons meet contrast in light and dark mode.

Security​

• Sign-in: per-account lock after repeated failures, single-use 2FA steps and passkey challenges, user verification required for passkeys, the same answer for unknown users and wrong passwords, rate-limited password resets, "sign out everywhere" revokes API and MCP tokens, sign-out only by POST, autologin links expire in two minutes and work once.
• Changing the account password or email needs the current password.
• The client IP is read from the rightmost untrusted proxy hop; Cloudflare headers only from Cloudflare.
• Web servers: PHP_VALUE / PHP_ADMIN_VALUE can no longer reach PHP-FPM from .htaccess; .htaccess loses SetHandler, AddHandler, Action and SetEnv; LiteSpeed and lighttpd no longer follow other owners' links; a stricter default disable_functions; phpMyAdmin and the mail autoconfig responder run as their own users.
• Mail: unauthenticated mail on localhost:25 may not use a hosted domain as sender; DKIM signing by rspamd refuses a header From the login does not own; send limits count by login.
• Databases: accounts can no longer reach databases of an account whose name starts with theirs; no wildcard MySQL grants or PostgreSQL CREATEDB for new accounts; one database limit across MySQL, PostgreSQL, SQL Server and MongoDB.
• Restore never trusts the archive: staged as root, rows validated, only allow-listed config, mail/DNS/DKIM only for domains the account owns, dumps loaded as the account.
• Admin: raw front-end (Caddy) config is Super Admin only; resellers limited to their own upsell plans, cannot change their IP, and no longer read host-wide metrics.
• WAF: lenient decoding, JSON/XML bodies inspected, oversized bodies refused or inspected at both ends (OVERSIZE_BODY_ACTION).
• Meet: only a host or cohost opens a room; join tokens are single use.
• The installer verifies the release signature.
• 2087: TOTP codes accepted within one 30-second step either side (enrolment and sign-in), SSH key input limited to one OpenSSH public key line, queue actions validate message IDs, autologin next paths stay on the panel; 2083 session cookies are always Secure.
• One implementation for 2083 and 2087: DNS zone writes, vhost saves, custom SSL uploads, mailbox create/quota/password, send limits, domain add/delete and PHP version changes all go through hitechcloudcli, so the admin panel and both REST APIs get the same checks as the customer panel ($INCLUDE refusal, zone load check under a lock, serial check, certificate/key match, password strength, plan mailbox/quota/send caps). Resellers' email API calls are limited to their own domains.

Things that behave differently after this update​

• .htaccess: lines using AddHandler, SetHandler, Action, SetEnv/SetEnvIf now return HTTP 500 on Apache. Replace SetEnvIf Authorization with CGIPassAuth On; remove cPanel AddHandler application/x-httpd-ea-php... lines.
• Mail from scripts: a site that sends through localhost:25 without SMTP authentication as one of its own domains is refused - use SMTP AUTH on port 587 or PHP mail().
• FTP: once the server has a TLS certificate, FTP requires explicit TLS (FTPS). Set "Require explicit FTP over TLS" in FileZilla.
• Backups to rclone remotes: an account may only use remotes named <account>.<name> or listed for it in /etc/hitechcloud/backups/rclone-remotes.conf.
• New account names may not contain _, and admin, harden, status, sudoers, help are reserved.
• PHP: putenv, pcntl_* and a few process functions are disabled by default (PHP_DISABLE_FUNCTIONS_BASELINE=off in native.conf turns the addition off).
• Custom SSL: a pasted certificate that does not name the domain, or whose key does not match, is refused (it used to be accepted with a warning).
• DNS API: raw zone saves and record deletes are refused when the zone would not load or named-checkzone cannot run.
• Mailboxes created from 2087 or the API follow the account's plan (mailbox count, per-mailbox quota, hourly send cap) and the server's password strength rule.