Client panel

What a hosting account has at hand, grouped as in the panel.

Email Files Databases Domains Software Security Advanced

Email

Email accounts: Create mailboxes on the account's domains, with a quota, change the password, see the space used and limit incoming mail, sending or logging in for each mailbox. Whoever uses the mailbox can get a one-time link to choose the password.
Forwarders: Forward mail from one address to another, on or off the server. Forwarding off the server rewrites the sender (SRS) so the messages are not refused at the destination.
Webmail: Open mail in the browser (Roundcube) without typing the password again: the login goes through the panel.
Automatic replies: Automatic out-of-office message for a mailbox, with a start and an end. It replies at most once per sender and never to lists, robots or automatic messages (RFC 3834).
Default address: What happens to mail for addresses that do not exist on a domain: by default it is bounced with an error, which is the safest option; alternatively, delivered to a mailbox on the same domain.
Email routing: Say whether a domain's mail is received on this server or elsewhere (for example, an external mail service), so that messages sent from here reach the right place.
Track deliveries: Look up the path of a sent or received message: whether it was delivered, deferred or refused, and why.
SPF, DKIM and DMARC: The records that prove your domains' mail leaves from this server. The panel creates them and signs mail with DKIM; here you see the status of each one.
Email filters: Per-mailbox rules applied on delivery (Sieve): move to a folder, flag, delete or stop, depending on the sender, the subject or other headers. No rule sends mail.
Spam filters: SpamAssassin scores every message that arrives from outside: the higher the score, the more likely it is spam. With the filter on, messages above your score go to each mailbox's Junk folder.

Files

File manager: Your account's files. Deleting moves to the trash, from where you can restore.
FTP accounts: FTP access to a folder of your account. Each FTP account only sees the folder you give it.
Disk usage: Where the account's space goes: the folders that take the most, mail and databases, so you know what to clean up.
Backups: The account backups made by the server and restoring by date: files, databases or mail, all or just a part. You can also make and download a backup of the account.
Off-site backups (SFTP, FTPS, S3): Send account backups to a server of yours (SFTP or FTPS) or to S3 storage, on a schedule. The destination's credentials are kept encrypted on the server.
Directory privacy: Protect a folder of the site with a name and password, asked by the browser before showing it.

Databases

MariaDB databases: Create databases and users, grant and revoke privileges, change passwords and see the size of each database. Names always carry the account's prefix.
phpMyAdmin: Open phpMyAdmin already logged in, only on the account's databases.

Domains

Domains: Main domain, addon domains, subdomains and aliases. Each can have its own PHP version and SSL certificate.
Subdomains: Create addresses such as shop.example.com inside one of the account's domains, each with its own folder, PHP version and certificate.
DNS zone editor: Records for your domains. The domain's own SOA and NS are managed by the server.
Dynamic DNS: A name in your domains (for example home.example.com) that follows your connection's IP: the router or a program on the computer tells the server when the IP changes. It uses the dyndns2 protocol, which most routers and ddclient know.
Redirects: Send visitors from one address to another (permanent or temporary), for example from an old page to the new one.
Force HTTPS: Always take visitors to the secure version of the site (https://), once the certificate has been issued.

Software

WordPress: Installation, updates and passwordless wp-admin access. Everything runs as your user, inside your area.
PHP version: Choose the PHP version of each domain, among those installed on the server.
PHP options: Change a domain's PHP options within the server's limits: memory, upload size, maximum time, showing errors.
Node.js and Python applications: Applications the server runs with your user, at an address on one of your domains. The code lives in a folder of its own, outside the site.
Git repositories: Link a repository (GitHub, GitLab or another) to a folder of a site. On deploy, the branch files go to the folder; anything there that does not come from the repository stays. It can deploy by itself on every push.

Security

SSL/TLS: Your domains' certificates. By default each domain has a free Let's Encrypt certificate, issued and renewed automatically. If you bought a certificate (for example organisation-validated, or a wildcard), you can install it here.
Password and security: Change the account password and see open sessions and recent logins.
Contacts and notices: The address the server sends this account's notices to, and which ones you want.
Two-factor authentication: Ask, besides the password, for a code from an authenticator app or a security key (passkey). Includes one-time recovery codes.
API tokens: Keys to automate the panel from scripts and other systems, through the REST API. Each token only does what you choose here, and never more than your account.
Sub-users: Access to your panel for the people who work with you, each with their own password and only the areas you choose. They sign in on the same page, as name@account. Your password, domains, backups, SSH and API tokens stay with you only.
SSH access: SSH login to the server with keys only, no password, inside the account's isolated area. The panel never creates the private key: create it on your computer and paste the public one here.
IP blocking: Stop IP addresses or networks from seeing the site.
Hotlink protection: Stop other sites from showing your site's images and files, using up the account's bandwidth.
Malware found: The files Imunify360 found with malicious code, what was done to each one and what to do next.

Advanced

Scheduled jobs (cron): Commands the server runs as your user, at the scheduled time. The time is the server's.
Site cache: Keeps your sites' public pages for 10 minutes and serves them without running PHP. It never keeps pages for logged-in visitors (for example in WordPress or a shop), submitted forms or password-protected areas.
Resource usage: The account's CPU, memory, process and disk use (CloudLinux LVE) and the times it hit the plan's limits.
Visits: Visit statistics for the sites: pages, referrers, countries, 404 errors, from the server logs.
Error logs: The sites' most recent errors (Apache and PHP), to understand why a page fails.
Access logs: Recent requests to the sites, line by line, to download or browse.
Bandwidth: Bytes served by each account's sites, added up from the web server logs every 5 minutes (with Nginx in front, it includes what the cache served). Read only.
FTP logins: Who logged in over FTP to the account's FTP accounts, when and from where.
Mail logins: Logins to the mailboxes (IMAP, POP3 and sending), including failed ones, to spot stolen passwords.
Error pages: Your own pages for the site's errors (404, 500 and others), instead of the server's.
Directory listings: Choose whether a folder without an index page shows the list of files or returns an error.