Feature Scope and Boundaries

WP Panel is an open-source server management panel specifically for hosting and operating WordPress sites on Debian 13 VPS. It runs as a single Go program and directly installs and manages Nginx, PHP 8.3, MariaDB, Redis, Fail2ban, and nftables on the system. It is not a general-purpose Linux panel, nor a Docker platform.

The content on this page has been verified item by item against the source code by the WP Panel maintainers, applies to v1.8.0, and was last verified on 2026-10-12. Features not listed on this page indicate that WP Panel does not currently provide them.

Site Isolation and Resource Model

Operation Mode and Technology Stack

The panel is a Go binary managed by systemd, with its own data stored in SQLite. Website services directly use Debian system software: Nginx, PHP 8.3 (PHP-FPM), MariaDB, Redis, Fail2ban, and nftables, without using Docker or containers. The panel includes its own HTTPS service (default port 8443) and does not rely on an Nginx reverse proxy.

Boundaries:Only Debian 13 is supported, PHP is fixed at 8.3, there is no multi-PHP version switching, and Nginx cannot be replaced with Apache or OpenLiteSpeed.

Independent System User per Site

Each website is assigned its own Linux system user and a user group with the same name upon creation (no login shell), and the website directory is owned by that user. Different websites do not share system users.

Boundaries:This is Unix user-level isolation, not container or virtual machine isolation.

Independent PHP-FPM Pool per Site

Each website has an independent PHP-FPM pool and an independent socket, and PHP processes run under the website's own system user. All websites do not share a single PHP pool.

Boundaries:All pools belong to the same PHP 8.3 FPM service; restarting or reloading PHP-FPM (e.g., clearing OPcache) affects all websites.

PHP Process Limit and Traffic Peaks

Each pool uses pm = ondemand and has its own pm.max_children limit; this limit is calculated once based on server memory and CPU at site creation and then fixed. When a website's PHP processes are fully utilized, only that website will queue or report errors, without occupying other websites' PHP process slots. Idle websites do not keep PHP processes resident.

Boundaries:This limit only isolates the number of PHP processes, not CPU, memory, or disk I/O. When a website experiences a traffic surge, it can still slow down the entire server, thereby affecting other websites. The panel currently has no interface for adjusting the per-site process limit.

PHP File Access Boundaries

Each pool sets open_basedir, allowing PHP to access only the site's own directory, /tmp, /usr/share/php, and the site's panel key directory; it also disables exec, passthru, shell_exec, system, proc_open, popen, and show_source. Therefore, PHP code on site A cannot read site B's directory through ordinary file functions.

Boundaries:/tmp is accessible to PHP on all websites. open_basedir and disabled functions are PHP-level restrictions, not kernel-level sandboxes.

Sensitive File Permissions

WordPress's wp-config.php (the file containing database passwords and keys) has permissions 0600, readable only by the site's own user; the key directory saved by the panel for each website is 0700. Even if another website is compromised and gains its system user privileges, these files cannot be read.

Boundaries:Regular code files and directories use standard 0644/0755 permissions so that Nginx can read static files. If an attacker bypasses PHP restrictions and executes arbitrary commands as site A's system user, they may read site B's regular code files (but cannot read site B's wp-config.php and keys).

Database Isolation

Each website has an independent MariaDB database and an independent database user, and that user is authorized to access only its own database.

Boundaries:All websites share the same MariaDB service; a large number of slow queries from one website will consume global database resources.

Shared Server Resources

CPU, memory, disk I/O, network bandwidth, and the Nginx, PHP-FPM, MariaDB, and Redis services are shared by all websites on the same server. The panel does not set cgroup-level CPU, memory, or I/O quotas for individual websites.

Boundaries:Therefore, the statement „a problem with one website does not affect other websites at all“ is inaccurate; the accurate statement is that process identities, files, databases, and PHP process counts are separate, while overall machine resources are shared.

Redis Object Cache

The server has only one local Redis instance, and WordPress websites are distinguished by their respective key prefixes in wp-config.php.

Boundaries:The panel does not set a Redis password, ACL, or independent instance for each website, so Redis is not a security isolation boundary between sites.

Page Cache and OPcache

Nginx FastCGI page cache uses a single global cache zone, and each website uses its own cache key and can be individually enabled, disabled, and purged. PHP configurations (such as memory_limit and upload size) and OPcache are set uniformly across the entire server.

Boundaries:Different PHP parameters cannot be set for individual websites; purging OPcache reloads PHP-FPM for all websites.

Panel Access Model

The panel has only one administrator account. Access requires passing through each server's unique random entry address, browser BasicAuth, and web login in sequence; consecutive login failures or frequent access to incorrect addresses will automatically ban the source IP.

Boundaries:There are no multi-user, sub-account, reseller, or customer self-service panels, and no built-in TOTP two-factor authentication; panel sessions are stored in memory, and re-login is required after a panel restart.

Low-Memory Server Adaptation

During installation, parameters such as MariaDB are adjusted according to physical memory; when memory does not exceed 8GB, disk space is sufficient, and the system has no Swap yet, a 2GB Swap is automatically created as a buffer. The PHP process limit for new websites is also calculated based on memory and CPU.

Boundaries:The actual traffic a website can handle depends on the website itself, plugins, and cache hit conditions; the panel does not promise specific concurrency or visit volumes.

Features Explicitly Not Provided

• No email server, mailbox, or email sending/receiving hosting is provided; alert emails and dual-authorized low-frequency WordPress transactional emails are sent through an external SMTP service configured by the administrator.
• No DNS resolution hosting or domain management is provided; domain resolution must be set up at the domain registrar or DNS provider.
• No FTP service is provided. File transfer uses the panel file manager; when local development is needed, SSH/SFTP-based AI development access can be enabled for individual websites.
• No Docker, containers, or app store are provided.
• Websites in other languages such as Java, Python, Node.js, and Go are not hosted; website types are only WordPress and general PHP. Node.js can only be installed as a development tool on the server.
• Multiple PHP versions are not supported, and a PHP version cannot be selected for individual websites; all websites use PHP 8.3.
• Alternative components such as Apache, OpenLiteSpeed, MySQL, and PostgreSQL are not supported.
• No multi-user, reseller, customer sub-account, plan quota, or billing features are provided, and it is not suitable as a shared hosting panel for multiple customers.
• No per-site CPU, memory, disk I/O, or disk space quotas are provided.
• No centralized management of multiple servers is provided; each server installs its own panel, and only the website migration feature establishes a connection between two panels.
• No web terminal (Web Shell) or online code editor is provided.
• Ubuntu, CentOS, Rocky, AlmaLinux, or Windows are not supported; it is only for Debian 13.
• No unattended WordPress automatic updates are provided, nor are cross-website bulk updates; core, plugin, and theme updates are confirmed and executed by the administrator site by site.
• It is not a complete WAF, nor a malware or vulnerability scanner; security features mainly consist of rule-based blocking, banning, change alerts, and evidence logging.
• WordPress Multisite networks are not supported management objects: core/plugin/theme updates and administrator modifications will reject Multisite.
• Cannot import websites from other panels such as BT Panel, cPanel, or DirectAdmin with one click; migrating from other environments requires manually uploading files and importing databases.

All Features

Installation, Panel & System

• One-Click Install & Repair: Install the panel along with Nginx, PHP 8.3, MariaDB, Redis, and Fail2ban/nftables on a clean Debian 13 with a single command; repair mode preserves existing configuration, login credentials, and website data, and restores the panel program and panel database on failure.
  Entry: Run the official install.sh in the server root terminal (install-cn.sh is available for servers in China); run it again to enter repair mode
  Boundary: Installation configures the entire server (software sources, firewall, kernel parameters), so a dedicated clean server should be used and it cannot coexist with other panels; the „complete wipe“ option in the uninstall script will delete websites and data.
• Panel Login Protection: Random entry point, two-layer login, and CSRF protection; 5 failed login attempts or 10 visits to different invalid addresses within one minute will automatically ban the source IP.
  Entry: Random panel address → browser BasicAuth → web login; Panel Settings → Modify Account
  Boundary: Single administrator; no built-in two-factor authentication; re-login is required after the panel restarts.
• Panel & Server Settings: Modify the panel title, administrator and BasicAuth credentials, server timezone, hostname, NTP time synchronization, GitHub download proxy, and you can modify the Linux root password after re-verifying the panel password.
  Entry: Panel Settings
  Boundary: The root password will not be saved or echoed; this operation will not enable SSH password login or modify SSH configuration. The settings page is not a general Linux system configuration tool.
• Panel Self-Update: Check for and install new versions on GitHub; before installation, verify the release signature and digest and back up, and if the new version fails the health check, the old version will be automatically restored. Optional automatic updates are disabled by default; when enabled, any newer stable official release will be installed, and after the panel first detects a new version, it will wait at least 24 hours by default; pre-release versions will not be installed automatically.
  Entry: Panel Settings → Panel Update / Auto Update
  Boundary: Panel updates, system package updates, and WordPress updates are three independent features.
• System Package Updates: Check for updatable Debian packages and perform a one-time non-interactive full upgrade in the background; closing the web page does not affect execution, and upon completion it checks whether Nginx, PHP-FPM, MariaDB, Redis, and the panel are running properly.
  Entry: Console update prompt → Panel Settings → System Update
  Boundary: If the dry-run results show that any package needs to be removed, it stops immediately; it will not automatically roll back packages or automatically restart the server; it is not limited to security patches only.
• Website Themes & Plugin Candidates: Maintain a candidate list of themes and plugins that can be installed together when creating a new WordPress website.
  Entry: Extension Configuration; check when creating a new website
  Boundary: The list does not mean the panel endorses the security or compatibility of these third-party components.
• Project Announcements: Display project announcements fetched from the official GitHub repository in the console, which can be dismissed in the current browser.
  Entry: Console → Project Announcements
  Boundary: This is only for information display and will not change the server or website.
• WordPress installation package cache: Caches the official installation package from wordpress.org for shared use in site creation and core updates; supports upload and online download, and automatically checks for new versions every 7 days by default.
  Entry: Panel Settings → WordPress Installation Package
  Boundary: Automatic detection only refreshes the panel's local cache and will not automatically upgrade any website.
• Panel data backup and operation logs: The panel's own database is automatically backed up daily with the most recent 7 copies retained; manual backup, download, and restore are supported, and failed restores automatically roll back; the most recent 1000 operation logs are retained.
  Entry: Panel Settings → Panel Database Backup / Recent Operation Logs
  Boundary: Includes only the panel's own data, not website files or website databases.

Website runtime environment

• Website creation, reinstallation, and deletion: Create a WordPress or general PHP website in one step: automatically sets up an independent system user, website directory, MariaDB database and user, PHP-FPM pool, and Nginx configuration, and can apply for an SSL certificate at the same time.
  Entry: Website Management → Create Website / Delete; Website Details → Reinstall WordPress
  Boundary: Reinstalling WordPress will clear the website's files and database without automatic backup; deleting a website will not automatically delete existing backup files.
• Pause, enable, and expiration reminders: Pausing a website stops external services but does not delete data, and temporarily suspends the site's automatic backup, WP-Cron, SSL renewal, and other automated tasks; the website expiration date can be recorded and reminders sent in advance.
  Entry: Website Management / Website Details → Pause, Enable, Expiration Time
  Boundary: The expiration date is only used for reminders and will not automatically pause or delete the website.
• Domains and aliases: Modify the website's primary domain and aliases; you can choose to also modify WordPress's site address (home/siteurl).
  Entry: Website Details → Edit Domain
  Boundary: After changing the domain, the certificate will not be automatically reissued; you need to reapply for a certificate covering the new domain.
• General PHP website entry directory: General PHP websites can set the external entry point to the project root directory or the public subdirectory (suitable for frameworks such as Laravel).
  Entry: Create Website / Website Details → Web Entry Directory
  Boundary: Only these two options are supported; arbitrary directories are not supported; not applicable to WordPress websites.
• SSL Certificates: Automatically apply for certificates for the primary domain and aliases via Let's Encrypt, and attempt automatic renewal daily within 30 days before expiration; certificates can also be installed manually and certificate packages downloaded.
  Entry: Website Details → SSL Management; can be automatically applied for when creating a website
  Boundary: Uses HTTP-01 validation; the domain must be able to reach this server; DNS validation or wildcard certificates are not provided; manually installed certificates will not be automatically renewed.
• Custom Nginx rules: Add server-level and location-level custom rules for each website; perform syntax checks on save, and restore old rules if reload fails.
  Entry: Website Details → Nginx Custom Configuration
  Boundary: Only syntax is checked, not whether rules are safe; cannot modify the main configuration generated by the panel or the global nginx.conf.
• PHP Runtime Configuration: Each website automatically gets an independent PHP-FPM pool; modify global PHP parameters (such as memory limit, upload size, execution time) in Software Management, with automatic recovery on failure; provide OPcache recommended values and cleanup.
  Entry: Software Management → PHP Configuration / OPcache
  Boundary: PHP parameters apply uniformly to all websites and cannot be set individually per website; only PHP 8.3 is available; there is currently no interface to adjust the PHP process limit for a single site; clearing OPcache will reload PHP-FPM for all websites.
• FastCGI Page Cache: Each website can independently enable or disable Nginx FastCGI full-page caching, set cache duration, and clear it with one click. WordPress websites automatically skip logged-in users, the admin area, shopping carts, and other dynamic requests; the companion plugin automatically clears the cache when content is updated and can prewarm it.
  Entry: Website Details → WordPress Optimization / Clear Cache; WordPress Admin Bar → Clear Cache
  Boundary: No cache hit rate statistics; there is no per-site toggle interface for Redis object cache; enabling caching does not guarantee that pages will be cached.
• CDN Real IP and Website Logs: Identify real visitor IPs when a website uses a CDN (strict mode only trusts CDN origin IP ranges), for use in rate limiting, blocking, and logs; access logs can be disabled, log only errors, or log everything; logs rotate daily and 14 copies are retained by default.
  Entry: Security Settings → CDN Real IP; Website Details → Access Log Mode / Website Logs / Log Retention
  Boundary: Compatibility mode trusts request headers; if the origin server can be accessed directly, IPs may be spoofed.
• AI Development Access (SSH/SFTP): Enable SSH/SFTP access for a single website and download a one-time connection package, allowing local AI coding tools or developers to work within that website's files and database scope; the connection package includes a description of the current panel's capabilities.
  Entry: Website Details → AI Development
  Boundary: Disabled by default; reuses the website's system user, has no sudo, can only operate on the site's files and database, but is not a sandbox; cannot be used when file lock is enabled.

WordPress Management and Updates

• Companion Plugin WP Panel Optimizer: A WordPress plugin built into the panel and automatically installed and upgraded, responsible for cache clearing and prewarming, maintenance pages, security settings, image optimization, and other integrations with the panel.
  Entry: Website Details → WordPress Optimization → Companion Plugin; WordPress Admin → WP Panel Optimizer
  Boundary: If the plugin is deleted or deactivated, related integrations stop working; this can be detected and repaired in the panel.
• WordPress Managed Email: Server administrators can authorize low-frequency WordPress transactional emails per site to use the panel's centrally configured external SMTP, without delivering SMTP credentials to the site. Site administrators also need to confirm in the companion plugin, can set the default sender name and Reply-To, send real test emails, and view detailed email logs stored in the site's database.
  Entry: Site Details → WordPress Managed Email; WordPress Admin → WP Panel Optimizer → Managed Email
  Boundaries: Only for low-frequency transactional emails; no marketing bulk sends, persistent queue, automatic retry, bounce handling, or final delivery tracking; SMTP acceptance does not mean the email has been delivered. By default, full body logs are retained for a maximum of 250 entries and 7 days and may contain sensitive information. Takeover is paused when a known third-party SMTP plugin conflict is detected; WordPress Multisite is not supported.
• WordPress Administrator and Configuration Repair: View and modify the WordPress administrator in the panel (the database is automatically backed up before modification), detect the table prefix and repair wp-config.php, modify the site address, and set whether public password recovery is allowed (can be restricted to administrators only).
  Entry: Database Management → Database Details; Website Details → WordPress Optimization → Password Recovery Protection
  Boundary: Administrator modification does not support Multisite; repairing wp-config.php does not rename database tables.
• WordPress Security Switches and File Lock: Disable WordPress update checks, prohibit file editing in the admin area, toggle WP_DEBUG, reject XML-RPC at the Nginx layer (default), and disable application passwords; the site-wide file lock makes code read-only (standard mode keeps uploads and cache directories writable, strict mode keeps only uploads writable).
  Entry: Website Details → WordPress Optimization / File Locking
  Boundary: File locking is implemented through Unix permissions, not a WAF; after locking, plugin installation, updates, and other write operations require a temporary maintenance window or the panel's controlled updates; some toggles depend on companion plugins to take effect.
• Version and Component Detection: Automatically (approximately every 6 hours) or manually detect the WordPress core, plugin, and theme versions and available updates for each website.
  Entry: Website Details → WordPress Version and Components; WP Overview → Detect All Websites
  Boundary: Displays a snapshot from the most recent detection, not real-time status.
• WP Overview: A single page summarizes the WordPress versions, pending update counts, SSL, and detection status of all websites, allowing one-click detection of all websites without logging into each backend individually.
  Entry: Sidebar → WP Overview
  Boundary: „Healthy“ only indicates that no issues were found in the summarized items; it does not mean the website is necessarily accessible, secure, or backed up.
• WordPress Core Updates: Preview and confirm updates to the WordPress core on a per-site basis: verify installation packages using official checksums, back up the database and core files before updating, check the website after updating, and automatically roll back on failure.
  Entry: Website Details → WordPress Core Updates
  Boundary: Multisite is not supported; there is no unattended automatic updating or cross-site bulk updating.
• Plugin Updates: Preview and update plugins one by one, back up before updating, and automatically roll back on failure by default.
  Entry: Website Details → WordPress Components → Plugin Updates
  Boundary: Commercial plugins can only be updated when WordPress returns a regular download URL; update verification is not a code security review.
• Theme Updates: Update themes one by one; additional confirmation is required before updating the currently active theme; automatically roll back on failure by default.
  Entry: Website Details → WordPress Components → Theme Updates
  Boundary: There is no bulk theme updating; parent themes and child themes are not updated as a single unit.
• Single-Site Bulk Plugin Updates: Select up to 50 plugins within a single website to update sequentially, with a database backup before starting.
  Entry: Website Details → WordPress Components → Bulk Plugin Updates
  Boundary: Subsequent updates are paused after a failure, requiring manual rollback or skipping; bulk updating across multiple websites is not supported.
• Update Backups and Update Logs: View update-specific backups (retained for 24 hours after the task ends) and update logs to handle interrupted or failed updates.
  Entry: Website Details → Update Backups / Update Logs
  Boundary: Restoring an update database backup only restores the database; it does not roll back plugins, themes, or core files.
• Temporary Maintenance Window: For sites with file locking enabled, temporarily grant write access for 3–10 minutes using a dedicated maintenance password (extendable). Upon expiry or completion, locking is automatically restored and verified.
  Access: Site Details → File Protection & Temporary Maintenance; WordPress admin bar
  Boundary: Only releases file locks; does not affect the database or Nginx. A panel restart will end the window early and re-lock.
• WordPress Anomaly Monitoring: Compares changes to administrator accounts, content, key settings, application passwords, and database persistent objects hourly. Alerts on anomalies such as newly added administrators, helping detect intrusions early.
  Access: Site Details → WordPress Optimization → Anomaly Monitoring
  Boundary: Disabled by default; hourly sampling may miss changes that occur and are reverted within the interval; compromised site code may interfere with results; not a malware scanner.

Image Optimization

• New Upload Image Optimization: Recompresses JPEG/PNG on upload, or uniformly converts to WebP.
  Access: WordPress Admin → WP Panel Optimizer → Image Optimization
  Boundary: Only processes new uploads after enabling; retains the original image if processing fails; WebP mode does not retain the original format file.
• Historical Image Batch Optimization: Performs in-place lossless compression on existing JPEG/PNG files in uploads via the admin panel.
  Access: WordPress Admin → WP Panel Optimizer → Image Optimization → Historical Gallery
  Boundary: Does not generate WebP or change filenames; processes in place with no task-level backup.

File Management

• File Browsing, Upload & Download: Browse, search, upload (resumable uploads for large files), remotely import from HTTPS addresses (up to 5GB), and download files within the site directory.
  Access: File Management
  Boundary: Scope is limited to the site directory and database backup directory; not a full-server file manager; no online code editor.
• File Operations, Compression & Extraction: Copy, move, rename, delete, ZIP compress and extract, and repair site file permissions.
  Access: File Management
  Boundary: A failed extraction does not roll back entirely; online archives are not backups.

Database

• Site Database Management: Each site automatically corresponds to a MariaDB database and user, created and deleted with the site; view capacity and backup status, change the database password (WordPress sites sync wp-config.php).
  Access: Database Management
  Boundary: Cannot create standalone databases unrelated to a site; the panel has no built-in SQL console; full SQL operations are performed via on-demand Adminer.
• On-Demand Adminer: Temporarily launches Adminer for a single site when needed (can be set to auto-close after 15/30/60 minutes), accessible after logging in through the panel.
  Access: Database Details → Adminer
  Boundary: Full privileges of the site database account; no read-only mode, SQL auditing, or automatic backups.

Backup

• Database Backup and Restore: Manually or scheduled export of the website database; supports downloading, uploading SQL files for restoration, restoring from existing backups, or emptying the database.
  Entry: Website Details → Database Backup; Database Details; Backup Overview
  Boundary: Restoration deletes existing data tables and does not automatically create a pre-restoration snapshot; manually back up first if current data needs to be retained.
• Website File Backup: Scheduled or manual creation of full website backups and incremental uploads backups, with automatic rotation and download capability.
  Entry: Backup Overview → File Backup; Scheduled Tasks
  Boundary: No one-click file restoration within the panel; requires downloading and manual restoration; incremental backups only include the uploads directory.
• Remote Backup: Synchronize database and file backups to another server via rsync/SSH, or upload to S3-compatible object storage, and verify remote status and supplement missing files.
  Entry: Backup Overview → Remote Backup Settings
  Boundary: Cannot restore directly from remote with one click; requires downloading first before restoration.

Security protection

• Firewall, Rate Limiting, and Auto-Ban: Combines Nginx rules and rate limiting, Fail2ban, and IPv4/IPv6 nftables: automatically bans high-frequency requests, WordPress login brute force, sensitive file scans and mass 404 probes, high-confidence SQL injection URLs, and SSH brute force; repeated attacks result in progressively longer bans; identifies requests impersonating Googlebot/Bingbot and logs alerts; supports manual/permanent bans, whitelists, and official search engine IP whitelists; denies access to unbound domains by default.
  Entry: Security Settings; Security Defense
  Boundary: Not a full WAF: SQL injection rules only inspect URLs, not POST/JSON request bodies.
• Security Events and Code Integrity: Aggregates WordPress request security events; establishes a code SHA-256 baseline for websites with file locks enabled, checks for code changes and newly appearing PHP files in runtime directories hourly, and alerts.
  Entry: Security Defense → WordPress Security Events / File Security Events
  Boundary: Only alerts and preserves evidence; does not automatically delete or quarantine files; initial baseline does not prove original code is clean; websites without file locks enabled have no code integrity checks.

Monitoring, Logs, and AI Diagnostics

• Resource Monitoring: Displays real-time CPU (separately showing I/O wait and steal), memory, disk, and load, and retains 24-hour/7-day/15-day historical trends; shows PHP-FPM process resources per website; monitors managed services and logs out-of-memory (OOM) events.
  Entry: Console; Software Management → Service Status
  Boundary: History retained for up to 15 days; not an APM or time-series database; per-website statistics only include PHP-FPM processes, not database or network.
• Alert Notifications: Alerts for insufficient resources, service anomalies, SSL expiration or renewal failures, website expiration, website inaccessibility, WordPress anomalies, etc., can be sent via email (SMTP) or Webhook, with individual toggles for each type.
  Entry: Alert Notifications; Website Details → Runtime Monitoring
  Boundary: Failed sends are not retried; website availability checks are initiated from the local machine, not multi-region monitoring; per-site runtime monitoring is disabled by default.
• Log Analysis: Analyzes up to 7 days of website access logs: request volume, status codes, popular paths, visitor IPs, crawlers, and bans, and can transition to AI diagnostics for in-depth analysis.
  Entry: Log Analysis
  Boundary: A maximum of 512MB of logs can be read per session; the statistics are not exact PV or real visitor counts.
• AI Diagnostics: Aggregates website operation status, logs, and limited code snippets, anonymizes them, and sends them to an OpenAI-compatible AI service configured by the administrator for analysis, with support for follow-up questions.
  Entry: AI Diagnostics
  Boundary: Read-only: only provides analysis and suggestions, and will not automatically modify the website or server; you need to provide your own AI service, and diagnostic data will be sent to the configured provider.

Scheduled Tasks and Software Management

• Scheduled Tasks: Manage scheduled tasks via the page: Shell commands, replacing WordPress's built-in WP-Cron with system cron, and file backup tasks; supports immediate execution and viewing execution logs. When a website is suspended, its site tasks are automatically paused.
  Entry: Scheduled Tasks
  Boundary: Shell tasks execute arbitrary commands under the identity set by the administrator; you must verify command safety yourself.
• Software and Service Management: View, start, and stop managed services such as Nginx, PHP-FPM, MariaDB, and Redis; edit key configurations for PHP, Nginx, MariaDB, and Redis (failed saves restore the previous configuration) and provide hardware-calculated recommended values; view logs; install WP-CLI and Node.js development tools.
  Entry: Software Management
  Boundary: Only manages fixed managed services; cannot install other software stacks (such as Apache, MySQL, or other PHP versions).

Website Migration

• Website Migration Between WP Panel Instances: Migrate WordPress or general PHP websites between two WP Panel servers of the same version, including files, databases, domains and aliases, SSL certificates, and main settings; multiple websites can be selected at once, and the source site displays a maintenance page during migration.
  Entry: Website Management → Website Migration
  Boundary: Only supports migration between WP Panel instances; cannot import from other panels; does not migrate backup history, access logs, custom Nginx rules, or custom command tasks; after completion, the administrator must update DNS or CDN resolution themselves.