Software, Scheduled Tasks, Alerts, and Settings

Maintain basic services, scheduled tasks, alert channels, extension links, and panel configuration.

Software Management

Software management displays the status of services such as Nginx, PHP-FPM, MariaDB, and Redis, and provides controlled access to configuration and logs. Server-level configurations affect multiple websites; understand the scope before making changes.

Recommended values and automatic rollback

The PHP-FPM concurrency limit for a new website is calculated once based on server memory and CPU; existing websites will not automatically change when other websites are added or removed.
OPcache can recalculate recommended values for shared memory and cache file count, and can also manually clear the cache after code updates.
MariaDB's InnoDB buffer pool and Redis max memory can be given recommended values based on server memory.
After saving MariaDB, Redis, or OPcache configurations, the panel will attempt to start and check the service; if it fails, the original configuration is automatically restored.

Recommended values are just a starting point suitable for most servers, not a performance guarantee. For high-traffic workloads, adjust based on monitoring results.

Scheduled Tasks

You can create, edit, run immediately, and delete panel-managed tasks, and also view system tasks and execution logs. Tasks run according to server time; when troubleshooting time discrepancies, first check the timezone.

Alerts

Supports SMTP and Webhook testing, alert toggles, thresholds, and history. A successful test only indicates that the current connection is normal; also check inbox rules, spam, and third-party rate limits.

SMTP Testing and Staged Diagnostics

A normal „Send Test Email“ only verifies one complete send; „SMTP Diagnostics“ will use the saved configuration to sequentially check DNS, IPv4/IPv6 connectivity, TLS or STARTTLS, authentication, and test email submission, suitable for locating issues such as connection timeouts, certificates, accounts, or provider rejections. The diagnostic report can be copied and does not include the SMTP password or authorization code.

Diagnostic emails and normal test emails are two independent sends: if you run diagnostics first and then click Send Test Email, the mailbox may receive „SMTP diagnostic“ and „Test Email“ separately. Configuring SMTP itself does not automatically send emails.

When connection to common SMTP ports times out, diagnostics will perform a limited check of TCP 443 and 2525 on the same host to help determine whether it may be affected by VPS upstream port restrictions; it will not modify firewalls, SMTP configuration, or server network policies.

Site Managed Email Total Protection

In the „Site Managed Email Settings“ popup in SMTP settings, you can choose a preset or custom server-wide site email total limit, and separately limit the daily attempts for system alerts. Site transactional emails and panel alerts are metered separately but still share the same external SMTP account, provider quota, and sending reputation.

When site emails reach 70% and 90% of the total, the panel will display a reminder and attempt to send a notification as configured.
After reaching 100%, the site will be blocked from sending further managed emails; panel alerts are still handled according to their own daily attempt limit.
A single site also has independent per-minute, hourly, and daily quotas, as well as limits on the number of recipients, email size, and number of attachments.

The same ongoing issue will remain in the same alert process; a panel restart will not treat it as a first-time anomaly. The alert ends only when the issue actually recovers or when an administrator disables the corresponding rule.

Resource alerts for CPU, memory, and disk: repeat reminders at most every 2 hours.
Service or website unavailability: repeat reminders at most every 6 hours.
Operational alerts for SSL, backups, and scheduled tasks: repeat reminders at most every 24 hours.
Website expiration reminders are sent 14, 7, 3, and 1 day before expiration.

Rapid service recovery and OOM are recorded as one-time events. Alert history is retained for 90 days, and the page displays the most recent 100 entries.

Panel Settings

The settings page is grouped by usage relationships: the first row contains „Panel & Account“ and „Server Basic Settings“, the second row contains „Update Management“ and „WordPress Installation Package“; panel database backup and operation logs continue to use full-width areas. Panel updates and system updates are located in the same „Update Management“ card, but remain two independent operations.

Manage panel port, network proxy, telemetry, update policy, WordPress installation packages, and panel database backups.
AI settings have been moved to the AI Diagnostics page; remote backup settings have been moved to a separate page under Backup Overview.
Operation logs are used to track administrator changes in the panel.
The Extensions page only saves shortcuts to common external tools; it does not turn third-party tools into built-in panel features.

How to recover if you forget the root password?

If you can still log in to WP Panel, you can go to „Panel Settings → Server Basic Settings“ and click „Modify Server root Password“ to open the dialog. Before submitting, you must re-enter the current panel login password; the target account is fixed as Linuxroot, and cannot be used to modify other system users.

The new password must be 8–128 UTF-8 bytes, cannot contain colons, newlines, or NUL characters, and must match the confirmation password.
The dialog can use the browser's Web Crypto to generate a 24-character strong password locally, and provides show and copy buttons. The generation process does not request the backend and is not saved by the panel; after clicking copy, the password will enter the clipboard of the current device. Please promptly save it to a trusted password manager and clear clipboard contents that are no longer needed.
The password is only handed over to the system locallychpasswd, and will not be saved, echoed, or written into ordinary logs or operation log bodies.
A successful modification will not log out the current panel session, nor will it modify SSH configuration, firewall, or SSH login policies.
If the server originally prohibits root or password-based SSH login, the new password will not automatically lift these restrictions; please continue to follow the server's existing security policies.

Development Tools

Software Management provides two optional development tools. Install them as needed; not installing them does not affect normal website operation.

WP-CLI: A tool for managing WordPress from the command line, typically used when AI development access is enabled.
Node.js + npm: Only needed if your theme or plugin requires front-end build.

These tools are server-level capabilities. Once installed, they are shared by all websites and do not need to be installed or uninstalled per website.

Site Status and Scheduled Tasks

The scheduled task list will indicate whether a task is „paused with the site“ or „deferred during migration.“ Pausing a site will not rewrite the task„s enabled status; automatic runs will be deferred, and the last actual execution result will not be overwritten as “skipped.„ After re-enabling, it will naturally resume according to the original schedule.

When an administrator manually executes site tasks on a paused site, confirmation is required again; manual execution is not possible during migration freeze.

How long are logs and events retained?

Access logs, Nginx/PHP error logs, and raw WordPress security logs for newly created sites are retained for 14 days by default; existing sites continue to use their original retention period.
Structured WordPress security events are retained for 90 days.
WordPress update task event logs are retained for 7 days; update backups and large file artifacts are still retained for only 24 hours.
Panel operation logs retain the most recent 1,000 entries; scheduled task text logs retain the most recent 1,000 lines.
A single local log analysis covers at most 7 days and 512 MB; the existing two-year alert deduplication marker rules remain unchanged.

These retention periods apply to different data sets. „Event logs retained for 7 days“ must not be interpreted as meaning update backups are also retained for 7 days.

Where can I view SQL request evidence?

The legacy WordPress SQL probe alert toggle is no longer in use. The new SQL request policy is configured under „Security Settings“; evidence, ban results, and manual actions are viewed under „Security Defense“. No new panel, email, or Webhook notifications will be added. Alerts for spoofed search engine crawlers and the existing thresholds and windows remain unchanged.