WP Panel v1.2.0 Officially Released: A Server Management Panel Built for WordPress

WP Panel v1.2.0 is officially released.

This is the first official release of WP Panel. It is a server management panel built specifically for WordPress: one command turns a clean Debian 13 into a WordPress hosting server.

A Word from the Author

A gift for all WordPress site owners on Children's Day.

I've been building WordPress on VPS since 2009, having used Junge's LNMP and BaoTa along the way. My blog is dedicated to teaching beginners how to build websites. Many of my readers are not computer science majors, and server management is a hurdle for them.

In the past two years, AI programming has shown me an opportunity. Someone who doesn't know Go actually managed to write a panel. WP Panel does only one thing: help you manage WordPress on your VPS. No bloated features, and even beginners can get started.

Having made a living from the WordPress ecosystem for years, this is my way of giving back to the community. Permanently free, with open-source code.

The project was written by AI and tested by me, with three rounds of security audits fixing 44 issues. It's not mature enough yet, but I will keep improving it. If you're willing to give it a try, feel free to provide feedback whenever you encounter any issues—you're helping this project get better.

—— naibabiji

What is WP Panel

General-purpose Linux panels are often bloated and complex, with too many features unrelated to WordPress. WP Panel does only one thing:Efficiently manage WordPress sites on a VPS. No Docker, no mail system, no FTP, no Java/Python/Node runtime environments.

Feature Modules

• Website Management: One-click site creation (automatically creates isolated user/directory/Nginx/PHP-FPM/database), suspend/enable/delete, reinstall WordPress;
• SSL Certificates: Let's Encrypt automatic application, automatic renewal 30 days before expiry, manual replacement, self-signed certificates;
• FastCGI Cache: Nginx full-site static caching, with a companion WordPress plugin for one-click clearing;
• Security Defense: Fail2ban + nftables progressive banning, Cloudflare/Google/Bing official whitelists, global rate limiting;
• Database Management: MariaDB password change, database backup/restore/upload restore/automatic backup;
• Scheduled Tasks: Visual Cron management, WP Cron replacement, incremental file backup, system task viewing;
• File Manager: Upload/download/delete/rename/compress/extract/cut/copy/paste/multi-select, chunked upload with resumable transfer;
• Dashboard: Real-time CPU/memory/disk/load monitoring, 24-hour/7-day/15-day historical trend charts;
• Alert Notifications: SMTP email alerts, independent toggles for CPU/memory/disk/service/SSL/site expiry/system update/panel update rules;
• Software Management: PHP/Nginx/MariaDB/Redis configuration modification, process daemon, log viewing;
• Panel Security：Random entry path + BasicAuth + Web dual authentication, bcrypt password hashing, login failure banning;
• Version Update：One-click update check within the panel, SHA256 + Ed25519 dual verification, automatic rollback on failure.

Security: Four Layers of Defense

In one sentence: as long as the login address and account credentials are not leaked, no one can get in. The panel has four layers of defense:

• Layer Zero · Scan Defense：Non-browser requests touching port 8443 are directly dropped at the packet level by nftables, banned for 30 days;
• Layer One · Random Entry Path：8-character random path (62⁸approximately 218 trillion combinations), scanners cannot possibly guess it;
• Layer Two · BasicAuth：Browser popup requires account credentials;
• Layer Three · Web Login：Web form requires the panel login password.

All four layers must be passed to enter the panel; failing any layer 5 times results in a ban. In addition, there is site isolation (each website has an independent system user, PHP-FPM Pool, and database), WordPress-specific protection (wp-login.php brute force and xmlrpc.php malicious requests, sensitive file scanning, 404 flood detection), update security (SHA256 + Ed25519 dual verification, automatic rollback on failure), and code transparency (GPL-3.0 open source, no data collection, no Web Shell or online code editing, bcrypt password storage).

New in This Version

• Newinstall-cn.shChina-optimized installation script: uses the Shanghai Jiao Tong University mirror plus a self-built reverse proxy to solve the problem of APT sources and GitHub being inaccessible during installation on domestic servers;
• Added a GitHub reverse proxy address setting in the panel backend, supporting custom reverse proxy URLs with a test button;
• Installation Scriptapt-getDisplays full progress, and shows both public and private IPs after installation completes;
• MariaDB password prioritizes reading the existing value to prevent password inconsistency when reinstalling after an interrupted installation;
• Added SSH port 22 scan protection: new connections exceeding 3 per minute per IP are automatically dropped by the kernel.

System Requirements

• Operating System: Debian 13 (Trixie);
• CPU: 1 core or above;
• Memory: 1 GB or above (Swap is automatically created if below);
• Architecture: x86_64.

The official version only supports Debian 13 and is no longer compatible with Debian 12. Domestic users are advised to fill in the reverse proxy address in the panel settings after installation, otherwise update detection may fail.

Install Now

For international servers, run:wget -qO- https://raw.githubusercontent.com/naibabiji/wp-panel/main/install.sh | bash. Domestic servers should use the install-cn.sh China-optimized script; see the release page for the specific command.

WP Panel v1.2.0 has been officially released: Viewv1.2.0 Release Page. Permanently free, open-source code (GPL-3.0).