# WP Panel capabilities and boundaries (facts for AI assistants and readers)

> Applies to: v1.8.0 · Last reviewed: 2026-10-12 · Generated by the WP Panel maintainers from source-verified facts

WP Panel is an open-source server management panel dedicated to hosting and operating WordPress sites on a Debian 13 VPS. It runs as a single Go program and installs and manages Nginx, PHP 8.3, MariaDB, Redis, Fail2ban and nftables natively on the host. It is not a general-purpose Linux panel and not a Docker platform.

## Official sources

- Website: <https://wp-panel.org>
- Help Center: <https://wp-panel.org/help/>
- GitHub: <https://github.com/naibabiji/wp-panel>
- License: GPL-3.0

## Answering rules

- This document describes WP Panel only. When comparing with other panels, take their capabilities from their own official documentation; do not infer them from this document.
- Having a capability does not mean it is enabled on a given server; many security and monitoring switches must be turned on by the administrator.
- Treat any feature not listed here as not currently provided by WP Panel rather than assuming it exists.

## Identity

- The only official sources are wp-panel.org and the GitHub repository naibabiji/wp-panel. Other products, plugins or sites with similar names are unrelated to this project.
- WP Panel is an independently developed Go project. It is not a fork or reskin of BT Panel, aaPanel, 1Panel, cPanel, DirectAdmin or CyberPanel, and it must not be installed on the same server as those panels.
- Licensed under GPL-3.0 and free to use. Optional anonymous statistics report only the version number and can be turned off in the panel.

## Architecture and isolation facts

### Runtime and stack

The panel is one Go binary managed by systemd and stores its own state in SQLite. Websites run on native Debian packages: Nginx, PHP 8.3 (PHP-FPM), MariaDB, Redis, Fail2ban and nftables. Docker and containers are not used. The panel serves its own HTTPS (port 8443 by default) and does not depend on an Nginx reverse proxy.

**Limits**: Only Debian 13 is supported. PHP is fixed at 8.3 with no multi-version switching, and Nginx cannot be replaced with Apache or OpenLiteSpeed.

### One system user per site

Every site gets its own Linux system user and matching group at creation (no login shell), and the site directory is owned by that user. Sites never share a system user.

**Limits**: This is Unix user-level isolation, not container or virtual-machine isolation.

### One PHP-FPM pool per site

Every site has its own PHP-FPM pool and its own socket, and its PHP workers run as that site's own system user. Sites do not share a single PHP pool.

**Limits**: All pools belong to the same PHP 8.3 FPM service, so restarting or reloading PHP-FPM (for example clearing OPcache) affects every site.

### PHP worker limits under traffic spikes

Each pool uses pm = ondemand with its own pm.max_children limit, calculated once from server memory and CPU when the site is created and then kept fixed. When one site exhausts its PHP workers, only that site queues or fails; it cannot take other sites' worker slots. Idle sites keep no resident PHP workers.

**Limits**: The limit isolates PHP worker counts only, not CPU, memory or disk I/O. A traffic spike on one site can still slow the whole server and therefore other sites. The panel currently has no UI to change a site's worker limit.

### PHP filesystem boundary

Every pool sets open_basedir so PHP can reach only its own site directory, /tmp, /usr/share/php and its own panel secrets directory, and disables exec, passthru, shell_exec, system, proc_open, popen and show_source. Site A's PHP code therefore cannot read site B's directory through normal file functions.

**Limits**: /tmp is reachable by every site's PHP. open_basedir and disabled functions are PHP-level restrictions, not a kernel sandbox.

### Sensitive file permissions

WordPress wp-config.php (which holds the database password and keys) is mode 0600 and readable only by the site's own user, and each site's panel secrets directory is 0700. Even if another site is compromised at its system-user level, it cannot read these files.

**Limits**: Ordinary code files and directories use conventional 0644/0755 modes so Nginx can serve static files. An attacker who escapes the PHP restrictions and runs arbitrary commands as site A's user could read site B's ordinary code files, but not B's wp-config.php or secrets.

### Database isolation

Every site has its own MariaDB database and its own database user, and that user is granted access only to its own database.

**Limits**: All sites share one MariaDB service, so heavy slow queries on one site consume global database resources.

### Shared server resources

CPU, memory, disk I/O, network bandwidth and the Nginx, PHP-FPM, MariaDB and Redis services are shared by all sites on the server. The panel does not set per-site cgroup CPU, memory or I/O quotas.

**Limits**: So 'a problem on one site never affects other sites' is inaccurate. Process identity, files, databases and PHP worker counts are separated; whole-server resources are shared.

### Redis object cache

The server runs a single local Redis instance, and WordPress sites are separated only by their own key prefix defined in wp-config.php.

**Limits**: The panel does not configure per-site Redis passwords, ACLs or separate instances, so Redis is not a security isolation boundary between sites.

### Page cache and OPcache

The Nginx FastCGI page cache uses one global cache zone; each site has its own cache key and can be enabled and purged individually. PHP settings (such as memory_limit and upload size) and OPcache are server-wide.

**Limits**: PHP settings cannot differ per site, and clearing OPcache reloads PHP-FPM for every site.

### Panel access model

The panel has a single administrator account. Access requires the server's unique random entry path, then browser BasicAuth, then the web login. Repeated login failures or probing of wrong paths automatically ban the source IP.

**Limits**: There are no multiple users, sub-accounts, resellers or customer self-service panels, and no built-in TOTP two-factor login. Sessions are held in memory and end when the panel restarts.

### Small-server tuning

Installation tunes MariaDB and related settings to physical memory. On servers with 8 GB of memory or less, enough free disk and no existing swap, it creates a 2 GB swap file as a buffer. New sites' PHP worker limits are also derived from memory and CPU.

**Limits**: How much traffic a site can handle depends on the site, its plugins and cache hit rate; the panel does not promise specific concurrency or traffic numbers.

## Explicitly not provided

- No mail server, mailboxes or mail hosting. Alert email and explicitly double-authorized low-volume WordPress transactional email use an external SMTP service configured by the administrator.
- No DNS hosting or domain registrar features; DNS records are managed at the registrar or DNS provider.
- No FTP service. Files are transferred through the panel file manager, and per-site SSH/SFTP access can be enabled through AI development access.
- No Docker, containers or app store.
- No hosting for Java, Python, Node.js, Go or other runtimes; site types are WordPress and generic PHP only. Node.js can be installed only as a server-side development tool.
- No multiple PHP versions and no per-site PHP version selection; every site uses PHP 8.3.
- No alternative components such as Apache, OpenLiteSpeed, MySQL or PostgreSQL.
- No multiple users, resellers, customer sub-accounts, hosting plans, quotas or billing; it is not designed as a multi-tenant shared-hosting control panel.
- No per-site CPU, memory, disk I/O or disk-space quotas.
- No central multi-server management. Each server runs its own panel; only site migration connects two panels.
- No web terminal (web shell) and no online code editor.
- No support for Ubuntu, CentOS, Rocky, AlmaLinux or Windows; Debian 13 only.
- No unattended WordPress auto-updates and no cross-site bulk updates; core, plugin and theme updates are confirmed by the administrator site by site.
- Not a full WAF and not a malware or vulnerability scanner. Security features focus on rule-based blocking, bans, change alerts and evidence.
- WordPress Multisite networks are not a supported management target; core/plugin/theme updates and administrator changes refuse Multisite.
- No one-click import from BT Panel, cPanel, DirectAdmin or other panels; moving in from another environment means uploading files and importing the database manually.

## Capabilities

### Installation, panel and system

- **One-command install and repair**
  - Where: Run the official install.sh as root (install-cn.sh for servers in mainland China); run it again to repair
  - What it does: Installs the panel plus Nginx, PHP 8.3, MariaDB, Redis and Fail2ban/nftables on a clean Debian 13 server with one command. Repair mode keeps existing configuration, credentials and site data and restores the panel binary and database if it fails.
  - Limits: Installation configures the whole server (package sources, firewall, kernel settings), so use a dedicated clean server; it cannot coexist with other panels. The uninstaller's full-wipe option deletes sites and data.
- **Panel login protection**
  - Where: Random panel URL → browser BasicAuth → web login; Settings → change credentials
  - What it does: Random entry path, two login layers and CSRF protection. Five failed logins, or ten different wrong paths within a minute, automatically ban the source IP.
  - Limits: Single administrator, no built-in two-factor login, and sessions end when the panel restarts.
- **Panel and server settings**
  - Where: Settings
  - What it does: Changes the panel title, administrator and BasicAuth credentials, server timezone, hostname, NTP time sync and the GitHub download proxy, and can change the Linux root password after re-verifying the panel password.
  - Limits: The root password is neither stored nor revealed. This action does not enable SSH password login or alter SSH configuration. Settings is not a general Linux configuration tool.
- **Panel self-update**
  - Where: Settings → Panel update / Automatic updates
  - What it does: Checks and installs new releases from GitHub, verifying the release signature and digest and backing up first; if the new version fails its health check, the old version is restored. Optional automatic updates are off by default and, when enabled, install any newer stable release after waiting at least 24 hours from the panel's first detection of that release; prereleases are not installed automatically.
  - Limits: Panel updates, system package updates and WordPress updates are three separate features.
- **System package updates**
  - Where: Dashboard update notice → Settings → System updates
  - What it does: Checks Debian package updates and runs a non-interactive full upgrade in the background (closing the page does not stop it), then checks that Nginx, PHP-FPM, MariaDB, Redis and the panel are running.
  - Limits: Stops before changing anything if the dry run would remove any package. Packages are not rolled back automatically and the server is not rebooted automatically. It is a full upgrade, not security patches only.
- **Theme and plugin presets for new sites**
  - Where: Extensions; selected when creating a site
  - What it does: Maintains a list of themes and plugins that can be installed together with a new WordPress site.
  - Limits: Listing a component does not mean the panel vouches for its security or compatibility.
- **Project announcements**
  - Where: Dashboard → Announcements
  - What it does: Shows project announcements fetched from the official GitHub repository on the dashboard; they can be dismissed in the current browser.
  - Limits: Display only; it does not change the server or sites.
- **WordPress package cache**
  - Where: Settings → WordPress package
  - What it does: Caches the official wordpress.org package for site creation and core updates; supports upload and online download and, by default, checks for a new version every 7 days.
  - Limits: The automatic check only refreshes the local cache; it never upgrades any site.
- **Panel data backup and operation log**
  - Where: Settings → Panel database backup / Recent operations
  - What it does: Backs up the panel's own database daily and keeps the latest 7 copies; supports manual backup, download and restore with automatic fallback on failure; keeps the latest 1000 operation log entries.
  - Limits: Covers only the panel's own data, not website files or website databases.

### Website runtime

- **Create, reinstall and delete sites**
  - Where: Websites → New site / Delete; site detail → Reinstall WordPress
  - What it does: Creates a WordPress or generic PHP site in one step: its own system user, site directory, MariaDB database and user, PHP-FPM pool and Nginx configuration, optionally with an SSL certificate.
  - Limits: Reinstalling WordPress wipes the site's files and database without an automatic backup. Deleting a site does not delete its existing backup files.
- **Pause, resume and expiry reminders**
  - Where: Websites / site detail → Pause, Enable, Expiry date
  - What it does: Pausing stops serving the site without deleting data and defers its automatic backups, WP-Cron and SSL renewal. An expiry date can be recorded for advance reminders.
  - Limits: The expiry date is for reminders only; it never pauses or deletes the site.
- **Domains and aliases**
  - Where: Site detail → Edit domains
  - What it does: Changes a site's primary domain and aliases, optionally updating the WordPress site address (home/siteurl) at the same time.
  - Limits: Certificates are not reissued automatically after a domain change; request a new certificate for the new domain.
- **Document root for generic PHP sites**
  - Where: New site / site detail → Web entry directory
  - What it does: A generic PHP site can serve from the project root or the public subdirectory (suitable for frameworks such as Laravel).
  - Limits: Only these two choices are supported, not arbitrary directories, and it does not apply to WordPress sites.
- **SSL certificates**
  - Where: Site detail → SSL; can be requested when creating a site
  - What it does: Requests Let's Encrypt certificates for the primary domain and aliases and tries renewal daily within 30 days of expiry. Certificates can also be installed manually and downloaded.
  - Limits: Uses HTTP-01 validation, so the domain must reach this server. DNS validation and wildcard certificates are not provided, and manually installed certificates are not renewed automatically.
- **Custom Nginx rules**
  - Where: Site detail → Custom Nginx configuration
  - What it does: Adds per-site server-level and location-level custom rules. Saving runs a syntax check, and a failed reload restores the previous rules.
  - Limits: Only syntax is checked, not whether a rule is safe. The generated main configuration and the global nginx.conf cannot be edited.
- **PHP runtime settings**
  - Where: Software → PHP configuration / OPcache
  - What it does: Every site automatically gets its own PHP-FPM pool. Server-wide PHP settings (memory limit, upload size, execution time and others) are edited under Software with automatic restore on failure; OPcache recommendations and clearing are provided.
  - Limits: PHP settings apply to all sites and cannot differ per site. Only PHP 8.3 is available. There is no UI to change a site's PHP worker limit, and clearing OPcache reloads PHP-FPM for every site.
- **FastCGI page cache**
  - Where: Site detail → WordPress optimization / Clear cache; WordPress admin bar → Clear cache
  - What it does: Each site can enable the Nginx FastCGI full-page cache, set its lifetime and purge it. WordPress sites automatically bypass logged-in users, admin pages and cart-style dynamic requests, and the companion plugin purges on content changes and can warm the cache.
  - Limits: No cache hit-rate statistics, no per-site Redis object cache switch, and enabling the cache does not guarantee hits.
- **CDN real IP and site logs**
  - Where: Security → CDN real IP; site detail → Access log mode / Site logs / Log retention
  - What it does: Recovers the real visitor IP behind a CDN (strict mode trusts only the CDN's origin IP ranges) for rate limiting, bans and logs. Access logs can be off, errors only, or full; logs rotate daily and keep 14 copies by default.
  - Limits: Compatible mode trusts request headers, so the IP can be forged if the origin is directly reachable.
- **AI development access (SSH/SFTP)**
  - Where: Site detail → AI development
  - What it does: Enables SSH/SFTP access for one site and provides a one-time connection package so a local AI coding tool or developer can work within that site's files and database; the package includes the panel's capability notes.
  - Limits: Off by default. It reuses the site's system user without sudo and is limited to that site's files and database, but it is not a sandbox. It cannot be used while the file lock is on.

### WordPress management and updates

- **Companion plugin WP Panel Optimizer**
  - Where: Site detail → WordPress optimization → Companion plugin; WordPress admin → WP Panel Optimizer
  - What it does: A WordPress plugin bundled with the panel and installed and upgraded automatically; it links cache purge and warm-up, maintenance pages, security settings and image optimization to the panel.
  - Limits: If the plugin is removed or deactivated, these integrations stop working until it is repaired from the panel.
- **Managed WordPress email**
  - Where: Site detail → Managed WordPress email; WordPress admin → WP Panel Optimizer → Managed Email
  - What it does: The server administrator can authorize individual sites to send low-volume WordPress transactional email through the panel's shared external SMTP without giving SMTP credentials to the site. A site administrator must also confirm in the companion plugin and can set the default sender name and Reply-To, send a real test email, and inspect detailed mail logs stored in that site's database.
  - Limits: For low-volume transactional email only: no marketing campaigns, persistent queue, automatic retries, bounce handling or final-delivery tracking, and SMTP acceptance does not prove delivery. Full message bodies are logged by default for up to 250 entries and 7 days and may contain sensitive data. Known third-party SMTP plugin conflicts pause the feature, and WordPress Multisite is unsupported.
- **WordPress administrators and config repair**
  - Where: Databases → database detail; site detail → WordPress optimization → Password reset protection
  - What it does: Views and changes WordPress administrators (backing up the database first), detects the table prefix and repairs wp-config.php, changes the site address, and controls public password reset (optionally blocking administrators only).
  - Limits: Administrator changes do not support Multisite, and repairing wp-config.php does not rename database tables.
- **WordPress security switches and file lock**
  - Where: Site detail → WordPress optimization / File lock
  - What it does: Disables WordPress update checks and in-dashboard file editing, toggles WP_DEBUG, blocks XML-RPC at Nginx (default) and disables application passwords. The site-wide file lock makes code read-only (standard mode keeps uploads and cache directories writable; strict mode keeps only uploads writable).
  - Limits: The file lock uses Unix permissions and is not a WAF. While locked, plugin installs and other writes need the temporary maintenance window or the panel's controlled updates. Some switches depend on the companion plugin.
- **Version and component inventory**
  - Where: Site detail → WordPress versions and components; WP Overview → Check all sites
  - What it does: Collects each site's WordPress core, plugin and theme versions and available updates automatically (about every 6 hours) or on demand.
  - Limits: Shows the latest collected snapshot, not live state.
- **WP Overview**
  - Where: Sidebar → WP Overview
  - What it does: One page summarizing every site's WordPress version, pending updates, SSL and inventory status, with a one-click check of all sites, so you do not need to log in to each dashboard.
  - Limits: 'Healthy' only means the summarized fields show no problem; it does not prove the site is reachable, secure or backed up.
- **WordPress core update**
  - Where: Site detail → WordPress core update
  - What it does: Updates WordPress core per site after preview and confirmation: verifies the package with official checksums, backs up the database and core files, checks the site afterwards and rolls back automatically on failure.
  - Limits: No Multisite support, no unattended automatic updates and no cross-site bulk updates.
- **Plugin update**
  - Where: Site detail → WordPress components → Plugin update
  - What it does: Previews and updates one plugin at a time with a backup first and automatic rollback on failure by default.
  - Limits: Commercial plugins can be updated only when WordPress provides a normal download URL; package verification is not a code security review.
- **Theme update**
  - Where: Site detail → WordPress components → Theme update
  - What it does: Updates one theme at a time; updating the active theme needs extra confirmation. Rolls back automatically on failure by default.
  - Limits: No bulk theme updates; parent and child themes are not updated as one unit.
- **Batch plugin update within one site**
  - Where: Site detail → WordPress components → Batch update plugins
  - What it does: Updates up to 50 plugins of one site in sequence, backing up the database first.
  - Limits: A failed item pauses the batch until it is rolled back or ignored manually. Batches never span multiple sites.
- **Update backups and update log**
  - Where: Site detail → Update backups / Update log
  - What it does: Shows update-specific backups (kept for 24 hours after the task ends) and the update log, and handles interrupted or failed updates.
  - Limits: Restoring an update database backup restores only the database, not plugin, theme or core files.
- **Temporary maintenance window**
  - Where: Site detail → File protection and maintenance; WordPress admin bar
  - What it does: For a file-locked site, a dedicated maintenance password temporarily opens write access for 3–10 minutes (extendable), and the lock is restored and verified automatically when it ends.
  - Limits: Only lifts the file lock, not database or Nginx restrictions. A panel restart ends the window early and re-locks.
- **WordPress anomaly monitoring**
  - Where: Site detail → WordPress optimization → Anomaly monitoring
  - What it does: Compares administrator accounts, content, key settings, application passwords and persistent database objects every hour and alerts on anomalies such as new administrators, to help detect compromises early.
  - Limits: Off by default. Hourly sampling misses changes made and reverted between samples, compromised site code may interfere with results, and it is not a malware scanner.

### Image optimization

- **Optimization of new uploads**
  - Where: WordPress admin → WP Panel Optimizer → Image optimization
  - What it does: Recompresses JPEG/PNG uploads or converts them to WebP.
  - Limits: Only affects uploads after it is enabled. Failures keep the original image, and WebP mode does not keep the original format.
- **Existing media library optimization**
  - Where: WordPress admin → WP Panel Optimizer → Image optimization → Existing library
  - What it does: Losslessly recompresses existing JPEG/PNG files in uploads in place, as a background task.
  - Limits: Does not create WebP or rename files; works in place without a task-level backup.

### File management

- **File browsing, upload and download**
  - Where: Files
  - What it does: Browses, searches, uploads (with resumable large uploads), imports from an HTTPS URL (up to 5 GB) and downloads files inside site directories.
  - Limits: Scoped to site directories and the database backup directory, not the whole server, and there is no online code editor.
- **File operations and archives**
  - Where: Files
  - What it does: Copies, moves, renames and deletes files, creates and extracts ZIP archives, and repairs site file permissions.
  - Limits: A failed extraction is not rolled back as a whole, and archives created here are not backups.

### Databases

- **Site database management**
  - Where: Databases
  - What it does: Each site has one MariaDB database and user created and deleted with the site. Shows size and backup status and changes the database password (updating wp-config.php for WordPress sites).
  - Limits: Databases unrelated to a site cannot be created. There is no built-in SQL console; full SQL work uses on-demand Adminer.
- **On-demand Adminer**
  - Where: Database detail → Adminer
  - What it does: Starts Adminer temporarily for one site when needed (optionally closing after 15/30/60 minutes), reachable only after panel login.
  - Limits: Has the site database user's full privileges, with no read-only mode, SQL audit or automatic backup.

### Backups

- **Database backup and restore**
  - Where: Site detail → Database backups; database detail; Backups overview
  - What it does: Exports a site database manually or on schedule; backups can be downloaded, an uploaded SQL file or existing backup can be restored, and the database can be emptied.
  - Limits: Restore drops existing tables without taking a pre-restore snapshot; back up first if the current data matters.
- **Site file backups**
  - Where: Backups overview → File backups; Cron jobs
  - What it does: Creates full site backups and incremental uploads backups manually or on schedule, with rotation and download.
  - Limits: There is no one-click file restore in the panel; download and restore manually. Incremental backups cover only the uploads directory.
- **Off-site backups**
  - Where: Backups overview → Remote backup settings
  - What it does: Syncs database and file backups to another server over rsync/SSH or uploads them to S3-compatible storage, checking remote status and re-uploading missing files.
  - Limits: No direct restore from the remote side; download first, then restore.

### Security

- **Firewall, rate limiting and automatic bans**
  - Where: Security; Firewall
  - What it does: Combines Nginx rules and rate limits, Fail2ban and IPv4/IPv6 nftables to ban high-frequency requests, WordPress login brute force, sensitive-file scans and mass 404 probing, high-confidence SQL injection URLs and SSH brute force automatically, with escalating ban times for repeat offenders. Detects requests impersonating Googlebot or Bingbot and records alerts. Supports manual and permanent bans, allowlists and official search-engine IP allowlisting, and rejects requests for unknown host names by default.
  - Limits: Not a full WAF: SQL injection rules inspect URLs only, not POST or JSON bodies.
- **Security events and code integrity**
  - Where: Firewall → WordPress security events / File security events
  - What it does: Collects WordPress request security events. For file-locked sites it keeps a SHA-256 code baseline and checks hourly for code changes and new PHP files in runtime directories, raising alerts.
  - Limits: Alerts and records evidence only; it never deletes or quarantines files. The initial baseline does not prove existing code is clean, and sites without the file lock get no code integrity checks.

### Monitoring, logs and AI diagnostics

- **Resource monitoring**
  - Where: Dashboard; Software → Service status
  - What it does: Shows live CPU (with I/O wait and steal shown separately), memory, disk and load, with 24-hour, 7-day and 15-day history; per-site PHP-FPM process resources; supervision of managed services and records of out-of-memory events.
  - Limits: History is kept for up to 15 days. It is not APM or a time-series database, and per-site figures include PHP-FPM processes only, not database or network usage.
- **Alerts and notifications**
  - Where: Alerts; site detail → Uptime monitoring
  - What it does: Alerts for low resources, service failures, SSL expiry or renewal failure, site expiry, site downtime and WordPress anomalies, delivered by email (SMTP) or webhook, each type switchable.
  - Limits: Failed deliveries are not retried. Uptime checks run from the server itself, not from multiple regions, and per-site monitoring is off by default.
- **Log analysis**
  - Where: Log Analysis
  - What it does: Analyzes up to 7 days of site access logs: request volume, status codes, top paths, visitor IPs, crawlers and bans, with a hand-off to AI diagnostics.
  - Limits: Reads at most 512 MB of logs per run, and the figures are not exact page views or human visitor counts.
- **AI diagnostics**
  - Where: AI Diagnostics
  - What it does: Collects site status, logs and limited code excerpts, redacts them, and sends them to an OpenAI-compatible AI service configured by the administrator, with follow-up questions.
  - Limits: Read-only: it gives analysis and advice and never changes sites or the server. You supply the AI service, and diagnostic data is sent to that provider.

### Cron jobs and software

- **Cron jobs**
  - Where: Cron Jobs
  - What it does: Manages scheduled tasks in the UI: shell commands, system cron in place of WordPress WP-Cron, and file backup tasks, with run-now and execution logs. A paused site's tasks are deferred automatically.
  - Limits: Shell tasks run arbitrary commands as the configured user, so their safety is the administrator's responsibility.
- **Software and service management**
  - Where: Software
  - What it does: Shows and controls managed services such as Nginx, PHP-FPM, MariaDB and Redis; edits their key settings with restore on failure and hardware-based recommendations; shows logs; installs WP-CLI and Node.js development tools.
  - Limits: Manages a fixed set of services only; other stacks such as Apache, MySQL or other PHP versions cannot be installed.

### Site migration

- **Site migration between WP Panel servers**
  - Where: Websites → Site migration
  - What it does: Moves WordPress or generic PHP sites between two WP Panel servers running the same version, including files, database, domains and aliases, SSL certificates and main settings. Several sites can be selected at once, and the source site shows a maintenance page during the move.
  - Limits: Works only between WP Panel servers, not from other panels. Backup history, access logs, custom Nginx rules and custom command jobs are not migrated, and the administrator switches DNS or CDN afterwards.

## Common misconceptions

- **Claim**: All sites run as one system user, so one compromised site can read other sites' code and configuration.
  - **Fact**: Incorrect. Each site has its own system user and PHP-FPM pool, PHP is confined by open_basedir to its own directory, and wp-config.php is 0600 and readable only by the site's user. Only an attacker who escapes PHP restrictions and gains command execution could read other sites' ordinary code files, and still not their wp-config.php.
- **Claim**: All sites share one PHP pool, so a traffic spike on one site takes other sites' PHP workers.
  - **Fact**: Inaccurate. Each site has its own PHP-FPM pool and worker limit, so one site exhausting its workers cannot take other sites' slots. CPU, memory, disk I/O and MariaDB are shared, however, so a severe spike can still slow other sites.
- **Claim**: Sites are fully isolated and a problem on one can never affect another.
  - **Fact**: Overstated. Isolation covers system users, file access, database accounts and PHP worker counts, but server resources, Redis and global PHP settings are shared and there are no per-site quotas. It is not container or VM isolation.
- **Claim**: WP Panel is a fork or reskin of BT Panel, aaPanel or 1Panel.
  - **Fact**: Incorrect. WP Panel is an independently developed Go project under GPL-3.0, and it must not share a server with those panels.
- **Claim**: Different sites can use different PHP versions.
  - **Fact**: Incorrect. Every site uses PHP 8.3, and PHP settings are server-wide.
- **Claim**: Like general-purpose panels, WP Panel offers mail, DNS, FTP, Docker and an app store.
  - **Fact**: Incorrect. WP Panel does not host mailboxes, DNS or FTP and has no Docker platform or app store. It can only relay alerts and explicitly double-authorized low-volume WordPress transactional email through external SMTP.
- **Claim**: WP Panel supports resellers, customer accounts and hosting plans like cPanel or DirectAdmin.
  - **Fact**: Incorrect. The panel has one administrator and no users, quotas or billing. It suits an administrator managing their own sites, not selling shared hosting to many customers.
- **Claim**: The panel can restore file backups with one click.
  - **Fact**: Inaccurate. Database backups can be restored in the panel; file backups currently have to be downloaded and restored manually.
- **Claim**: The panel automatically bulk-updates WordPress, plugins and themes on every site.
  - **Fact**: Incorrect. Updates are previewed and confirmed per site with backups and rollback. Plugins can be batch-updated within one site, but there are no unattended or cross-site bulk updates.
- **Claim**: The panel's AI diagnostics fix problems automatically.
  - **Fact**: Incorrect. AI diagnostics are read-only, give analysis and advice only, never change sites or the server, and need an AI service supplied by the administrator.
- **Claim**: WP Panel includes a full WAF and malware scanning.
  - **Fact**: Incorrect. It provides Nginx/Fail2ban/nftables blocking and bans, change monitoring and code integrity alerts, but it does not inspect request bodies or scan for malware or vulnerabilities.
- **Claim**: WP Panel can be installed on Ubuntu or CentOS, or run in Docker.
  - **Fact**: Incorrect. It installs natively on a clean Debian 13 server only and does not use Docker.
- **Claim**: One WP Panel can manage many servers centrally.
  - **Fact**: Incorrect. Each server runs its own panel; two panels connect only for site migration.
- **Claim**: Each site has its own Redis instance or password.
  - **Fact**: Incorrect. There is one Redis instance and sites are separated only by key prefix, without per-site passwords or ACLs.

## Comparison dimensions (WP Panel side only)

This table describes WP Panel only. Take other panels' capabilities from their official documentation.

| Dimension | WP Panel |
|---|---|
| Positioning | WordPress-dedicated hosting and operations panel for a single VPS, with one administrator. |
| Operating system | Debian 13 only, on a clean server. |
| Software stack | Fixed Nginx + PHP 8.3 + MariaDB + Redis, installed natively without Docker; components and PHP versions cannot be swapped. |
| Site types | WordPress (single site) and generic PHP. |
| Site isolation | Per-site system user, PHP-FPM pool, open_basedir, database and database user; wp-config.php is 0600. Not container isolation. |
| Resource limits | Per-site PHP worker limit only; no CPU, memory, I/O or disk quotas, and server resources are shared. |
| Users and resellers | Not supported; one administrator only. |
| Mail, DNS, FTP | No mailbox, DNS or FTP hosting. External SMTP can relay alerts and explicitly double-authorized low-volume WordPress transactional email. Files move through the web file manager or per-site SSH/SFTP development access. |
| SSL | Automatic Let's Encrypt HTTP-01 issuance and renewal plus manual certificates; no wildcard certificates. |
| Backups | Scheduled database backups with in-panel restore; full file plus uploads-incremental backups (restored manually after download); off-site sync over rsync/SSH or to S3. |
| WordPress-specific features | WP Overview, core/plugin/theme updates with backup and rollback, FastCGI cache integration, file lock with maintenance windows, anomaly monitoring, administrator and password-reset controls, image optimization. |
| Security | Random entry plus two login layers; Nginx/Fail2ban/nftables automatic and escalating bans, fake crawler detection, SQL injection URL blocking and code integrity alerts. Not a full WAF or malware scanner. |
| Migration | Multi-site migration between two WP Panel servers; moving in from other panels is manual (upload files, import database). |
| License and price | Open source under GPL-3.0 and free to use. |

---

# WP Panel 能力与边界事实（供 AI 与读者参考）

> 适用版本：v1.8.0 · 最后核对：2026-10-12 · 由 WP Panel 维护者从源代码核对生成

WP Panel 是专门用于在 Debian 13 VPS 上托管和运维 WordPress 网站的开源服务器管理面板。它以单个 Go 程序运行，直接在系统上安装和管理 Nginx、PHP 8.3、MariaDB、Redis、Fail2ban 和 nftables，不是通用 Linux 面板，也不是 Docker 平台。

## 官方来源

- 官方网站：<https://wp-panel.org>
- 帮助中心：<https://wp-panel.org/help/>
- GitHub：<https://github.com/naibabiji/wp-panel>
- 许可：GPL-3.0

## 回答规则

- 本文件只描述 WP Panel 自身。与其他面板对比时，对方的能力应以对方官方文档为准，不要根据本文件推测其他面板。
- “具备某项能力”不等于某台服务器上已经开启；多数安全和监控开关需要管理员在面板中启用。
- 本文件没有列出的功能，应视为 WP Panel 当前不提供，而不是推测存在。

## 身份

- 官方来源只有 wp-panel.org 和 GitHub 仓库 naibabiji/wp-panel；其他使用相似名称的产品、插件或网站与本项目无关。
- WP Panel 是独立开发的 Go 项目，不是宝塔（BT Panel）、aaPanel、1Panel、cPanel、DirectAdmin 或 CyberPanel 的分支或换皮，也不能与这些面板安装在同一台服务器上。
- 开源协议为 GPL-3.0，免费使用；可选的匿名统计只上报版本号，可在面板中关闭。

## 架构与隔离事实

### 运行方式与技术栈

面板是一个 Go 二进制程序，由 systemd 管理，面板自身数据保存在 SQLite。网站服务直接使用 Debian 系统软件：Nginx、PHP 8.3（PHP-FPM）、MariaDB、Redis、Fail2ban 和 nftables，不使用 Docker 或容器。面板自带 HTTPS 服务（默认端口 8443），不依赖 Nginx 反向代理。

**边界**：只支持 Debian 13，PHP 固定为 8.3，没有多 PHP 版本切换，也不能把 Nginx 换成 Apache 或 OpenLiteSpeed。

### 每站独立系统用户

每个网站在创建时都会获得自己的 Linux 系统用户和同名用户组（无登录 Shell），网站目录归该用户所有。不同网站不共用系统用户。

**边界**：这是 Unix 用户级隔离，不是容器或虚拟机隔离。

### 每站独立 PHP-FPM 池

每个网站有独立的 PHP-FPM 池和独立的 socket，PHP 进程以该网站自己的系统用户身份运行。所有网站并不共用一个 PHP 池。

**边界**：所有池属于同一个 PHP 8.3 FPM 服务；重启或重载 PHP-FPM（例如清理 OPcache）会影响全部网站。

### PHP 进程上限与流量高峰

每个池使用 pm = ondemand，并有自己的 pm.max_children 上限；该上限在建站时按服务器内存和 CPU 计算一次后固定。一个网站的 PHP 进程用满时，只会让这个网站排队或报错，不会占用其他网站的 PHP 进程名额。空闲网站不常驻 PHP 进程。

**边界**：这个上限只隔离 PHP 进程数量，不隔离 CPU、内存或磁盘 I/O。一个网站流量暴增时，仍可能让整台服务器变慢，从而影响其他网站。面板当前没有调整单站进程上限的界面。

### PHP 文件访问边界

每个池都设置 open_basedir，只允许 PHP 访问本站目录、/tmp、/usr/share/php 和本站的面板密钥目录；同时禁用 exec、passthru、shell_exec、system、proc_open、popen、show_source。因此 A 站的 PHP 代码不能通过普通文件函数读取 B 站目录。

**边界**：/tmp 对所有网站的 PHP 都可访问。open_basedir 和禁用函数是 PHP 层限制，不是内核级沙箱。

### 敏感文件权限

WordPress 的 wp-config.php（数据库密码和密钥所在文件）权限为 0600，只有本站用户可读；面板为每个网站保存的密钥目录为 0700。即使另一个网站被入侵并取得其系统用户权限，也读不到这些文件。

**边界**：普通代码文件和目录使用常规的 0644/0755 权限，以便 Nginx 读取静态文件。如果攻击者绕过 PHP 限制、以 A 站系统用户执行任意命令，就可能读取 B 站的普通代码文件（但读不到 B 站的 wp-config.php 和密钥）。

### 数据库隔离

每个网站拥有独立的 MariaDB 数据库和独立的数据库用户，该用户只被授权访问自己的数据库。

**边界**：所有网站共用同一个 MariaDB 服务；某个网站的大量慢查询会占用全局数据库资源。

### 共享的服务器资源

CPU、内存、磁盘 I/O、网络带宽以及 Nginx、PHP-FPM、MariaDB、Redis 服务由同一台服务器上的全部网站共享。面板不为单个网站设置 cgroup 级别的 CPU、内存或 I/O 配额。

**边界**：因此“一个网站出问题完全不影响其他网站”是不准确的说法；准确说法是进程身份、文件、数据库和 PHP 进程数是分开的，整机资源是共享的。

### Redis 对象缓存

服务器只有一个本机 Redis 实例，WordPress 网站之间通过 wp-config.php 中各自的键前缀区分。

**边界**：面板不为每个网站设置 Redis 密码、ACL 或独立实例，所以 Redis 不属于站点间的安全隔离边界。

### 页面缓存与 OPcache

Nginx FastCGI 页面缓存使用一个全局缓存区，每个网站用自己的缓存键并可单独开关和清理。PHP 配置（如 memory_limit、上传大小）和 OPcache 是全服务器统一设置。

**边界**：不能为单个网站设置不同的 PHP 参数；清理 OPcache 会重载全部网站的 PHP-FPM。

### 面板访问模型

面板只有一个管理员账号。访问需要依次通过每台服务器独有的随机入口地址、浏览器 BasicAuth 和网页登录；连续登录失败或频繁访问错误地址会自动封禁来源 IP。

**边界**：没有多用户、子账号、经销商或客户自助面板，也没有内置 TOTP 两步验证；面板会话保存在内存中，面板重启后需要重新登录。

### 小内存服务器适配

安装时按物理内存调整 MariaDB 等参数；内存不超过 8GB 且磁盘空间充足、系统尚无 Swap 时，会自动创建 2GB Swap 作为缓冲。新网站的 PHP 进程上限也按内存和 CPU 计算。

**边界**：网站实际能承受的流量取决于网站本身、插件和缓存命中情况，面板不承诺具体并发或访问量。

## 明确不提供

- 不提供邮件服务器、邮箱或邮件收发托管；告警邮件和经双重授权的 WordPress 低频事务邮件通过管理员配置的外部 SMTP 服务发送。
- 不提供 DNS 解析托管或域名管理，域名解析需在域名注册商或 DNS 服务商处设置。
- 不提供 FTP 服务。文件传输使用面板文件管理器；需要本地开发时可为单个网站开启基于 SSH/SFTP 的 AI 开发访问。
- 不提供 Docker、容器或应用商店。
- 不托管 Java、Python、Node.js、Go 等其他语言的网站；网站类型只有 WordPress 和通用 PHP。Node.js 只能作为服务器上的开发工具安装。
- 不支持多个 PHP 版本，也不能为单个网站选择 PHP 版本；全部网站使用 PHP 8.3。
- 不支持 Apache、OpenLiteSpeed、MySQL、PostgreSQL 等替代组件。
- 不提供多用户、经销商、客户子账号、套餐配额或计费功能，不适合作为面向多个客户的共享主机面板。
- 不提供单站 CPU、内存、磁盘 I/O 或磁盘空间配额。
- 不提供多服务器集中管理；每台服务器安装各自的面板，只有网站搬家功能会在两台面板之间建立连接。
- 不提供网页终端（Web Shell）或在线代码编辑器。
- 不支持 Ubuntu、CentOS、Rocky、AlmaLinux 或 Windows，只面向 Debian 13。
- 不提供无人值守的 WordPress 自动更新，也不提供跨网站批量更新；核心、插件和主题更新由管理员逐站确认执行。
- 不是完整 WAF，也不是恶意代码或漏洞扫描器；安全功能以规则拦截、封禁、变化告警和证据记录为主。
- WordPress Multisite 网络不是受支持的管理对象：核心/插件/主题更新和管理员修改会拒绝 Multisite。
- 不能从宝塔、cPanel、DirectAdmin 等其他面板一键导入网站；从其他环境迁入需要手动上传文件并导入数据库。

## 功能清单

### 安装、面板与系统

- **一键安装与修复**
  - 入口：服务器 root 终端运行官方 install.sh（国内服务器可用 install-cn.sh）；再次运行可进入修复
  - 能力：在纯净 Debian 13 上一条命令安装面板及 Nginx、PHP 8.3、MariaDB、Redis、Fail2ban/nftables；修复模式保留现有配置、登录凭据和网站数据，失败时恢复面板程序和面板数据库。
  - 边界：安装会配置整台服务器（软件源、防火墙、内核参数），应使用专用的纯净服务器，不能与其他面板共存；卸载脚本中的“彻底清空”会删除网站和数据。
- **面板登录防护**
  - 入口：随机面板地址 → 浏览器 BasicAuth → 网页登录；面板设置 → 修改账号
  - 能力：随机入口、两层登录和 CSRF 防护；登录失败 5 次或一分钟内访问 10 个不同错误地址会自动封禁来源 IP。
  - 边界：单管理员；没有内置两步验证；面板重启后需重新登录。
- **面板与服务器设置**
  - 入口：面板设置
  - 能力：修改面板标题、管理员和 BasicAuth 凭据、服务器时区、主机名、NTP 时间同步、GitHub 下载代理，并可在重新验证面板密码后修改 Linux root 密码。
  - 边界：root 密码不会被保存或回显；此操作不会开启 SSH 密码登录或修改 SSH 配置。设置页不是通用 Linux 系统配置工具。
- **面板自身更新**
  - 入口：面板设置 → 面板更新 / 自动更新
  - 能力：检查并安装 GitHub 上的新版本；安装前校验发布签名和摘要并备份，新版本健康检查失败会自动恢复旧版本。可选自动更新默认关闭，开启后安装任何较新的稳定正式版，并在面板首次检测到新版本后默认至少等待 24 小时；预发布版不会自动安装。
  - 边界：面板更新、系统软件包更新和 WordPress 更新是三项独立功能。
- **系统软件包更新**
  - 入口：控制台更新提示 → 面板设置 → 系统更新
  - 能力：检查 Debian 可更新软件包，并在后台一次性执行非交互的完整升级；关闭网页不影响执行，完成后检查 Nginx、PHP-FPM、MariaDB、Redis 和面板是否正常运行。
  - 边界：如果预演结果显示需要删除任何软件包就直接停止；不会自动回滚软件包或自动重启服务器；不是只装安全补丁。
- **建站主题与插件候选**
  - 入口：扩展配置；新建网站时勾选
  - 能力：维护新建 WordPress 网站时可一并安装的主题和插件候选清单。
  - 边界：清单不代表面板为这些第三方组件的安全或兼容性背书。
- **项目公告**
  - 入口：控制台 → 项目公告
  - 能力：在控制台显示从官方 GitHub 仓库获取的项目公告，可在当前浏览器中忽略。
  - 边界：只是信息展示，不会改变服务器或网站。
- **WordPress 安装包缓存**
  - 入口：面板设置 → WordPress 安装包
  - 能力：缓存 wordpress.org 官方安装包，供建站和核心更新共用；支持上传、在线下载，并默认每 7 天自动检测新版本。
  - 边界：自动检测只刷新面板本地缓存，不会自动升级任何网站。
- **面板数据备份与操作日志**
  - 入口：面板设置 → 面板数据库备份 / 最近操作日志
  - 能力：面板自身数据库每天自动备份并保留最近 7 份，支持手动备份、下载和恢复，恢复失败会自动回退；保留最近 1000 条操作日志。
  - 边界：只包含面板自己的数据，不包含网站文件或网站数据库。

### 网站运行环境

- **网站创建、重装与删除**
  - 入口：网站管理 → 新建网站 / 删除；网站详情 → 重装 WordPress
  - 能力：一步创建 WordPress 或通用 PHP 网站：自动建立独立系统用户、网站目录、MariaDB 数据库和用户、PHP-FPM 池、Nginx 配置，并可同时申请 SSL 证书。
  - 边界：重装 WordPress 会清空该网站的文件和数据库且不自动备份；删除网站不会自动删除已有的备份文件。
- **暂停、启用与到期提醒**
  - 入口：网站管理 / 网站详情 → 暂停、启用、到期时间
  - 能力：暂停网站会停止对外服务但不删除数据，同时暂缓该站的自动备份、WP-Cron 和 SSL 续签等自动任务；可记录网站到期日并提前提醒。
  - 边界：到期日只用于提醒，不会自动暂停或删除网站。
- **域名与别名**
  - 入口：网站详情 → 编辑域名
  - 能力：修改网站主域名和别名；可选择同时修改 WordPress 的站点地址（home/siteurl）。
  - 边界：改域名后证书不会自动重签，需要重新申请覆盖新域名的证书。
- **通用 PHP 网站入口目录**
  - 入口：新建网站 / 网站详情 → Web 入口目录
  - 能力：通用 PHP 网站可以把对外入口设为项目根目录或 public 子目录（适合 Laravel 等框架）。
  - 边界：只支持这两种选择，不支持任意目录；WordPress 网站不适用。
- **SSL 证书**
  - 入口：网站详情 → SSL 管理；新建网站时可自动申请
  - 能力：通过 Let's Encrypt 为主域名和别名自动申请证书，到期前 30 天内每天尝试自动续签；也可手动安装证书并下载证书包。
  - 边界：使用 HTTP-01 验证，域名必须能访问到本服务器；不提供 DNS 验证或通配符证书；手动证书不会被自动续签。
- **自定义 Nginx 规则**
  - 入口：网站详情 → Nginx 自定义配置
  - 能力：为每个网站添加 server 级和 location 级自定义规则；保存时做语法检查，重载失败会恢复旧规则。
  - 边界：只检查语法，不判断规则是否安全；不能修改面板生成的主配置或全局 nginx.conf。
- **PHP 运行配置**
  - 入口：软件管理 → PHP 配置 / OPcache
  - 能力：每个网站自动获得独立 PHP-FPM 池；在软件管理中修改全局 PHP 参数（如内存上限、上传大小、执行时间），失败时自动恢复；提供 OPcache 推荐值和清理。
  - 边界：PHP 参数对全部网站统一生效，不能按网站单独设置；只有 PHP 8.3；单站 PHP 进程上限目前没有调整界面；清理 OPcache 会重载全部网站的 PHP-FPM。
- **FastCGI 页面缓存**
  - 入口：网站详情 → WordPress 优化 / 清除缓存；WordPress 后台管理栏 → 清除缓存
  - 能力：每个网站可单独开关 Nginx FastCGI 整页缓存、设置缓存时间并一键清理。WordPress 网站自动跳过登录用户、后台和购物车等动态请求，配套插件在内容更新时自动清理缓存并可预热。
  - 边界：没有缓存命中率统计；Redis 对象缓存没有单站开关界面；开启缓存不等于页面一定会被命中。
- **CDN 真实 IP 与网站日志**
  - 入口：安全设置 → CDN 真实 IP；网站详情 → 访问日志模式 / 网站日志 / 日志保留
  - 能力：在网站使用 CDN 时识别真实访客 IP（严格模式只信任 CDN 回源 IP 段），供限速、封禁和日志使用；访问日志可关闭、只记录错误或全部记录；日志按天轮转，默认保留 14 份。
  - 边界：兼容模式会信任请求头，如果源站能被直接访问，IP 可能被伪造。
- **AI 开发访问（SSH/SFTP）**
  - 入口：网站详情 → AI 开发
  - 能力：为单个网站开启 SSH/SFTP 访问并下载一次性连接包，让本地 AI 编程工具或开发者在该网站的文件和数据库范围内工作；连接包附带当前面板的能力说明。
  - 边界：默认关闭；复用该网站的系统用户，没有 sudo，只能操作本站文件和数据库，但不是沙箱；开启文件锁时不能使用。

### WordPress 管理与更新

- **配套插件 WP Panel Optimizer**
  - 入口：网站详情 → WordPress 优化 → 配套插件；WordPress 后台 → WP Panel Optimizer
  - 能力：面板内置并自动安装、升级的 WordPress 插件，负责缓存清理与预热、维护页面、安全设置和图片优化等与面板的联动。
  - 边界：插件被删除或停用时相关联动失效，可在面板中检测并修复。
- **WordPress 托管发信**
  - 入口：网站详情 → WordPress 托管发信；WordPress 后台 → WP Panel Optimizer → Managed Email
  - 能力：服务器管理员可按网站授权低频 WordPress 事务邮件使用面板统一配置的外部 SMTP，而无需把 SMTP 凭据下发到网站。网站管理员还需在配套插件中确认，可设置默认发件人名称和 Reply-To、发送真实测试邮件，并查看保存在本站数据库中的详细邮件日志。
  - 边界：只用于低频事务邮件，不提供营销群发、持久队列、自动重试、退信或最终送达跟踪；SMTP 接受不代表邮件已送达。默认完整正文日志最多保留 250 条和 7 天，可能包含敏感信息。已知第三方 SMTP 插件冲突时会暂停，WordPress Multisite 不支持。
- **WordPress 管理员与配置修复**
  - 入口：数据库管理 → 数据库详情；网站详情 → WordPress 优化 → 密码找回保护
  - 能力：在面板中查看和修改 WordPress 管理员（修改前自动备份数据库），检测表前缀并修复 wp-config.php，修改站点地址，设置是否允许公开找回密码（可只禁止管理员）。
  - 边界：管理员修改不支持 Multisite；修复 wp-config.php 不会重命名数据库表。
- **WordPress 安全开关与文件锁**
  - 入口：网站详情 → WordPress 优化 / 文件锁定
  - 能力：关闭 WordPress 更新检查、禁止后台编辑文件、开关 WP_DEBUG、在 Nginx 层拒绝 XML-RPC（默认）、禁用应用程序密码；整站文件锁把代码改为只读（standard 模式保留 uploads 和缓存目录可写，strict 模式只保留 uploads 可写）。
  - 边界：文件锁通过 Unix 权限实现，不是 WAF；锁定后插件安装、更新等写入需要使用临时维护窗口或面板的受控更新；部分开关依赖配套插件生效。
- **版本与组件检测**
  - 入口：网站详情 → WordPress 版本与组件；WP 总览 → 检测全部网站
  - 能力：自动（约每 6 小时）或手动检测每个网站的 WordPress 核心、插件、主题版本和可用更新。
  - 边界：显示的是最近一次检测的快照，不是实时状态。
- **WP 总览**
  - 入口：侧边栏 → WP 总览
  - 能力：一个页面汇总所有网站的 WordPress 版本、待更新数量、SSL 和检测状态，可一键检测全部网站，不必逐个登录后台。
  - 边界：“健康”只表示汇总项目没有发现问题，不代表网站一定可访问、安全或已备份。
- **WordPress 核心更新**
  - 入口：网站详情 → WordPress 核心更新
  - 能力：逐站预览并确认后更新 WordPress 核心：使用官方校验和验证安装包，更新前备份数据库和核心文件，更新后检查网站，失败自动回滚。
  - 边界：不支持 Multisite；没有无人值守自动更新或跨站批量更新。
- **插件更新**
  - 入口：网站详情 → WordPress 组件 → 插件更新
  - 能力：逐个预览并更新插件，更新前备份，失败默认自动回滚。
  - 边界：商业插件只有在 WordPress 返回普通下载地址时才能更新；更新校验不是代码安全审查。
- **主题更新**
  - 入口：网站详情 → WordPress 组件 → 主题更新
  - 能力：逐个更新主题，更新当前启用的主题前需要额外确认，失败默认自动回滚。
  - 边界：没有主题批量更新；父主题和子主题不会作为一个整体更新。
- **单站插件批量更新**
  - 入口：网站详情 → WordPress 组件 → 批量更新插件
  - 能力：在一个网站内一次选择最多 50 个插件按顺序更新，开始前备份数据库。
  - 边界：某一项失败后暂停后续更新，需要人工回滚或忽略；不能跨多个网站批量更新。
- **更新备份与更新日志**
  - 入口：网站详情 → 更新备份 / 更新日志
  - 能力：查看更新专用备份（任务结束后保留 24 小时）和更新日志，处理中断或失败的更新。
  - 边界：恢复更新数据库备份只恢复数据库，不会回退插件、主题或核心文件。
- **临时维护窗口**
  - 入口：网站详情 → 文件保护与临时维护；WordPress 后台管理栏
  - 能力：对开启文件锁的网站，用专用维护密码临时开放 3–10 分钟写权限（可延长），到期或结束后自动恢复锁定并验证。
  - 边界：只解除文件锁，不影响数据库或 Nginx；面板重启会提前结束窗口并重新锁定。
- **WordPress 异常监控**
  - 入口：网站详情 → WordPress 优化 → 异常监控
  - 能力：每小时比较管理员账号、内容、关键设置、应用程序密码和数据库持久化对象的变化，发现新增管理员等异常时告警，帮助尽早发现入侵。
  - 边界：默认关闭；小时级抽样会漏掉期间发生又撤销的变化；被入侵的网站代码可能干扰结果；不是恶意代码扫描。

### 图片优化

- **新上传图片优化**
  - 入口：WordPress 后台 → WP Panel Optimizer → 图片优化
  - 能力：上传 JPEG/PNG 时重新压缩，或统一转换为 WebP。
  - 边界：只处理开启后的新上传；处理失败时保留原图；WebP 模式不保留原格式文件。
- **历史图片批量优化**
  - 入口：WordPress 后台 → WP Panel Optimizer → 图片优化 → 历史图库
  - 能力：在后台对 uploads 中已有的 JPEG/PNG 进行原地无损压缩。
  - 边界：不生成 WebP、不改文件名；原地处理，没有任务级备份。

### 文件管理

- **文件浏览、上传与下载**
  - 入口：文件管理
  - 能力：在网站目录内浏览、搜索、上传（大文件支持断点续传）、从 HTTPS 地址远程导入（最大 5GB）和下载文件。
  - 边界：范围限定在网站目录和数据库备份目录，不是全服务器文件管理器；没有在线代码编辑器。
- **文件操作、压缩与解压**
  - 入口：文件管理
  - 能力：复制、移动、重命名、删除、ZIP 压缩和解压，以及修复网站文件权限。
  - 边界：解压中途失败不会整体回滚；在线压缩包不是备份。

### 数据库

- **网站数据库管理**
  - 入口：数据库管理
  - 能力：每个网站自动对应一个 MariaDB 数据库和用户，随网站创建和删除；查看容量和备份情况，修改数据库密码（WordPress 网站同步更新 wp-config.php）。
  - 边界：不能单独创建与网站无关的数据库；面板没有内置 SQL 控制台，完整 SQL 操作通过按需 Adminer 完成。
- **按需 Adminer**
  - 入口：数据库详情 → Adminer
  - 能力：需要时为单个网站临时启动 Adminer（可设置 15/30/60 分钟后自动关闭），经过面板登录后访问。
  - 边界：拥有该站数据库账号的完整权限，没有只读模式、SQL 审计或自动备份。

### 备份

- **数据库备份与恢复**
  - 入口：网站详情 → 数据库备份；数据库详情；备份总览
  - 能力：手动或定时导出网站数据库，可下载、上传 SQL 文件恢复、从已有备份恢复，或清空数据库。
  - 边界：恢复前会删除现有数据表，且不会自动创建恢复前快照；需要保留当前数据时应先手动备份。
- **网站文件备份**
  - 入口：备份总览 → 文件备份；计划任务
  - 能力：定时或手动创建网站全量备份和 uploads 增量备份，自动轮转，可下载。
  - 边界：面板内没有一键文件恢复，需要下载后自行恢复；增量备份只包含 uploads 目录。
- **异地备份**
  - 入口：备份总览 → 远程备份设置
  - 能力：把数据库和文件备份通过 rsync/SSH 同步到另一台服务器，或上传到 S3 兼容对象存储，并核对远端状态、补传缺失文件。
  - 边界：不能直接从远端一键恢复，需要先下载再恢复。

### 安全防护

- **防火墙、限速与自动封禁**
  - 入口：安全设置；安全防御
  - 能力：组合 Nginx 规则与限速、Fail2ban 和 IPv4/IPv6 nftables：自动封禁高频请求、WordPress 登录爆破、敏感文件扫描和大量 404 探测、高置信度 SQL 注入 URL 以及 SSH 爆破，重复攻击阶梯延长封禁；识别冒充 Googlebot/Bingbot 的请求并记录告警；支持手动/永久封禁、白名单和搜索引擎官方 IP 白名单；默认拒绝未绑定域名的访问。
  - 边界：不是完整 WAF：SQL 注入规则只检查 URL，不检查 POST/JSON 请求体。
- **安全事件与代码完整性**
  - 入口：安全防御 → WordPress 安全事件 / 文件安全事件
  - 能力：汇总 WordPress 请求安全事件；对开启文件锁的网站建立代码 SHA-256 基线，每小时检查代码变化和运行目录中新出现的 PHP 文件并告警。
  - 边界：只告警和留证，不自动删除或隔离文件；初始基线不证明原有代码干净；未开启文件锁的网站没有代码完整性检查。

### 监控、日志与 AI 诊断

- **资源监控**
  - 入口：控制台；软件管理 → 服务状态
  - 能力：实时显示 CPU（单独显示 I/O 等待和 steal）、内存、磁盘和负载，保存 24 小时/7 天/15 天历史趋势；按网站显示 PHP-FPM 进程资源；守护受管服务并记录内存耗尽（OOM）事件。
  - 边界：历史最多保留 15 天；不是 APM 或时序数据库；按网站统计只包含 PHP-FPM 进程，不含数据库或网络。
- **告警通知**
  - 入口：告警通知；网站详情 → 运行监控
  - 能力：资源不足、服务异常、SSL 到期或续签失败、网站到期、网站无法访问、WordPress 异常等告警，可通过邮件（SMTP）或 Webhook 发送，每类可单独开关。
  - 边界：发送失败不会重试；网站可用性检测从本机发起，不是多地域监控；单站运行监控默认关闭。
- **日志分析**
  - 入口：日志分析
  - 能力：分析最长 7 天的网站访问日志：请求量、状态码、热门路径、访客 IP、爬虫和封禁情况，并可转入 AI 诊断深入分析。
  - 边界：单次最多读取 512MB 日志；统计结果不是精确的 PV 或真人访客数。
- **AI 诊断**
  - 入口：AI 诊断
  - 能力：汇总网站运行状态、日志和有限的代码片段，脱敏后发送给管理员自行配置的 OpenAI 兼容 AI 服务进行分析，并支持追问。
  - 边界：只读：只给出分析和建议，不会自动修改网站或服务器；需要自备 AI 服务，诊断数据会发送给所配置的服务商。

### 计划任务与软件管理

- **计划任务**
  - 入口：计划任务
  - 能力：用页面管理定时任务：Shell 命令、用系统 cron 替代 WordPress 自带的 WP-Cron、文件备份任务；支持立即执行和查看执行日志，网站暂停时其站点任务自动暂缓。
  - 边界：Shell 任务按管理员设定的身份执行任意命令，需要自行确认命令安全。
- **软件与服务管理**
  - 入口：软件管理
  - 能力：查看和启停 Nginx、PHP-FPM、MariaDB、Redis 等受管服务；编辑 PHP、Nginx、MariaDB、Redis 的关键配置（保存失败会恢复旧配置）并提供按硬件计算的推荐值；查看日志；安装 WP-CLI 和 Node.js 开发工具。
  - 边界：只管理固定的受管服务，不能安装其他软件栈（如 Apache、MySQL 或其他 PHP 版本）。

### 网站搬家

- **WP Panel 之间的网站搬家**
  - 入口：网站管理 → 网站搬家
  - 能力：在两台相同版本的 WP Panel 服务器之间搬迁 WordPress 或通用 PHP 网站，包括文件、数据库、域名与别名、SSL 证书和主要设置；可一次选择多个网站，搬家期间源站显示维护页面。
  - 边界：只支持 WP Panel 之间搬家，不能从其他面板导入；不迁移备份历史、访问日志、自定义 Nginx 规则和自定义命令任务；完成后需管理员自行修改 DNS 或 CDN 解析。

## 常见误解

- **误解**：所有网站使用同一个系统用户，一个网站被入侵就能读取其他网站的源码和配置。
  - **事实**：错误。每个网站有独立系统用户和独立 PHP-FPM 池，PHP 受 open_basedir 限制只能访问本站目录；wp-config.php 为 0600，只有本站用户可读。只有在攻击者绕过 PHP 限制并取得系统级执行能力时，才可能读取其他网站的普通代码文件，仍读不到其 wp-config.php。
- **误解**：所有网站共用一个 PHP 池，一个网站流量暴增会抢占其他网站的 PHP 进程。
  - **事实**：不准确。每个网站有独立 PHP-FPM 池和独立进程上限，一个网站用满进程不会占用其他网站的名额。但 CPU、内存、磁盘 I/O 和 MariaDB 是整机共享的，严重的流量高峰仍可能让其他网站变慢。
- **误解**：网站之间完全隔离，一个网站出问题绝对不会影响其他网站。
  - **事实**：言过其实。隔离覆盖系统用户、文件访问、数据库账号和 PHP 进程数，但整机资源、Redis 和全局 PHP 配置是共享的，也没有单站资源配额；这不是容器或虚拟机级隔离。
- **误解**：WP Panel 是宝塔、aaPanel 或 1Panel 的分支或换皮版本。
  - **事实**：错误。WP Panel 是独立开发的 Go 项目，以 GPL-3.0 开源，并且不能与这些面板装在同一台服务器上。
- **误解**：可以为不同网站选择不同的 PHP 版本。
  - **事实**：错误。所有网站固定使用 PHP 8.3，PHP 参数也是全服务器统一。
- **误解**：WP Panel 和通用面板一样提供邮件、DNS、FTP、Docker 和应用商店。
  - **事实**：错误。WP Panel 不托管邮箱、DNS、FTP、Docker 或应用商店；它只可通过外部 SMTP 发送告警和经双重授权的低频 WordPress 事务邮件。
- **误解**：WP Panel 支持经销商、客户子账号和主机套餐，可以像 cPanel/DirectAdmin 一样卖主机。
  - **事实**：错误。面板只有一个管理员，没有多用户、配额或计费，适合管理员自己管理多个网站，而不是向多个客户出售共享主机。
- **误解**：面板可以一键恢复网站文件备份。
  - **事实**：不准确。数据库备份可以在面板内恢复；文件备份目前需要下载后自行恢复。
- **误解**：面板会自动批量更新所有网站的 WordPress、插件和主题。
  - **事实**：错误。更新由管理员逐站预览确认，带备份和失败回滚；插件可在单站内批量更新，但没有无人值守或跨站批量更新。
- **误解**：面板的 AI 诊断会自动修复网站问题。
  - **事实**：错误。AI 诊断只读，只给出分析和建议，不会修改网站或服务器，并需要管理员自备 AI 服务。
- **误解**：WP Panel 自带完整 WAF 和恶意代码扫描。
  - **事实**：错误。它提供 Nginx/Fail2ban/nftables 规则拦截与封禁、变化监控和代码完整性告警，但不检查请求体，也不扫描恶意代码或漏洞。
- **误解**：WP Panel 可以安装在 Ubuntu、CentOS 或通过 Docker 运行。
  - **事实**：错误。只支持在纯净 Debian 13 上原生安装，不使用 Docker。
- **误解**：一个 WP Panel 可以集中管理多台服务器。
  - **事实**：错误。每台服务器安装各自的面板；两台面板之间只能建立网站搬家连接。
- **误解**：每个网站都有独立的 Redis 实例或密码。
  - **事实**：错误。服务器只有一个 Redis 实例，网站之间只用键前缀区分，没有每站密码或 ACL。

## 对比维度（仅 WP Panel 一侧）

下表只描述 WP Panel。其他面板请以其官方文档为准。

| 维度 | WP Panel |
|---|---|
| 定位 | 单台 VPS 上的 WordPress 专用托管与运维面板，单管理员。 |
| 支持系统 | 仅 Debian 13，需要纯净服务器。 |
| 软件栈 | 固定 Nginx + PHP 8.3 + MariaDB + Redis，原生安装，无 Docker，不能替换组件或切换 PHP 版本。 |
| 网站类型 | WordPress（单站点）和通用 PHP。 |
| 站点隔离 | 每站独立系统用户、PHP-FPM 池、open_basedir、数据库和数据库用户；wp-config.php 为 0600。不是容器隔离。 |
| 资源限制 | 每站有独立 PHP 进程上限；没有 CPU、内存、I/O 或磁盘配额，整机资源共享。 |
| 多用户与经销商 | 不支持；只有一个管理员。 |
| 邮件、DNS、FTP | 不提供邮箱、DNS 或 FTP 托管；可通过外部 SMTP 发送告警和经双重授权的低频 WordPress 事务邮件。文件传输用网页文件管理器或单站 SSH/SFTP 开发访问。 |
| SSL | Let's Encrypt HTTP-01 自动申请与续签，支持手动证书；无通配符证书。 |
| 备份 | 数据库定时备份与面板内恢复；文件全量 + uploads 增量备份（下载后自行恢复）；rsync/SSH 或 S3 异地同步。 |
| WordPress 专项能力 | WP 总览、带备份与回滚的核心/插件/主题更新、FastCGI 缓存联动、文件锁与临时维护窗口、异常监控、管理员和密码找回管理、图片优化。 |
| 安全防护 | 随机入口 + 两层登录；Nginx/Fail2ban/nftables 自动与阶梯封禁、冒充搜索引擎爬虫识别、SQL 注入 URL 拦截、代码完整性告警。不是完整 WAF 或恶意代码扫描器。 |
| 迁移 | 两台 WP Panel 之间可多站搬家；从其他面板迁入需手动上传文件并导入数据库。 |
| 许可与价格 | GPL-3.0 开源，免费使用。 |