WHost beta distribution has started: the first groups are getting access

WHost, the hosting control panel from WISECP, has started reaching its beta users. Beta requests have been open for a while; what is new is that the distribution of WHost 1.0.0-beta.1, the first public beta released on 9 November, has begun, and the first groups have received their access, their license key and the installation steps. Access keeps opening in small groups, and WHost is free while in beta. This post covers what WHost does, how its security is built and tested, and how to get access.

What WHost is

WHost is a complete, modern hosting panel built from the ground up by the team behind WISECP. Everything a hosting server needs is managed from one admin panel and one client panel, and every action the panel takes is also available through its API.

Everything a hosting panel does

• Accounts and plans: create, suspend, unsuspend and remove hosting accounts; plans with disk, resource and feature limits; a client panel for your customers, and one-click sign-in to a customer's panel when you need to help.
• Domains and DNS: addon domains, subdomains and redirects, with DNS zones and records managed in the panel, including DNSSEC.
• SSL: free Let's Encrypt certificates issued and renewed automatically, bulk issuance, and your own certificates when you upload them.
• Email: mailboxes with DKIM signing, Rspamd spam filtering and webmail with one-click sign-in.
• Databases: MariaDB databases and users, with phpMyAdmin one click away.
• Files and FTP: a file manager with a built-in code editor, uploads, downloads and archives, plus FTP accounts locked to their own folder.
• Cron jobs and backups: scheduled tasks per account, and backups to local and remote storage (SFTP or S3) with schedules, retention and one-click restore.
• Web servers and PHP: WHost installs with Nginx or Nginx + Apache, and OpenLiteSpeed or LiteSpeed Enterprise can be switched on from the panel afterwards; PHP 7.4 to 8.5, chosen per domain, with its own settings.
• Security tools: the firewall, an under-attack mode, Fail2Ban and a web application firewall, all managed in the panel.
• API and webhooks: a documented REST API for everything the panel does, with signed requests, webhooks for events and a PHP SDK.
• Updates: signed panel updates installed from the Updates page, and operating system security updates installed on their own.

Security in layers

Hosting panels have been the target of serious, actively exploited vulnerabilities this year. A panel holds the keys to every site on its server, so WHost is built in layers that do not depend on each other: when one layer is bypassed, the next one still stands.

• Isolation between accounts: every hosting account runs as its own Linux user inside its own resource slice, with CPU, memory, process and disk I/O limits. Each site gets its own PHP-FPM pool, confined to the account's own files, with command execution functions disabled and temporary files and sessions kept inside the account. Shell access is a per-account switch, and accounts cannot open SSH tunnels.
• A panel that is not exposed: the WHost agent listens only on the server's internal address, behind nginx, which serves modern TLS with strict security headers. Admin sign-in supports two-factor authentication with backup codes and an IP allow list, every API request is signed and protected against replay, and API keys can be limited by scope and by IP. An API key cannot change an account's or the server's root password.
• Network and web protection: the firewall denies inbound traffic by default and will not let you lock yourself out. Fail2Ban watches SSH, mail, FTP, the panel sign-in and the websites themselves, and bans scanners and repeat offenders. ModSecurity with the OWASP Core Rule Set inspects web traffic, logging what it matches until you switch it to blocking, and WHost's own attack rules can ban the address behind a match.
• Mail and FTP: sign-in only over TLS, sending limits per account, DKIM signing and spam filtering; FTP users stay inside their own folder and connect over TLS.
• Secrets and audit: the admin password is stored only as a hash, API secrets are encrypted at rest, migration credentials live only in memory, and an append-only audit log records sign-ins, impersonation and destructive actions.
• Signed updates: every release is a signed package that is verified before it is installed, with a backup taken first and an automatic rollback if the update fails. The panel also checks its own files against a signed manifest every time it starts.

How it was tested

• A live penetration test against a production replica, by attack class: injection, XSS, SSRF, authentication, authorization, client-side attacks, cryptography, business logic and infrastructure. Every confirmed finding was fixed and measured again.
• A security verification programme covering hardening, authorization and identity between accounts, input validation, secrets, the supply chain, the protection layers, logging and detection, and clean installs and backups. Each control was checked to be in place, configured correctly and doing what it should under real requests, and checked again after every fix.
• Clean installs: every beta build is installed from scratch on fresh servers before it is published.
• Patching as it happens: when PHP published security fixes in October, our servers were measured and patched, and WHost's web rules learnt to recognise the related attack attempts.

Experimental in this beta

Node.js and Python applications, migration from cPanel and DirectAdmin over SSH, reseller accounts and white label work in our tests, but we have not yet tried every path on every supported system. Please treat them as experimental during the beta and tell us what you find. The known limitations page lists what this beta does not do yet.

Works with WISECP

The WHost server module ships with WISECP 5.0-beta.4. Connect your WHost servers once: paid orders open hosting accounts on the right server with the right package, overdue services are suspended and come back when the invoice is paid, and your customers sign in to their WHost panel with one click from the service page. The setup is described in the WHost article of the WISECP user guide.

How to get access

• Request access: open wisecp.com/whost, choose "Request Beta Access" and tell us what you want to test. Sign in with your wisecp.com account first, so that the request, and later the license, is tied to it.
• Wait for the approval email: access opens in small groups, and the approval email carries your license key and the installation steps.
• Install on a clean server running Ubuntu 22.04 or 24.04, AlmaLinux 9, Rocky Linux 9 or CentOS Stream 9, then enter your license key at the first sign-in.

With git installed, installation is a single command, run as root on a fresh server with a fully qualified host name. The installation guide lists the requirements and options:

cd /tmp && git clone https://wisecp.com/files/whost/whost.git && cd whost/installer && bash install.sh --hostname=srv1.example.com

Updates and feedback

A new installation follows the beta channel: when a beta release is published, the panel shows that an update is available and installs it from its Updates page. Please send what you find with a support ticket from your wisecp.com client area, or report it from the panel itself; every report helps us shape the releases that follow.

Not in the beta yet? Request access on wisecp.com/whost.

Release page: releases.wisecp.com/en/whost/1.0.0-beta.1