App catalog and WordPress

#App Installer

In the user panel, Software → App Installer shows the catalog and the account's installations. To install, pick the application, a domain and an optional subdirectory; depending on the app you are asked for a site name, language and admin details. Requirements are checked first: PHP version and extensions, database server, the package's database and application limits, memory and disk space. If anything blocking is missing, the install does not start.

#Applications in the catalog

Node.js and Python applications are installed as applications run by the panel's app manager and count toward the package's application limit; see Applications. For apps that let the first visitor create the admin account, the domain stays behind a panel-generated username and password until you click Setup finished, remove the lock.

#Package verification

Each application is defined by a recipe (a JSON file). Versions are resolved from official sources (GitHub, Packagist, npm, git or the vendor's URL), and a package is never used until it has been verified against a published checksum, a pinned checksum or a signature. Install steps run as the account user. Signature-verified packages (for example MediaWiki) need gnupg: on a native server these tools come with the "App catalog tools" component under Server Admin → Components.

#Updates, backups and cloning

The latest version of every installed application is checked every 6 hours, and the account owner is notified once per new release. From an installation's detail page you can run:

• Update: a file and database backup is taken first; if the update fails or the site returns a 5xx error, the backup is restored automatically.
• Backups: manual backups, restoring a chosen backup and deleting it. Backups do not count toward the disk quota; their total is capped at the package's disk limit (at least 1 GB, 10 GB for unlimited packages).
• Clone: copies the installation to another domain or directory in the same account, including a copy of the database, with addresses and paths rewritten in the configuration.
• Uninstall: deleting the files and deleting the database are separate choices.

Some recipes (such as Magento Open Source, PrestaShop and the starter projects) are not updated from the panel; update them the way the application itself expects.

#Automatic updates (Pro)

On Pro, each installation gets a policy of Off, Minor versions only or All versions, plus an optional maintenance window (days, start and end time in the server's local time). The updater runs every 15 minutes, starts at most two updates per round and tries each target version only once.

#Catalog settings

Server Admin → App Catalog lists the recipes and every account's installations, and holds these settings:

#WordPress Toolkit

Software → WordPress Toolkit finds the WordPress sites in the account's home directory (including ones not installed through the installer) and manages them with WP-CLI as the account user. All sites are rescanned every night. Server admins and resellers see every account's sites on the WordPress Sites screen. On a native server WP-CLI is a component; if it is missing, install it from Components.

• Core, plugin and theme updates; installing plugins and themes from WordPress.org, activating, deleting and toggling auto-updates
• Maintenance mode, debugging, search engine visibility, core auto-updates (off, minor, major)
• One-time admin login, user passwords, WP-Cron, search and replace, cache flush
• Restore points: taken before updates (kept 7 days), before search and replace (14 days) and manually (30 days)

#Security measures

Each measure is applied and reverted on its own: disable file editing in the dashboard, block PHP in the uploads directory, protect wp-config.php, disable XML-RPC, rotate the security keys, disable directory listing, hide the WordPress version, rename the "admin" user and change the table prefix. A restore point is taken before every measure, and if a measure breaks the site the change is rolled back automatically.

#Smart updates and bulk actions (Pro)

A smart update records the home page and any URLs you choose, takes a restore point, updates, then checks the same URLs again (HTTP status, fatal errors, empty pages, a visible-text difference threshold). If a check fails, the site is restored automatically. Pro also adds scheduled smart updates and bulk updates, maintenance mode, cache flushes and recommended security measures across many sites.

#Staging, cloning and caching

Before a push, a restore point of the live site is taken; if the home page check fails, the push can be rolled back automatically.

#Laravel Toolkit

Software → Laravel Toolkit detects the Laravel projects in the account, including App Installer installs and Git repositories:

• Allow-listed artisan commands (migrations, caches, optimize) and a free-form command box without shell expansion
• Queue workers: up to 8 processes per worker and 24 per account (or the package's process limit if lower). On a native server they run as systemd units in the account's resource slice; in a container they run under the panel's process manager.
• Scheduler: schedule:run every minute, added to Cron Jobs. On a native server it goes into the account's crontab; in a container the panel's scheduler runs it.
• A .env editor (with backups; comments and order are kept) and post-deploy steps for Composer and Git deployments

#Site Builder

Domains → Site Builder creates static sites without code. Templates: Coming soon, Digital business card, Landing page, Portfolio, Restaurant & café, Résumé / CV, Link in bio and Event. It offers live preview, image uploads, drafts and publishing, and the templates load nothing from outside (no CDN, no web fonts). On publish, existing content in the document root is moved to a timestamped backup that you can restore. The optional contact form sends mail through the server's local sendmail.

#Packages and editions

The App Installer, WordPress Toolkit, WordPress tools, staging, Laravel Toolkit and Site Builder are package features; choose which accounts get them under Server Admin → Packages (see Accounts and packages). Pro-only: automatic application updates, WordPress smart updates and bulk actions, and WordPress staging. The Community edition is limited to 3 hosting accounts; see Pricing to compare editions.