Roadmap

What we are building next, release by release.

A plan, not a promise. ArcPanel is built by a small team, and the order can change. Last reviewed .

Latest: 2.3.1 Changelog
Now

The next releases

Oldest first. Testing means the features are done and being tested; In development means work is still going on.

2.4.0

Testing

Object storage next to your sites.

  • S3-compatible object storageBuckets and keys per account on the server itself, inside the limits of the package.
  • Backups to S3Send backups to any S3-compatible host.
Before you upgrade Servers that skip 2.3.0 get its firewall change too: custom rules in custom.sh that call iptables must move to custom.nft.

2.5.0

Testing

The Update Center.

  • Update policiesChoose per server whether patches, new releases or nothing installs on its own.
  • Updates pageSee what a new release changes before you install it.
  • RollbackGo back to the previous version when an update fails.
  • Updates through the APICheck and start updates through REST API v2.

2.6.0

Testing

Backups with destinations, PHP settings per domain, an audit log and security hardening.

  • Backup destinations and schedulesBackup jobs with their own schedule and any number of destinations (SFTP, S3, B2, Google Drive, Dropbox, OneDrive, WebDAV), encrypted archives, a Backups page that shows every run, and a restore wizard.
  • PHP settings per domainChange the PHP limits of one domain from its page, within the maximums of the package.
  • Audit logEvery change made in the panel or through the API, with an export and a check that the log was not altered.
  • Security headersA content security policy and other security headers on every page, and HSTS when you turn it on.
  • Recovery codes for two-factor sign-inSign in with a one-time recovery code when the authenticator is lost.
  • TLS-only mail and FTP sign-inRefuse passwords sent without encryption. On for new servers, a switch on upgraded ones.
  • Stricter checksTighter validation of what can be saved, and staging limits per account.
  • Upload from a URLFetch a file from a URL straight into the File Manager, or through REST API v2.
Before you upgrade Users with two-factor sign-in must create recovery codes: the old reset link is removed. Backup hosts and the nightly backup become backup jobs with destinations; the upgrade converts them.

3.0.0

Planned

A major version: Git deploy, a Job Center, alerts and the Server and Site Doctor.

  • Deploy from GitPull a repository on a push to it, through a signed webhook from GitHub, GitLab or Gitea, with presets for Laravel and static sites.
  • Deploy from your CIGitHub Actions and GitLab CI upload a built release without a stored password.
  • Releases and rollbackEvery deploy is a release with shared folders and a health check, and you can roll back to an earlier one.
  • Job CenterEvery long operation is a job: one Jobs page with live logs, cancel and retry, and the same jobs through REST API v2.
  • AlertsFull disks, high load, stopped services, expiring certificates and failed backups sent to the panel, email, Telegram, Slack, Discord or Mattermost.
  • Server and Site DoctorRead-only checks of the server, its web domains and its mail domains, with a score, an explanation and a Fix button where a panel command can fix it.
Before you upgrade A major version: v-run-queue-task is removed (use the job commands), REST API v2 task ids become job:ID and a task that is gone answers 404 instead of 410, and the upgrade turns old task records into jobs, which an older package cannot undo. Check your scripts and API clients first; the REST API stays v2.
Next

Decided, after these releases

ionCube in the PHP Manager

Install the ionCube loader for a PHP version from the panel.

Key rotation for stored secrets

Rotate the keys that encrypt stored secrets, and limit secrets per package.

Later

The backlog

Not committed. About one wave per quarter, in this order; the order is reviewed every quarter.

  1. Wave 1

    • Web application firewall and bot protection
    • Mail deliverability center
    • Cloudflare DNS

  2. Wave 2

    • WordPress toolkit
    • Collaborators with scoped access

  3. Wave 3

    • Staging and clone
    • Signed webhooks
    • Log explorer with live traffic
    • Scheduled malware scans

  4. Wave 4

    • Migration from HestiaCP
    • Passkeys and single sign-on
    • AI assistant (experimental, opt-in)

Also designed: Functions: small handlers that scale to zero, on the same server.

Not on the roadmap

What we do not plan to build, and why.

  • Billing and WHMCS modulesOut of scope for the panel.
  • Kubernetes, Windows or a mobile appArcPanel runs one Linux server well.
  • New mail, DNS or database enginesThe proven engines stay.
  • Serverless at scaleFunctions run on the one server, inside the limits of the account.
  • Distributed object storageObject storage is one service on one server, like the rest of the panel.
  • SDKs in other languagesThe published OpenAPI document lets you generate a client in any language.
  • An MCP server for REST API v2The agent skills drive arc, which already gives profiles, dry runs and JSON output.

Need something sooner, or have an idea?

Tell us on GitHub. Requests with a clear use case move up the list.

Open an issue