Roadmap

What we are building next, release by release.

A plan, not a promise. ArcPanel is built by a small team, and the order can change. Last reviewed .

Latest: 2.2.6 Changelog
Now

The next releases

Oldest first. Testing means the features are done and being tested; In development means work is still going on.

2.3.0

Testing

A new firewall, with IPv6.

  • Firewall on nftablesThe firewall moves from iptables and ipset to nftables, with rules and bans for IPv4 and IPv6.
  • More of the REST API v2Backup runs and the state of queued tasks can be read through REST API v2.
  • Restores with restic 0.16Restoring a snapshot backup works again on servers with restic 0.16.
Before you upgrade Custom rules in custom.sh that call iptables must move to custom.nft. A server that cannot load the new rules keeps iptables and says so.

2.4.0

Testing

Object storage next to your sites.

  • S3-compatible object storageBuckets and keys per account on the server itself, inside the limits of the package.
  • Backups to S3Send backups to any S3-compatible host.
Before you upgrade Servers that skip 2.3.0 get its firewall change too: custom rules in custom.sh that call iptables must move to custom.nft.

2.5.0

Testing

The Update Center.

  • Update policiesChoose per server whether patches, new releases or nothing installs on its own.
  • Updates pageSee what a new release changes before you install it.
  • RollbackGo back to the previous version when an update fails.
  • Updates through the APICheck and start updates through REST API v2.

2.6.0

In development

Security hardening across the panel.

  • Security headersA content security policy and other security headers on every page, and HSTS when you turn it on.
  • Recovery codes for two-factor sign-inSign in with a one-time recovery code when the authenticator is lost.
  • TLS-only mail and FTP sign-inRefuse passwords sent without encryption. On for new servers, a switch on upgraded ones.
  • Stricter checksTighter validation of what can be saved, and staging limits per account.
  • Upload from a URLFetch a file from a URL straight into the File Manager, or through REST API v2.
Before you upgrade Users with two-factor sign-in must create recovery codes: the old reset link is removed.
Next

Decided, after these releases

Backup destinations and schedules

Any number of destinations (SFTP, S3, B2, Google Drive, Dropbox, OneDrive, WebDAV), a schedule per job, encrypted archives and a page that shows every run. Planned for 2.7.

ionCube in the PHP Manager

Install the ionCube loader for a PHP version from the panel.

Key rotation for stored secrets

Rotate the keys that encrypt stored secrets, and limit secrets per package.

Later

The backlog

Not committed. About one wave per quarter, in this order; the order is reviewed every quarter.

  1. Wave 1

    • Job Center with live progress
    • Alerts by e-mail, Telegram and Slack
    • PHP settings per domain
    • Audit log of every change
    • Server and Site Doctor

  2. Wave 2

    • Git deploy with rollback
    • Web application firewall and bot protection
    • Mail deliverability center
    • Cloudflare DNS

  3. Wave 3

    • WordPress toolkit
    • Collaborators with scoped access

  4. Wave 4

    • Staging and clone
    • Signed webhooks
    • Log explorer with live traffic
    • Scheduled malware scans

  5. Wave 5

    • Migration from HestiaCP
    • Passkeys and single sign-on
    • AI assistant (experimental, opt-in)

Also designed: Functions: small handlers that scale to zero, on the same server.

Not on the roadmap

What we do not plan to build, and why.

  • Billing and WHMCS modulesOut of scope for the panel.
  • Kubernetes, Windows or a mobile appArcPanel runs one Linux server well.
  • New mail, DNS or database enginesThe proven engines stay.
  • Serverless at scaleFunctions run on the one server, inside the limits of the account.
  • Distributed object storageObject storage is one service on one server, like the rest of the panel.
  • SDKs in other languagesThe published OpenAPI document lets you generate a client in any language.
  • An MCP server for REST API v2The agent skills drive arc, which already gives profiles, dry runs and JSON output.

Need something sooner, or have an idea?

Tell us on GitHub. Requests with a clear use case move up the list.

Open an issue