Unicorn Panel v1.0.14

Unicorn Panel 1.0.14 is here

This release lands a brand new Unicorn Shield suite, website cloning, richer analytics, and a lot of smaller polish across the panel.

Shield gets four new tabs

• Threats (beta). Watches outbound and inbound traffic across your whole fleet and drops connections to known-bad IPs at the firewall, with fleet-aware allow-listing so your own servers never block each other. Ships with four curated feeds enabled by default (Spamhaus DROP, Spamhaus DROPv6, Feodo IPBL, and ThreatFox from abuse.ch), plus three more you can turn on from the tab. Each feed has an on/off toggle and a Scope selector (Outbound, Inbound, or both). The tab also scans running processes for post-exploit shapes like reverse shells, download-execute pipelines, and cryptominer connections.
• File Integrity Monitor (beta). Watches your panel code, system binaries, and security configs across every server in your fleet. Changes to sensitive paths like sshd_config, sudoers, SUID bits, or anything under /usr/local/bin fire critical alerts. The default view groups events by file so you can see which servers show the same change and resolve them across the fleet in one click.
• WAF (beta). A live view of attack traffic hitting your sites. The scanner reads your proxy access and error logs, classifies common probes (SQL injection, XSS, path traversal, WordPress probing, log4shell, and more), and shows headline numbers, a world map of attacker countries, a stacked attack timeline, and the top offending IPs. Ban an attacker from the By IP table and the ban lands in a dedicated WAF jail with a 24 hour auto-expire.
• Vulnerabilities. See every pending package update across your fleet with CVE details and severity scores from the Alpine security database and OSV. Pick a single server or scan all at once. Switch between a per-server breakdown and a by-package grouping, filter by severity, search for a CVE id, and export as CSV.

Clone a website to a new domain

Create a Website now has a Clone tile alongside Static HTML, PHP, and WordPress. Pick a source site from a searchable card grid (each card shows the site's favicon), toggle what gets copied (files, URLs, paths, linked databases, cron jobs, SSH keys), and the panel builds the clone in the background. Progress streams live into the Create screen with a one-line status plus a View details log, and the whole process keeps running even if you close the tab. WordPress sites use WP-CLI search-replace so serialised data stays valid when the domain changes. Clones can target the source server (fastest) or any other server in your fleet.

Website analytics covers devices, operating systems, browsers, and bots

The Analytics tab on each website has four new cards. Device Type shows the mobile, desktop, and tablet split. Operating System and Browsers break down your real visitor traffic. Bots lists specific crawlers like Googlebot, Bingbot, ClaudeBot, OpenAI, Meta AI, Perplexity, Ahrefs, Jetpack, UptimeRobot, and more, with a matching Bot Categories card that groups them by purpose (Search engine, AI crawler, Monitoring, SEO tool, Advertising, Link preview). The Visitors line chart is also smoother now with a gently rounded curve.

Mail

• Per-mailbox spam thresholds. Open any mailbox, go to Spam settings then Defaults, and set your own Junk and Reject scores for that one mailbox. Useful for a mailbox that needs to be more strict (an executive address) or more lenient (a role mailbox that receives bulk).
• Mailbox menu reorganised. Change password, Set quota, and View DKIM key now live under a Settings submenu, and a new Spam settings submenu groups the whitelist with the new Defaults modal.
• Sparkline tooltip now shows the real hourly count instead of a ten-minute average. A mailbox that sent 18 messages in an hour reads 18 instead of 3.

Smaller touches

• Mark a site as staging. Toggle on Create Website and Manage Website that adds a noindex response header so search engines leave the site alone. A STAGING badge shows up on the website list and manage page.
• Re-detect server IP. New entry on the individual server page that fetches the current public IP, shows it to you to confirm, then updates the panel and pushes the change to any secondaries. Handy after a VPS snapshot restore or any provider-side IP change.
• Global search ranks closer matches first. Searching "unicorn" with a mix of unicornpanel.com and subdomains now surfaces the apex above the subdomains, and the per-category limit has been bumped from three to five.
• Filter the Servers list by role. Pick one or more roles (MariaDB, Hermes, NGINX, and so on) to show only the matching servers.
• Install script removes UFW before setting up the Unicorn firewall, so fresh installs no longer have UFW left over fighting with the nftables ruleset.