Features

Three panels

HostFog gives each kind of user their own panel, each at its own address with its own sign-in, look and app icon:

Every sign-in page has Forgotten your password?: one email with a 6-digit one-time code and a reset link, which never reveals whether a login exists. A new password signs that login out everywhere else. Only the people a panel is for can sign in there. "Log in as" opens a customer's own Control Panel and "Return to admin" comes back. Emails send each person to their own panel. hf-admin portals shows, changes or switches them off; the classic address on port 8443 always works for everyone.

Customer panel

Admin panel

HostFog Webmail

https://webmail.yourdomain.com (also https://panel.yourdomain.com:8443/webmail/) — log in with the full email address and mailbox password, or click Webmail next to a mailbox in the panel (single sign-on).

• Inbox and folders with unread counts (refresh every minute), search (everything / from / to / subject / text), unread & flagged views, pages
• Read: safe HTML view (scripts, forms and frames removed; shown in a sandboxed frame with a strict content policy), pictures from the internet blocked until you allow them (per message, per sender, or always), attachments (open/download), view source, print
• Write: new, reply, reply all, forward (with the original attachments), Cc/Bcc, attachments up to 25 MB, drafts, signature, address book suggestions; sent mail is saved in Sent and the original is marked answered
• Organise: mark read/unread, flag, move, spam/not spam, delete to Trash, empty Trash/Junk, create/rename/delete folders and sub-folders
• Contacts: add/edit/delete, import vCard or CSV, export vCard, people you write to are added automatically
• Autoresponder (with dates) and filters (move, mark read, flag, forward a copy, delete) — the same rules the panel uses, so spam settings set in the panel are never lost
• Settings: name shown to recipients, signature, messages per page, picture policy, phone/computer settings

Security: the mailbox password is never stored in a readable form (encrypted in the session; the key only lives in the visitor's cookie), CSRF tokens on every action, login throttling, 2-hour idle logout, one-time single sign-on links valid for 2 minutes. Mailboxes can only send as their own address.

New in this release

• Spam guard: an account that suddenly sends far more email than usual is paused automatically, and you get an email
• Mail queue: see waiting mail, retry or delete it, or delete everything from one sender
• Read-only staff logins: see everything and answer tickets, but change nothing
• Download all your data: customers get one .zip of their files, databases and mail
• Domain expiry reminders 30 and 7 days before a domain's registration ends
• Weekly summary email for administrators every Monday
• Staff notes and tags on customer accounts, shown on their tickets
• Follow-up emails on day 3 and day 7 for new customers who haven't finished setting up
• Saved replies for support tickets, in the customer's language
• Control panel data backups every night, kept on the server and off it; put one back with hf-admin panel-restore
• Unpaid invoice reminders: reminders after 3 and 7 days, then the account is suspended and switched back on when it's paid
• File limit per package (inodes), with a warning at 90%
• Scheduled maintenance mode: the "back soon" page switches on and off by itself
• Mailbox nearly full: an email to the mailbox at 90%, with how to make room, before mail starts bouncing
• Daily spam summary: what went to Junk, with a "Not spam" link for each message
• Webmail two-factor login with an authenticator app and backup codes, plus an email when a mailbox is signed into from a new place
• Maintenance mode per website: a branded "back soon" page in one click, with a preview link for the customer
• Support PIN: a 6-digit code customers read out on the phone so support knows who they're talking to
• Business overview: charts of new accounts, cancellations and monthly revenue (admins and resellers)
• Webmail on the customer's own domain: webmail.theirdomain.com with its own free SSL certificate
• Passkeys: sign in with Face ID, a fingerprint, Windows Hello or a security key
• Dark mode, following the computer or chosen per person
• Public status page with 90-day history, incidents and planned maintenance (/status, /status.json)
• Restore one file by browsing a backup; restore as a copy so nothing is overwritten
• Errors explained: website errors in plain words, with what to do
• Image optimiser with automatic WebP
• Copy a website to another domain, database included
• 30-day server graphs: CPU, memory, disk and traffic
• Weekly backup restore test
• Discount codes and free trials for online orders
• Knowledge base (Help) with search, languages and ticket suggestions
• Referral programme with automatic credits
• Webmail filters and forwarding: forward all mail (with or without a copy), filters with several conditions (sender, recipient, subject, mailing list, size, attachments) and several actions, edit, copy and switch off filters
• Webmail dark mode switch (Auto / Light / Dark)
• Speed test: a score from 0 to 100 per website with tips that link to the fix (page cache, image optimiser, WebP, Redis, PHP version, HTTPS)
• Monthly report emailed to each customer: visitors, uptime, space, backups, SSL and speed — also viewable in the panel
• Webmail in 8 languages (English, Spanish, Portuguese, French, German, Turkish, Arabic right to left, Hindi), with a language picker
• Weekly speed test of every website, with an email when one gets slower
• Bulk actions for admins and resellers: suspend, unsuspend, change plan, send a message or delete many accounts at once
• Customer activity log: sign-ins and every change in the account, by the customer or by support, with CSV download
• Approval for resellers: an admin can make a reseller's deletes and whole restores wait for approval (for all resellers or one at a time)
• Two-step approval for risky staff actions (delete an account or reseller, restore a whole backup, switch off two-factor login): password again, or a second administrator approves

Also included

• Two-factor login (authenticator apps, backup codes; can be required for staff) and API tokens with a JSON API at /api/v1
• Hard CPU, memory and process limits per package (Packages → Enforce limits)
• Python apps (Flask, Django, FastAPI) and a sandboxed web terminal
• Stripe billing: public order page at /order, automatic accounts, suspension on non-payment, invoices, customer portal
• Own invoices: numbered PDF invoices with your company and VAT details, emailed automatically for Stripe payments, or made by hand for bank transfers
• More than one server: extra HostFog servers join the main panel with a join code (hf-admin node-enable <main IP>); accounts are placed on any server, DNS and billing stay on the main one
• Import accounts (Admin → Import accounts): upload a full account backup (.tar.gz or .tar.zst) from your old server, give a download link, or put the file in /home/hostfog-import. Websites, addon/sub/parked domains, databases, mailboxes with all messages and old passwords, forwarders, DNS records and cron jobs come across; customers keep their passwords
• Off-server backup copies (Backups): every nightly backup is also sent to any S3-compatible object storage, optionally encrypted. Customers can restore one file, one database or one mailbox instead of the whole account
• HostFog updates from the panel (HostFog updates): see what's new, update in one click, or let it update itself every night
• Website security (Malware & web firewall): ModSecurity with the OWASP rules in front of every website (per site on/off and allow rules) and a malware scanner (ClamAV plus PHP backdoor checks) that quarantines infected files; customers scan their own sites under Security scan
• Staging sites (Staging): copy a website and its database to staging.<domain>, test there, then push files, database or both back to live. A full backup is taken first; WordPress addresses are rewritten and staging is hidden from search engines

• AI helper (customers: AI helper; admin: AI helper): explains why a website is down, what an error log means, or how to fix .htaccess, in plain English with steps. It checks the site from the server and reads its recent errors; passwords and keys are removed first. You bring an Anthropic (Claude) or OpenAI-compatible API key and set a daily limit per account

• Billing-software module (integrations/): create, suspend, unsuspend, terminate, change password/package, single sign-on and usage stats from your billing software

• 9 languages for customers and staff (English, Spanish, Portuguese, French, German, Turkish, Arabic with right-to-left, Hindi), chosen per user
• Move accounts between servers (Move accounts): files, mail, databases, DNS, SSL, cron and limits, in one click; the customer gets an email when it's done
• White label (White label): your logo, colours and name everywhere, including webmail and emails; "HostFog" is never shown
• Wildcard SSL (SSL/TLS → Wildcard): one free Let's Encrypt certificate for *.domain, issued over DNS automatically; new subdomains get HTTPS straight away
• Import from another host (customers): copy a website over FTP/SFTP, a database over MySQL and mailboxes over IMAP from any provider
• Uptime monitor (customers): checks each website every 5 minutes (optionally for a word on the page), emails and phone alerts when it goes down and comes back, 24 h / 7 d / 30 d uptime and a response-time chart; admins see every customer site that is down
• Redis cache per account (Redis cache): a private Redis reachable only through a socket in the account's home, size set per package; one click connects WordPress (object cache)
• CDN connection (CDN): paste your CDN provider API token, then copy DNS to the CDN, switch its proxy on or off, purge the cache, use development mode. Mail records are never proxied; visitor IPs stay real in logs
• Email deliverability (customers: Deliverability; admin: Mail health): live SPF, DKIM, DMARC, MX and reverse-DNS checks with how to fix each, blocklist checks for the server IP, and hourly sending limits per account/package for mailboxes and PHP mail(), so one hacked site can't get the server blocklisted
• Customer email notifications: customers get an email (and a panel notification) for every change to their hosting — plan, suspension, changes made by support (one summary), new domains, free SSL, space nearly full, malware, sign-ins from a new place, password/email/two-factor changes — and choose which kinds under Password & security
• Emails in each customer's language (all 8 panel languages, Arabic right to left), with a one-time "Choose your password" link in welcome emails
• Welcome emails: a new customer gets one email with everything — panel sign-in, how to point their domain, webmail and mail-app settings, SFTP/FTP, databases, their plan, first steps and where to get help; new resellers get their own welcome with their Reseller Panel sign-in and first steps
• Getting started checklist on a new customer's or reseller's overview (password, two-factor login, domain + free SSL, website, first email address) that ticks itself off as they go
• Announcements (Announcements): admins and resellers email their customers about maintenance or news, also shown as a banner in the customer's panel
• Support tickets (Support): customers open tickets in their panel; the admin (or the reseller who owns the account) answers there; both get emails and phone notifications
• Docker apps (Docker apps): one-click n8n, Nextcloud, Uptime Kuma, Ghost, Vaultwarden and Gitea, each in a capped container on the customer's domain or subdomain. The admin enables Docker once; packages set how many apps
• Ruby apps (Rails, Sinatra, any Rack app) with Bundler and Puma, like the Node.js and Python apps
• Mailing lists (Mailing lists): announcement or discussion lists on the customer's own domain, with one-click unsubscribe, list headers and DMARC-safe sending
• DNSSEC (DNS zone editor → DNSSEC): signs a zone in one click and shows the DS record for the registrar. DNS cluster (DNS cluster): secondary nameservers copy every zone automatically (BIND catalog zones); any HostFog server becomes one in one click
• HostFog Tunnel (admin: Tunnels): your own tunnel service. A website running on someone's own computer — a local WordPress, an app in development, a client demo — gets a public https://<name>.tunnel.yourdomain.com link through your server, with no router settings or port forwarding. Each tunnel has its own key that opens only its own name; every tunnel gets its own HTTPS certificate; offline tunnels show a friendly page; set how many tunnels each account may have. Built on frp (open source, downloaded from its official releases and checksum-verified). With the HostFog Panel desktop app there's no command and no account at all: click Share on a site. The app gets free links from your server with its own private computer key (admin: Tunnels → HostFog Panel desktop app — on or off, links per computer, links in total, unused links removed after 60 days, and the endpoint address the app connects to; the app reads that endpoint from the panel each time it shares, GET /api/v1/desktop/endpoint). API: GET/POST /api/v1/tunnels, GET /api/v1/tunnels/{name}/client, DELETE /api/v1/tunnels/{name}; for the desktop app, the same under /api/v1/desktop/tunnels with an X-HF-Device computer key instead of a token. Needs one DNS record, *.tunnel.yourdomain.com, and port 7000 open
• Phone app: the panel installs on phones and computers as an app (Password & security → Phone app), with notifications for downtime and support replies