Changelog

New download certificate endpoint, which returns the full chain of a site or tenant certificate.

Ubuntu 22.04 can no longer be picked for new servers, and creating a server now defaults to Ubuntu 26.04. Existing 22.04 servers keep running and stay manageable.

End of life database versions were retired from server creation: MySQL 8.0, MariaDB 11.2, and PostgreSQL 13 and older. database_type gained explicit mysql84, mysql9, mariadb114 and postgresql14 through postgresql18 values. The bare mysql, mariadb and postgresql values keep working and follow the version we currently recommend for that engine.

Creating a server accepts an ip_type, so you can provision IPv4, IPv6 or a dual stack address on DigitalOcean, Hetzner, Vultr, UpCloud, Linode, AWS, Hostinger and Katapult.

ServerPilot servers can now be imported as well. Apps move from /srv/users to /home, Ploi's own stack replaces the ServerPilot one, and user crontabs are taken over with their paths rewritten.

Server monitor notifications now carry a duration, so "CPU over 80% for longer than 60 minutes" sends one alert instead of firing on every short spike.

Laravel Forge servers can be imported into Ploi. The scan reads the server's sites, certificates, daemons, cronjobs, databases and system users, converts the vhosts to the Ploi NGINX layout, and links the git remotes as custom repositories.

Tenants can hold multiple certificates side by side. Every certificate request adds a new one, installed next to the current certificate until you swap it in.

A synchronize action on the firewall pages reconciles Ploi's rule list with the server's actual ufw ruleset, importing rules that were added outside of Ploi and removing rules that no longer exist.

Sites can hold multiple certificates, with one active at a time. Certificate responses expose that active state, and the new activate certificate endpoint swaps the webserver over to another installed certificate.

New one-off script run endpoint, which executes a script on a server without saving it first. Scripts also take a user now, so besides ploi and root they can run as any system user on the target server, for example a site's isolated system user.

Sites can be created with wildcard subdomains, which stores a *.domain alias and includes it in the vhost server name.

The global database backup and site file backup list endpoints accept server, site and per_page query parameters, so you no longer have to walk every page to find one site's backups.

Team permissions gained granular sub-permissions with parent inheritance, plus full server and site CRUD permissions under a manage-servers umbrella.

Requesting a tenant certificate supports DNS validation through Cloudflare, DigitalOcean, Linode, Route53, Hetzner and Bunny, using either a raw API token or a stored profile credential.

You can now sign in to Ploi with your Google account.

Updating a site brings zero_downtime_deployment to parity with the panel. It rewrites the deploy script for the site's own system user, moves the PHP-FPM reload, and seeds the pre and post deploy scripts.

The ping_url returned after triggering a deploy webhook now reports a status of in-progress, failed, success or unknown, so a CI/CD pipeline can tell whether the deployment actually succeeded.

Creating a site file backup accepts a local_path, the destination path on your backup driver where the archive is stored. It comes back as remote_path when you retrieve the backup.

The API keys page was redesigned with tabs and permission presets, and now lists the OAuth applications connected to your account.

Ploi now ships an MCP server at https://ploi.io/api/mcp, with curated tools for servers, sites, databases, repositories, tenants, aliases, FastCGI cache and insights. Connect Claude, ChatGPT or any other MCP client over OAuth and manage your infrastructure from there, no API key needed.

The create backup endpoints accept next_backup_at to schedule when the first backup runs, so you can spread backups instead of having them all start at once, and deleteOnFail to drop the local archive when a backup fails.

A site can have multiple monitors per location now, as long as each one watches a distinct path.

The site and repository endpoints expose whether quick deploy is enabled.

A dedicated "Deployment failed" notification event, available on every notification channel.

Installing a repository now accepts a source_provider_id to select which connected git provider to use.

Creating a firewall rule now accepts comma‑separated IP addresses — one rule is created per IP instead of a single broken rule.

Ubuntu 26.04 is now supported across all providers when creating a server, alongside Debian 13.

New script schedules and script actions endpoints. Schedule scripts to run on a recurring basis, or trigger them on events such as a server boot, with a configurable per‑action delay.

Debian 12 support added via a new OS provisioner abstraction; OS versions are now grouped by distribution when creating a server.

Live deploy logs are now persisted on the site, so output survives a page reload.

Added a graceful reload action to the services API, so you can reload a service without a full restart.

Major WordPress management additions: install and delete plugins, install themes, search‑replace, and site cloning with database duplication.

WordPress API actions can now be queued with on‑demand support.

Added a WordPress statistics overview to the site general page.

New native rclone backup driver, plus FTP backup file tracking and rotation for database and site backups.

Variable injection via deploy webhooks for applications, support for multiple {RESTART_DAEMON} variables, and a deploy‑started notification across all notification channels.

Nginx config version history for servers and sites, a Laravel queue worker GUI for worker applications, and Laravel Pulse daemon support with real‑time UI updates.

Added MariaDB 11.4 (LTS) as a database option when creating a server.

Load balancer network rules now support an allow type and a description field.

Regional expansion: 7 new AWS regions are now available.

Severity and priority filtering for Composer and NPM vulnerability insights.

Added MySQL 9 as a database option when creating a server.

New server locations added, including Amsterdam and Zurich.