https://rootmanage.com/updates Every update to RootScan and the RootManage agents, with its date, what changed, how it affects you and what to do. 2026-10-12T00:00:00Z tag:rootmanage.com,2026:updates:rootscan:v2-9-0 2026-10-12T00:00:00Z

The first version since 2.1.1 that goes to every installed RootScan. It brings in all the features built in 2.2.0 to 2.8.0 (listed below) and changes how the paid features are delivered.

The first version since 2.1.1 that goes to every installed RootScan. It brings in all the features built in 2.2.0 to 2.8.0 (listed below) and changes how the paid features are delivered. What changed: - RootScan Email and white-label branding are delivered to servers that have a valid paid licence when the licence is checked, instead of being part of the downloaded package - A paid server needs a licence check-in less than 3 days old to keep the paid features on - Right after an update RootScan checks the licence, so a paid server gets its features at once - Includes everything from 2.2.0 to 2.8.0, which are described in the entries below How it affects you: - Free plan: nothing is taken away. The scanner, cleaner, firewall, web rules and reports for up to 10 accounts keep working - Paid plans: Email and white-label keep working as long as the server can reach rootmanage.com at least once every 3 days - A server on 2.1.1 or older jumps several versions at once, so read the entries below to see what is new What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-8-0 2026-10-12T00:00:00Z

The paid features (RootScan Email and white-label) were moved out of the open part of the package and are unlocked only by a valid paid licence. It also bundles the licence notice, the web rules fix and the bot-protection switch from 2.7.x.

The paid features (RootScan Email and white-label) were moved out of the open part of the package and are unlocked only by a valid paid licence. It also bundles the licence notice, the web rules fix and the bot-protection switch from 2.7.x. What changed: - RootScan Email and white-label are unlocked by the licence and not by a setting on the server - Free servers receive the same engine, without the paid parts working - Includes the licence notice (2.7.2) and the web rules fix and bot-protection switch (2.7.1) How it affects you: - Free plan: no change in what you can do - Paid plans: no change in what you can do, as long as the licence is valid What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-7-2 2026-10-12T00:00:00Z

A plain-language licence notice now ships with RootScan, so it is clear what you may and may not do with the files.

A plain-language licence notice now ships with RootScan, so it is clear what you may and may not do with the files. What changed: - A LICENSE.txt with the terms is included in the package - Every code file carries a short copyright line - The installer shows the terms, and the public FAQ explains whether the code can be read How it affects you: - No change in how RootScan works - The code stays readable, but RootScan is not open source What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-7-1 2026-10-11T00:00:00Z

On a real cPanel server Apache refused the RootScan web rules file. This version fixes that, and adds an on and off switch for bot protection.

On a real cPanel server Apache refused the RootScan web rules file. This version fixes that, and adds an on and off switch for bot protection. What changed: - Fixed: Apache rejected one web rule with a "missing closing parenthesis" error. The rules are now written correctly - If Apache still refuses a rule, RootScan now adds the rules one at a time, keeps the ones that are accepted and tells you which one was left out - New: a Bot protection ON/OFF switch in the Firewall tab, and the command rootscan fw bots on|off - Guard now only checks bots when the firewall is switched on How it affects you: - Servers that could not install the web rules now can - Bot protection can be turned off without touching the rest of the firewall What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-7-0 2026-10-11T00:00:00Z

This version looks for the tricks attackers use to stay on a server, watches WordPress administrators and can recognise real search-engine bots.

This version looks for the tricks attackers use to stay on a server, watches WordPress administrators and can recognise real search-engine bots. What changed: - Persistence checks: auto-prepend settings in .htaccess, .user.ini and php.ini, pictures set to run as PHP, redirects shown only to search engines, very long lines, mu-plugins and db.php files - WordPress administrator watch: RootScan remembers the administrators of each site, flags a new one as high severity and flags a changed e-mail. It only reads the database and shows masked values - New card in Web rules: block PHP in uploads folders for all sites, or only some, with an off switch and an optional nightly refresh. Also rootscan harden - Bot verification: Googlebot, Bingbot, Applebot, YandexBot and Baiduspider are confirmed by a reverse and forward DNS check, and fake bots are counted as abusive How it affects you: - More hidden problems are reported, so a server can show new findings after the update - Real search-engine bots are never counted against you - Blocking PHP in uploads can break a plugin that runs PHP from there, so use the off switch if a site breaks What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-6-1 2026-10-11T00:00:00Z

The mail reputation check reported blacklist listings that were not real on a server whose DNS answered every question with the same address.

The mail reputation check reported blacklist listings that were not real on a server whose DNS answered every question with the same address. What changed: - Answers of 127.0.0.1 and wildcard resolver answers are now treated as "no answer" and not as "listed" How it affects you: - Fewer false alarms in RootScan Email (paid plans) What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-6-0 2026-10-11T00:00:00Z

The Email page in WHM was rebuilt with the layout of a mail quarantine, with sub-tabs and bulk actions.

The Email page in WHM was rebuilt with the layout of a mail quarantine, with sub-tabs and bulk actions. What changed: - Sub-tabs: Quarantine, Activity monitor, Statistic, Reputation and Settings - Quarantine table with account, received date, reasons, sender, recipients, subject and the PHP script that sent it, with sorting, search, 25 per page and bulk release, freeze and delete - A view panel shows the headers, the start of the message and why it was flagged - The reasons come from RootScan's own checks, not from a trained mail filter How it affects you: - Easier to review and release held mail - Only on paid plans, because RootScan Email is a paid feature What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-5-0 2026-10-11T00:00:00Z

This version makes it harder for an attacker to use RootScan against a server or to switch it off without being noticed.

This version makes it harder for an attacker to use RootScan against a server or to switch it off without being noticed. What changed: - Files in customer folders are now changed as the account user, never as root through links or special files - New command rootscan verify and a nightly e-mail if RootScan's own files, permissions, cron entries or pages have been changed - The installer sets strict ownership and permissions on every file - The scanner also looks inside nested folders and very large files, finds PHP hidden at the end of pictures, flags attempts to evade a scan and finds CGI, Python and JSP shells How it affects you: - You may get a "RootScan files changed" e-mail if someone edits them, which is the point of the check - Someone with root on the server can still change anything. RootScan reports it, it cannot prevent it What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-4-0 2026-10-11T00:00:00Z

RootScan Email is now a paid feature, and gained checks for stolen mailbox passwords, bounce floods and per-account limits.

RootScan Email is now a paid feature, and gained checks for stolen mailbox passwords, bounce floods and per-account limits. What changed: - RootScan Email, white-label and the mail PDF sections are part of the paid plans. Every other feature stays in the free plan - A sample of the message is read before an automatic hold, so a newsletter is reported and not held - Alerts for a stolen mailbox password and for a flood of bounces - Per-account hourly sending limits - A SpamAssassin check, described honestly as a check and not as an incoming mail filter - Delisting links, an hourly re-check and a "clean again" notice - Ignore a rule in one folder, with a note How it affects you: - Free plan: the Email tab shows that Email is part of the paid plans - Paid plans: more mail problems are caught early What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-3-0 2026-10-11T00:00:00Z

The first version of RootScan Email protects a server's mail reputation, which is what keeps your customers' mail out of spam folders.

The first version of RootScan Email protects a server's mail reputation, which is what keeps your customers' mail out of spam folders. What changed: - Mail reputation: blacklist checks, reverse DNS, SPF, DKIM and DMARC with a grade for each domain - Exim queue shown as a quarantine, with freeze, thaw and remove, and a way to hold an account's outgoing mail - Finds the folder a spam script runs from. The default action is to alert, and holding is opt-in - A Timeline for each infection (what probably happened and a recovery checklist), an A to F grade, plain-text explanations of each finding, rootscan pause and rootscan status --json How it affects you: - Needs Exim, which cPanel uses - Nothing is held automatically unless you choose that What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-2-0 2026-10-10T00:00:00Z

A large feature release. It was tried by the owner on a real VPS before the later versions were built.

A large feature release. It was tried by the owner on a real VPS before the later versions were built. What changed: - White-label branding (paid plans) and monthly PDF reports, sent on the 1st of the month - MailWatch counts spam in the Exim log inside the 5-minute check - Telegram commands, in a private chat only - False-alarm report: only the file's fingerprint and the rule id are sent to us, never the file - Restore a clean copy of a file from an uncompressed cPanel backup when cleaning - WordPress plugin update with a backup and an undo (needs the PHP zip module) - WordPress database check for injected scripts, with clean and undo. It talks only to the local MySQL (needs pdo_mysql) - An "Ask an expert" button, fleet alerts by e-mail when a server has been quiet for over 26 hours or reports malicious files, and referral links How it affects you: - Some features need a PHP module that your server may not have, and RootScan says which one is missing - Nothing in the database is changed without a backup and an undo What to do: Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves. tag:rootmanage.com,2026:updates:rootscan:v2-1-0 2026-10-10T00:00:00Z

RootScan can now update itself. This version also fixes problems found when it was first installed on a real cPanel server.

RootScan can now update itself. This version also fixes problems found when it was first installed on a real cPanel server. What changed: - New: rootscan update, with --check and --rollback. It checks a signed notice and a checksum, keeps a backup and rolls back by itself if the update fails - New: an Update now banner in WHM and an optional auto-update for the same major version, at night - New: a licence card showing your plan, end date and days left, and a redesigned WHM interface - Fixed: the installer stopped when the cPanel theme was not the one it expected, because cPanel uses jupiter. The cron job and licence key were never set up - Fixed: the WHM "page expired" error - RootScan now sends counts-only statistics when it checks in, and the dashboard shows them per server How it affects you: - Servers that stopped at the installer can finish the install now - Future updates are one command, with no re-download or re-install What to do: On 2.0.x, run the install command from your dashboard once. After that, sudo rootscan update does the rest. tag:rootmanage.com,2026:updates:rootscan:v2-0-0 2026-10-10T00:00:00Z

A new generation of RootScan, with many more checks and tools, and a free plan of 10 accounts for every registered user.

A new generation of RootScan, with many more checks and tools, and a free plan of 10 accounts for every registered user. What changed: - 67 detection rules, and vulnerable plugin, theme and core checks for WordPress, Joomla and Drupal - Cleaner: removes injected code, restores genuine WordPress files or quarantines, always with an undo - A quick scan every 5 minutes for new attacks - Health score, exposure checks, a server audit and end-of-life PHP checks per account - Firewall (CSF or an ipset chain) with allow and deny lists, country and port rules, and lock-out protection - ModSecurity web rules that are tested with the web server before they are used and rolled back if the test fails - Alerts by e-mail, Telegram and webhook, weekly reports, results shared with cPanel users, and rootscan doctor and rootscan audit - Free plan: 10 accounts on 1 server, for every registered user. The licence is checked with signed answers How it affects you: - The firewall and web rules start switched off (monitor mode), so nothing is blocked until you turn it on - Version 1 servers need the new install: it is a new generation, not an in-place patch What to do: Download the package from your dashboard, unpack it as root and run the installer. tag:rootmanage.com,2026:updates:uptime:v1-0-0 2026-10-08T00:00:00Z

One tiny signal a minute tells RootManage your server is alive.

One tiny signal a minute tells RootManage your server is alive. What changed: - A timer sends one signal a minute and nothing runs in between. It only reads the server's uptime - The dashboard shows up and down status and a 30-day uptime figure - A cron line is used instead of a timer on systems without systemd - Down and up e-mails are built, but they are not switched on yet How it affects you: - Almost no CPU use - You will not receive down or up e-mails until they are switched on. This page will say so when they are What to do: Install it with the command from your dashboard. To update it later, run the same line again. tag:rootmanage.com,2026:updates:rootscan:v1-1-0 2026-09-26T00:00:00Z

The first versions of RootScan: a WHM and cPanel add-on that scans for hacked websites, with a licence key for each server.

The first versions of RootScan: a WHM and cPanel add-on that scans for hacked websites, with a licence key for each server. What changed: - Installs inside WHM and cPanel - Scans websites for web shells and injected code and quarantines what it finds - A licence key for each server, created in your dashboard - Public page, dashboard and downloads on rootmanage.com How it affects you: - Versions 1.x were replaced by 2.0.0 on 10 October 2026 What to do: Move to 2.0.0 or later from your dashboard. tag:rootmanage.com,2026:updates:server-health:m-2026-09-12 2026-09-12T00:00:00Z

The dashboard can now show the processes using the most CPU, and an administrator can stop a runaway one. Every action is recorded in an activity log.

The dashboard can now show the processes using the most CPU, and an administrator can stop a runaway one. Every action is recorded in an activity log. What changed: - The agent reports the top processes by CPU for the heavy-process panel - An administrator can stop a process through the same safe job queue as Run now. Clients cannot stop processes - An activity log records who did what, for both administrators and clients How it affects you: - You can see why a server is slow without logging in - Every stop request is recorded with the name of the person who made it What to do: Nothing to do. The agent updates itself. tag:rootmanage.com,2026:updates:guard:v1-0-0 2026-09-06T00:00:00Z

The fifth RootManage agent: host-level flood control, with block and unblock from the dashboard.

The fifth RootManage agent: host-level flood control, with block and unblock from the dashboard. What changed: - Host flood control: SYN cookies, dropping invalid packets and a rate limit on ports 80 and 443 - A traffic view with the busiest addresses and abnormal spikes - Block and unblock addresses from the dashboard - It is not an internet DDoS scrubber and only handles traffic that already reached the server How it affects you: - Helps a server survive abusive floods, but it cannot help if the network link is already full What to do: Install it with the command from your dashboard. tag:rootmanage.com,2026:updates:litehouse:v1-1-0 2026-09-02T00:00:00Z

Each finding now includes a command you can paste as root to fix it. LiteHouse still never applies a change itself.

Each finding now includes a command you can paste as root to fix it. LiteHouse still never applies a change itself. What changed: - A paste-as-root solve command for every finding - LiteHouse still only reports and never changes the server How it affects you: - Faster fixes, and you stay in control of what runs What to do: Nothing to do if your agent updates itself, or run sudo litehouse --update. tag:rootmanage.com,2026:updates:litehouse:v1-0-0 2026-09-02T00:00:00Z

The fourth RootManage agent: a low-priority website audit every morning.

The fourth RootManage agent: a low-priority website audit every morning. What changed: - Daily audit at 04:00 IST, or on demand with Run now from the dashboard - Findings with severities, a graph, history and reports - Does not start a scan when you install it - Runs with a low priority How it affects you: - It never changes your server What to do: Install it with the command from your dashboard. tag:rootmanage.com,2026:updates:server-health:m-2026-09-02 2026-09-02T00:00:00Z

You can ask the Server Health agent for an immediate check or scan from your dashboard instead of waiting for the next scheduled run.

You can ask the Server Health agent for an immediate check or scan from your dashboard instead of waiting for the next scheduled run. What changed: - Run now in the dashboard queues a job for the server - The agent picks it up on its next heartbeat, about a minute later, and shows the result and a log tail - Jobs are queued and run with a low priority How it affects you: - Useful right after a fix, to see the result at once What to do: Nothing to do. The agent updates itself. tag:rootmanage.com,2026:updates:metrics:v1-0-0 2026-08-30T00:00:00Z

A separate small agent that draws CPU, memory, disk and network charts for your server.

A separate small agent that draws CPU, memory, disk and network charts for your server. What changed: - A sample every 5 minutes: CPU, memory, disk, load, cores and network speed - Charts and history in your dashboard - Separate from Server Health and Backup, with a low priority - Updates itself on request with rootmanage-metrics --update How it affects you: - Almost no extra load on the server - Installing it does not remove the Server Health agent What to do: Install it with the command from your dashboard. tag:rootmanage.com,2026:updates:backup:v1-0-0 2026-08-30T00:00:00Z

Nightly backups of your databases and files, sent off the server.

Nightly backups of your databases and files, sent off the server. What changed: - A backup at 02:00 IST every night: databases are dumped first, then files, with a low priority - Storage on our storage box, or your own SFTP or S3 destination - Lists snapshots and restores files on request - Updates itself and can be updated with rootmanage-backup --self-update How it affects you: - Backups are off the server, so a failed disk or a hack does not take the copies with it What to do: Install it with the command from your dashboard. Save your storage details first if your plan uses your own box. tag:rootmanage.com,2026:updates:server-health:v2-3-0 2026-08-29T00:00:00Z

The daily job now refreshes its checking engines before it scans, so the results use up-to-date information.

The daily job now refreshes its checking engines before it scans, so the results use up-to-date information. What changed: - At 01:00 IST the agent refreshes the hardening and package-scan engines from their official sources, using little CPU, then runs the scan - If an engine is missing, the daily job tries to install it again - Inactive or unpaid servers stop before any update or scan - Detects common control panels and backup tools - Server Health and the Admin Live Monitor show the hardening score, package vulnerabilities and copy-paste solve commands - Commands: rootmanage-agent --once, --scan, --self-update and --version How it affects you: - The daily scan can take a little longer because the engines are refreshed first - Scans only run for servers with an active plan What to do: Nothing to do. The agent updates itself. tag:rootmanage.com,2026:updates:server-health:v2-1-0 2026-08-29T00:00:00Z

The agent got its daily scan and the ability to update itself.

The agent got its daily scan and the ability to update itself. What changed: - Daily scan at 01:00 IST with a CPU limit - Stops early on inactive servers - Detects the software stack on the server - Uses Lynis and Trivy when they are installed - Updates itself How it affects you: - Low impact on your sites, and servers update without your help What to do: Nothing to do. The agent updates itself. tag:rootmanage.com,2026:updates:server-health:m-2026-08-28 2026-08-28T00:00:00Z

The first version of live server monitoring: an agent on your server reports to your dashboard.

The first version of live server monitoring: an agent on your server reports to your dashboard. What changed: - Each server gets its own agent token - A heartbeat sends the latest load and usage figures - Alerts appear in the dashboard, and administrators see every server in the Live Monitor How it affects you: - You can see how a server is doing without logging in What to do: Install the agent with the command from your dashboard.