Modernizing at Full Speed

Maybe you noticed: we’ve started to modernize more aggressively. Pascal has always had the urge to modernize continuously. Whenever there was an immediate need, or a request from one of you, our precious customers, he implemented what was needed. No excessive lead time, no overcrowded backlog, just do it!

Since his return to Switzerland, and even more since AI agents joined the team, this has turned into a steady stream of new releases. Here is a short overview of the past year.

Better protection for your account

The control panel now supports two-factor authentication. When you log in, the panel asks for your password and for a code. The code comes from an authenticator app on your phone, or it is sent to you by email. To set up the app, you scan a QR code in the panel. New accounts have the email codes switched on from the start. A login now ends after four days without use, and stays valid as long as you use it.

Passwords are now stored with Argon2, the method that security experts recommend today. Until 2017, we stored passwords as SHA-1 hashes. Then we switched to a stronger method (PBKDF2), and each time you logged in, the panel saved your password with the newer method. Django, the framework behind the panel, no longer supports SHA-1. So after our upgrade, the remaining SHA-1 passwords no longer work. If you have logged in at least once in the last nine years, nothing changes for you. If you haven’t logged in since before 2017, click “Forgot password?” on the login page and set a new password.

A fresh look, in your language

The panel is now available in English, German, Vietnamese and Chinese. The emails we send you are in your language, too, including the subject line.

We are evaluating Vue as the future technology for the panel’s user interface. But we didn’t want you to wait for it. A fresh design now runs on wservices.ch, djangoeurope.com, the API browser and the control panel. The panel and the API browser also have a dark mode.

We also invest in usability. When an error happens, the panel no longer opens a popup. Instead, a short notice in the corner says what happened, and your page stays as it is. When your session ends, you can log in again on the same page, and you don’t lose what you have typed. In long tables, the column headers stay visible while you scroll. The examples in empty fields are lighter now, so you don’t mistake them for real input, and checkboxes sit neatly next to their text.

And everything works on your phone, with the same menu button on all our sites, from our websites to the API. In the panel, that button opens the menu from the right finally, and so does a swipe from the right edge. On a computer, a button at the bottom of the side menu collapses it to its icons. The API browser now has a user menu, too, with a link to the control panel.

Billing and statistics

The new “Billing” menu shows all your products in one place. There, you can renew or activate a product, cancel it at the end of the billing period, or switch auto-renew back on. You don’t need to open a support ticket for this.

For RabbitMQ, the panel shows how many messages your vHost has handled this month, next to the limit of your plan. We have also redrawn the statistics charts. You find them in the menu under “SSH users” and “Rabbit MQ”: open an SSH user or a vHost, and follow the links to its statistics.

API keys with clear limits

An API key can now do only what you allow. A table lists everything the API offers, and for each part you choose whether the key may view, add, change or delete, instead of giving the key full access. For example, a script that manages your domains doesn’t need access to your mailboxes, so you simply don’t allow it. In addition, you can limit a key to one IP address or network, written as usual for IPv4 or IPv6 with netmask, or to a country. Then the key works only from where you use it, for example from your build server.

If you look after other accounts, for example as an agency for your clients, an API key can act as any of them. So one script can do its work in all the accounts you look after.

The panel shows a new key only once, then only its last four characters. You can revoke any key with one click, or let it expire automatically: at a date you choose, or after a period in which it isn’t used.

Mail that gets through

Email is old, yet it is more important than ever. Your email address proves who you are: you use it to sign up, to log in and to get back into your accounts. So big providers like Gmail, Outlook and Yahoo have grown suspicious of any mail they can’t verify. That’s why you can now sign your outgoing mail with DKIM and publish a DMARC policy straight from the panel, so your mail is recognized as yours.

The reality is even harsher. Since February 2024, Google expects every sender to authenticate their mail with SPF or DKIM. Google at least tries to be smart: mail that fails these checks may still be delivered to the spam folder. Microsoft followed in May 2025, and it is much stricter: mail that breaks its rules is not delivered at all. Badly configured DNS records, together with large amounts of unfiltered mail sent again and again, put our mail servers on blocklists. When a server is on a blocklist, everyone who sends mail through it has problems. This kept us busy: those of you whose business depends on sending a lot of email had to open support tickets again and again.

Forwarded mail was another problem: Gmail sometimes treated a forwarded message as forged. A new mail relay now rewrites the sender address of forwarded mail (SRS), so it arrives where it should.

On our servers

If you build applications with AI, you can now enable the vector extension (pgvector) for your PostgreSQL databases, as well as unaccent and pg_trgm. Let’s Encrypt wildcard certificates now also cover the main domain, so example.com as well as *.example.com. Our servers are ready for Debian 13. Their firewalls moved from iptables to nftables, and fail2ban blocks anyone who repeatedly tries to guess passwords.

Always up to date

To be safe, we upgraded Django and Angular, the frameworks the control panel is built on, to their latest stable releases. Software ages quickly, so we now upgrade more often. More automatic checks now run on every change we make to our software. This is part of the experience I’m allowed to bring to djangoeurope.

Soon, AI agents will take over part of the upgrade work. They will decide smartly what needs to be done, but they must follow the same strict rules as we do. We don’t trust ourselves to be careful when we are in a hurry: automatic checks stop us before we save a wrong change, and the tests on our servers fail as soon as we make a mistake. The agents will have to pass exactly the same checks, and have every change reviewed and properly explained.

Security

This year, we started a public bug bounty program. Security researchers who find a weakness in our platform report it to us, we fix it quickly, and they receive a reward.

The public forms of the panel, such as signup and password reset, are protected against bots without asking you to solve puzzles. Instead, your browser solves a small calculation task (proof of work). This costs you almost nothing, but it makes thousands of automated requests expensive.

Just do it

None of this came from a long-term plan. It came from your requests, from our own daily work, and from Pascal’s urge to improve things right away. If something is missing for you, tell us. Maybe you will find it in the panel sooner than you think.