The problem this solves

Billing lives in your client portal. Hosting lives in cPanel. The gap between them is filled with tickets a technician answers by hand.

• Mailbox requests“Can you add an email account for me?” is a two minute job that costs a ticket, a context switch and a reply.


• DeliverabilitySPF, DKIM, DMARC and PTR posture is invisible to the customer, so diagnosing it becomes your work.


• Broken DNSWithout a snapshot and a diff, a customer’s edit is unrecoverable except by you.


• Shared panel loginsHanding a client or agency a cPanel login hands over full file and account access, with no audit trail you own.

The Control Center puts a scoped, permission gated, fully audited subset of cPanel where the customer already is, and gives you an admin console that shows every server, every mapped account, every outbound API call and every action anyone took.

What your customers can do

Sixteen tabs, each rendering against the live cPanel account, each gated by the permissions you set per product. Most also render inline on the WHMCS product details page.

• OverviewUsage and status cards, their own in flight tasks, effective plan limits, one click Run backup. Each data source is guarded separately, so one failure does not blank the dashboard.


• WebsitesDisk and inode usage, subdomains, redirects, an inline file browser with typed delete confirmation, and single sign on into the native File Manager.


• Domains & DNSPrimary, addon and parked zones. Add, edit in place and remove records with a “what changed” diff before saving, snapshot history and one click rollback, one click SPF and DKIM fixes, and an SPF / DKIM / DMARC / PTR traffic light.


• EmailMailboxes, quotas, forwarders, autoresponders, catch all, a full mail filter rule builder with reorder and trace built from the server’s own filter vocabulary, SpamAssassin control, and webmail SSO.


• DatabasesCreate and delete databases and users, grant and revoke privileges, rename in place, manage the Remote MySQL whitelist, check and repair, phpMyAdmin SSO.


• AppsBrowse the Softaculous catalogue with server side search, category filter and paging, install through a schema aware form, then upgrade, back up, clone, stage, push live, remove or SSO in.


• WordPressProvider auto detected. WP Toolkit resolves to a one click SSO deep link. Otherwise Softaculous site cards: log in, view plugins and themes, upgrade core.


• BackupsOne timeline merging cPanel, Softaculous and JetBackup 5, each snapshot badged by origin, with queued work shown alongside. Softaculous and JetBackup snapshots restore in panel.


• SSLInstalled certificates with issuer, expiry and status, re run AutoSSL, install and remove certificates, generate a CSR, capability gated Force HTTPS.


• SecurityTwo factor setup, SSH keys, IP Blocker, per domain ModSecurity, hotlink protection, Directory Privacy, and cPanel API tokens with a one time secret reveal.


• Cron JobsAdd, edit and remove jobs from a schedule preset library. A command invoking a dangerous binary is refused server side until explicitly confirmed.


• FTP & Web DiskFTP accounts with passwords and quotas against the plan limit, plus Web Disk (WebDAV) accounts with permissions.


• MetricsDisk, bandwidth and inode series, LVE usage where CloudLinux is detected, a trend forecast from the account’s own observed series, and per domain PHP version switching.


• LogsRecent visitors, the live site error log by domain, the raw log inventory and archived logs.


• AdvancedDirectory indexing, custom error pages, Apache handlers, MIME types and a DNS lookup tool. Enumerations are read back from the server, never guessed.


• Notifications, Support, Account SettingsService alerts from the daily maintenance run, a service scoped route into your ticket flow, and User Manager subaccounts.

What you get as the operator

Fifteen admin tabs in five groups. Dashboard and Reports make no live WHM calls, so an unreachable server slows nothing down and blocks no page.

• Feature MatrixThe commercial control. Features by area as rows, your products as columns, tri state cells with numeric limits. Basic, Advanced and Reseller presets ship. Versioned JSON export and import with a dry run diff.


• ServersOne card per WHMCS cPanel server: probe status, adapter badges, mapped account count, credential health verdict, test and scan, a per server kill switch and a maintenance toggle.


• Service Mapping and ImportDiscover mappings from your hosting table, verify them against WHM account summaries, and dry run a WHM account sweep before applying it.


• Task QueueFilterable browser over queued work with retry, cancel and per task attempt logs scrubbed at write time. Raw payloads are never exposed.


• Audit LogAppend only trail, each row expanding to a sanitised request and response diff, CSV and JSON export, retention horizon shown on the page.


• API Call LogEvery outbound WHM, UAPI, API2 and Softaculous call with endpoint, HTTP code and latency, decorated with the resolved hostname and cPanel username so a failure is attributable to a host and an account.


• DiagnosticsA server authentication verdict panel that names the failing entry, states which auth method is configured (never the value) and quotes what the server actually replied, plus self test output and migration status.


• API Credentials and SettingsFull add, edit, rotate, revoke and delete lifecycle over stored credentials, showing metadata only, plus five emergency kill switches applied immediately with no cache.

Security and engineering

Properties of the shipped code, not aspirations.

• Credential vaultAES-256-GCM with a fresh IV per value, key derived by HKDF-SHA256 from your WHMCS encryption hash with domain separation. Reads return nothing on tamper. A stored value never reaches markup, an attribute or a JSON response.


• OwnershipThe owning hosting record is re read on every call and never cached across requests. A verified mapping row linking service to server to cPanel username is additionally required.


• Five layer permissionsGlobal flags, the per product feature matrix, client and service overrides, the role ACL and the server’s detected capability must all agree. Controls the actor cannot use are hidden at render, not rendered then refused on click.


• Deliberate asymmetryAn unverified server allows reads and blocks mutations. On database error, read rate buckets fail open and mutation buckets fail closed, so degrading the database never switches off the brake.


• Guarded transportOne SSRF guarded HTTPS transport with a response size cap and a per server circuit breaker. Retries are limited to classified retryable failures on GET only, with backoff and jitter.


• Five kill switchesAll mutations, DNS edits, Softaculous, file operations and backup restores, each toggled from Settings and evaluated first. Every switch defaults to off, so a missing setting cannot brick the module.


• Honest degradation“No cron jobs yet” and “we could not read your cron jobs” are different messages. Admin usage figures are stamped with the age of the sync they came from. An adapter that cannot be positively detected reports as unverified rather than assumed present.

Licensing

Every tier ships both components: the evps_cpanel_control_center addon and the evps_cpanel_extended server module.

Compatibility and requirements

Check these before you buy. Everything below is measured against the shipped builds.

• WHMCS 8.13 to 9.0Running on PHP 8.2 or 8.3, with the ionCube Loader installed and active.


• ionCube Loader 13.3 or newercPanel servers commonly report the Loader as a two part version such as 13.3 or 14.4 even when the installed package is a patch release. 13.3 satisfies the floor.


• Which build to takeTake ic14-php83 unless you are on PHP 8.2, in which case take ic13. There is no PHP 8.3 build under ionCube 13, and ionCube 15 builds do not exist yet.


• A cPanel server already in WHMCSAt least one server under Setup, Servers with working WHM API credentials. The module edits and tests server entries but deliberately does not create them.


• WHM API accessRoot or reseller level access sufficient for account listing, account summary, session creation and UAPI impersonation.


• The WHMCS system cronThe task queue and the nightly maintenance, retention and prune jobs depend on it running normally.


• Client themesEVPS-1000X through its native service tab registry, plus stock twenty one and six through the product details output path. Exactly one path fires per request, and the standalone control panel works on any theme.


• Everything else is optionalSoftaculous, JetBackup 5, WP Toolkit, CloudLinux, Imunify, LiteSpeed Cache, Installatron and SiteJet are all optional. Nothing breaks when they are absent, the relevant features simply hide.

What is not included

Deliberate boundaries of the shipped product, stated plainly so you can decide with the facts.

• Not a full file managerThe inline browser navigates directories and deletes behind a typed confirmation. Copy, move, permissions, extract and compress are not in the interface. Everything beyond browse and delete is one SSO click into cPanel’s own File Manager.


• Full cPanel account restores are operator assistedThey are listed on the timeline but the restore control is deliberately absent, and there is no customer facing backup download. Softaculous and JetBackup 5 snapshots do restore in panel.


• WP Toolkit is detection and SSO onlyNo in panel instance listing and no per site operations. Managed WordPress inside the panel runs through Softaculous.


• Cloudflare is read onlyA status card on the DNS tab. No zone management, no cache purge, no mutations of any kind. Full card detail additionally requires the sibling proxmoxcloud_cf product.


• JetBackup 5 onlyJetBackup 4 installations report as unverified and contribute no snapshots. Installatron and SiteJet are detection only, with no Softaculous equivalent feature surface.


• Admin scope limitsThe cPanel Accounts tab is read only, account imports run synchronously rather than through the queue, and the cPanel password changes through the WHMCS server module flow so the credential WHMCS stores stays in sync.

Questions

• Does this replace cPanel for my customers?No, and it is not meant to. It puts the frequent, low risk jobs into WHMCS where the customer already is, and links out by single sign on for the rest: File Manager, phpMyAdmin, webmail, WP Toolkit and installed applications.


• Can different products have different capabilities?Yes. The Feature Matrix sets features and numeric limits per product with tri state cells, three presets ship, and individual clients or services can be overridden on top.


• What happens when a server is unreachable?The circuit breaker opens for that server and returns a cooldown message instead of hammering it. Dashboard and Reports keep working because they make no live calls, and an unverified server allows reads while blocking mutations, so nothing half applies.


• What if a customer does something destructive?Destructive actions need an explicit confirmation and, where relevant, a typed target match. DNS zones are snapshotted and roll back in one click. Five kill switches take effect immediately with no cache.


• Are my WHM credentials safe?They are encrypted with AES-256-GCM under a key derived by HKDF-SHA256 from your WHMCS encryption hash with domain separation, and are never read back into the interface. The admin screen only tells you whether a credential exists.


• How many applications does the Apps tab offer?Whatever your Softaculous licence carries. The catalogue is read live from the server and paged with an honest count, so no fixed number is quoted here.

Screenshots

EVPS cPanel Extended - Overview

EVPS cPanel Extended - Domains & DNS

EVPS cPanel Extended - Email filters

EVPS cPanel Extended - Backups timeline

EVPS cPanel Extended - Feature Matrix

EVPS cPanel Extended - Servers

EVPS cPanel Extended - API Call Log

EVPS cPanel Extended - Diagnostics