Troubleshooting

Start with the panel itself. The dashboard and the site status show most problems with a short reason, and the Activity log has the details. If the panel does not open at all, connect to the server over SSH and use the commands below.

Commands

systemctl status wardpane          # is the panel running?
journalctl -u wardpane -f          # panel log, live
journalctl -u wardpane-sync        # the root helper that applies PHP and Node.js settings
journalctl -u 'wardpane-php@*'     # php-fpm of the sites
journalctl -u 'wardpane-pm2@*'     # PM2 daemons that run the Node.js apps, one per owner
journalctl -u wardpane-auth        # root password checks (signing in as root)
sudo node /opt/wardpane/bin/unlock-login.js                 # lift sign-in blocks
sudo node /opt/wardpane/bin/unlock-login.js --reset-access  # sign-in from .env again

The panel does not open

• Check that the service runs: systemctl status wardpane.
• Check the firewall. Port 1500 must be open in ufw and in the VPS provider’s firewall, if the provider has one.
• If PANEL_ALLOW_IPS is set, the panel does not answer other addresses at all. Connect through an SSH tunnel (see panel security) or reset the list with --reset-access=allow-ips.
• For about a minute after installation, until the IP certificate is issued, the browser may warn about a self-signed certificate.

Cannot sign in

• “Too many failed sign-in attempts”: wait, or run sudo node /opt/wardpane/bin/unlock-login.js.
• “Sign-in is not available right now” when signing in as root: the root password helper is not reachable. Check systemctl status wardpane-auth.socket and journalctl -u wardpane-auth. Running install.sh again recreates the helper.
• Root cannot sign in if its password is locked or empty (passwd -S root shows L or NP).

A certificate is not issued

• Every name of the site needs an A record with the server IPv4. If a name has AAAA records, each of them must point to this server. The SSL tab shows which names are missing from the certificate and why.
• ACME_EMAIL must be set.
• Behind Cloudflare, turn on Behind Cloudflare for the site and use the SSL mode Full or Flexible for the first issuance. See Cloudflare.
• Failed attempts are retried with growing pauses, and the log shows when the next one is due. Let’s Encrypt allows only 5 duplicate certificates a week, so WardPane avoids ordering the same set of names again.

A PHP site shows errors

• The site’s PHP error log is in the panel; on disk it is logs/php-error.log next to the site files.
• PHP can write only to tmp/, logs/, data/ and the folders you listed. Uploads, caches and plugin updates need their folder in the list. Re-apply & fix permissions fixes ownership after you uploaded files as root.
• mail() does not work in the sandbox: send mail through SMTP.
• If php-fpm does not start in the strict sandbox, set PHP_SANDBOX=basic, restart the panel and report the problem.

A Node.js app shows 502

The app is not listening or has crashed. Open the site’s Handler tab: the state, the last action and the output and error logs are there. Make sure the app listens on the PORT and HOST the panel sets. After changing dependencies, press npm install, then Restart. See Node.js.

Visitors are blocked who should not be

• To find out which check blocked them, look at the site’s protection statistics and the Activity log.
• Look up the visitor’s IP in Advanced, Security. The lookup shows the country and network, and whether the address is in a hosting network or belongs to a known crawler.
• Add trusted addresses to the site’s allow list, which exempts them from every site check except devices. The global blocklist still applies to them.
• If the site is behind Cloudflare and Behind Cloudflare is off, every visitor looks like Cloudflare. Turn it on.

Damaged data files

If data.json or settings.json is damaged, the panel uses the .bak copy and keeps the broken file as *.corrupt-<time>. If both copies are unusable, the panel refuses to start, because starting with empty settings would remove all sites. Restore from /var/backups/wardpane/<time>/, or remove both files to start from scratch.

Still stuck

Write to [email protected]. Describe what you did and what you expected, and include the relevant lines from journalctl -u wardpane with passwords and tokens removed. Report security problems to [email protected].