Help Center conversations, easier server selection and safer access

Get help in the context of the guide you are reading, find the right server more easily, and stay in control of shared access. This release also strengthens account protection and improves backups, Classic migrations and everyday server management.

More useful help, right where you need it

• Ask Zappy about the guide you are reading. Help Center articles now offer a question button that starts a separate conversation with the article already attached as context, without disturbing existing chats. Zappy and the panel assistant can also read full articles rather than relying on short previews.
• Get a reply after the assistant checks your service. Panel chats now recover turns that previously ended after a tool action without a useful answer. Saved-chat dates also follow your selected app language.
• Know when advice is automated. Zappy describes automatically researched answers accurately instead of implying a human team reviewed them, and dedicated hardware findings are passed for infrastructure review without promising a replacement.
• Receive more accurate account guidance. Cancellation instructions no longer describe the optional review as mandatory, service answers can identify ended contracts and scheduled deletion dates, and Windows evaluation expiry is available when explaining unexpected VPS shutdowns.
• Keep control of assistant actions and data. Discord bot console commands now require confirmation, outbound requests are restricted after sensitive service information has been read, and guest support conversations stay separate from account data. Automated screenshots cannot open administrative or API pages, or capture private service pages without a configured capture account.

Find the right hosting more easily

• Explore real hosting activity on the homepage. A live map shows anonymised orders arriving at our datacenters, with product details and location information. Open the location view to explore availability, prices and measured ping, with a mobile-friendly location sheet.
• Reach every main product from the shop introduction. Gameservers, VPS, TeamSpeak, Discord bots and dedicated servers now have direct shop links, with labels that wrap cleanly on smaller screens.
• Choose a dedicated server by location first. The configurator shows the processors available at your selected location, location-aware socket choices and ready-now builds, helping you narrow down suitable hardware.
• Compare VPS backup options without cramped cards. Backup choices use full-width rows with aligned facts and prices, adapt to the space available, and keep consistent ZapX Pass styling.

Stronger protection for your account and data

• “Lock now” closes access more reliably. Earlier unlock proofs no longer keep the session open, and active notification, console and progress streams stop after locking. Passkey sign-ins without PIN or biometric verification no longer automatically unlock the app lock.
• Your ZapX two-factor protection also applies when coming from Classic. The Classic login bridge now asks for the regular second factor when enabled. If your browser offers an unknown Classic passkey at ZapX login, you receive an explanation instead of a silent failure.
• Sign in with clearer, safer checks. Social sign-up requires a provider-verified email address, sign-in return destinations are more tightly checked, and email-code requests have stronger abuse limits. The mobile sign-in flow also accepts only the intended app sign-in requests.
• Sensitive credentials receive stronger protection. OAuth, social-login, TeamSpeak and temporary remote-management credentials are better protected in storage; login codes and cookies are kept out of diagnostic output. Locked accounts are also refused more consistently across connected sign-ins, remote consoles and shop support handoffs.
• Confirm your identity before downloading database contents. Full database exports and database-backup downloads now request a fresh email-code verification when needed, then continue the download. Schema-only exports are unchanged.
• Use integrations with clearer access boundaries. REST API and MCP access now have a 600-request-per-minute account budget alongside existing credential limits, and custom ISO libraries on shared servers belong to the caller. Cross-site request checks and download protections are more consistent, while OAuth error handling avoids unsafe return destinations.

Sharing that follows your permissions

• Shared access stays within the resources granted to you. Linking a shared service to an owner’s custom domain requires DNS write permission on that domain, and domain activity respects the corresponding read permissions. One-Click App lookups stay within the requested server’s panel context, while linked-panel project changes remain owner-only.
• View dedicated server details with the right read permissions. Share recipients can now see hardware, statistics and traffic in the panel, matching API access. Dedicated remote management remains owner-only across the panel, API and MCP.
• Sensitive actions use the appropriate permission. Assistant Workshop changes require mod-management access, and assistant activity reads require activity access. Destructive Discord bot operations, including template wipes, follow owner-only restrictions, with reinstall retries also respecting running restores.
• A declined sharing invitation stays declined. Owners must wait 30 days before inviting that account again. Invitation lists and responses are also more tightly bound to the intended recipient, and revoked access is rechecked before shared users’ scheduled tasks run.

More reliable server management

• VPS maintenance handles common interruptions better. Mounting a bootable ISO on a running VPS now includes the restart needed to start the installer; restores no longer rely on an outdated running status. Root-password changes better handle brief node unavailability, and reinstalls retry eligible temporary refusals.
• Classic VPS moves prepare the right CPU and disk settings. Affected servers receive pending host-CPU settings for applications that need features such as AVX, while adopted Windows servers receive the disk setting needed for retrim. Restart hints explain when pending settings take effect, and unsafe live moves between incompatible CPUs are blocked.
• Your firewall rules stay visible and editable. Catch-all rules that resemble Classic system rules now receive a neutral “custom rule” comment instead of disappearing or being removed during a later sync.
• File tools keep operations within your server. Gameserver file actions and console-log reads have stronger boundaries, URL and mod downloads receive stricter destination checks, and server imports enforce the amount of data actually transferred. Large supported uploads retain their existing allowances.
• Schedules and SFTP follow service state more consistently. Scheduled control actions respect incident locks, every line of a scheduled console command receives the existing shutdown checks, and SFTP access is cleaned up after moves. A delayed SFTP update can no longer re-enable access after suspension or revocation.
• Repeated game changes have clearer limits and less leftover data. Game re-downloads are capped at 20 per server per 24 hours, and FiveM resource installations retain only the newest five installer backups per resource and configuration file. Workshop saves still succeed after the inline metadata budget is reached, with new titles and previews appearing later.
• FiveM and Silica workflows are easier to follow. Maker deployments now recognise FiveM Enhanced servers, generated FiveM READMEs avoid conflicting manifest instructions, and Silica settings have clearer labels. Classic Discord bot moves also recognise malformed tokens more reliably instead of leaving those cases stuck for review.

Backups and Classic moves with fewer surprises

• Turn daily VPS safety backups back on without a Pass. Re-enabling the daily backup no longer requires an active ZapX Pass. Backup descriptions now distinguish safety backups, customer-created backups and restore access, and hosting pages no longer advertise backup features they do not provide.
• Restore with better safeguards. Gameserver, TeamSpeak and Discord bot restores stop with a clear message if temporary space becomes critically low, while sparse-file handling reduces unnecessary expansion. TeamSpeak restores preserve managed logging, transfer and bandwidth settings.
• Classic move information stays closer to reality. Gameserver moves preserve booked dedicated IPs in the affected cases, and old gameserver/TeamSpeak web-interface notices refresh when servers have been deleted or wiped. Support for moving TeamSpeak rentals prepaid far into the future is available behind an optional rollout setting.

Clearer billing and checkout behaviour

• Understand billing-related service suspensions. Gameservers, TeamSpeak servers and Discord bots now record billing as the suspension cause, including account-wide invoice locks, so the panel can distinguish these from customer pauses or staff holds.
• Classic-paid plan changes settle more consistently. Applicable VPS price differences are credited promptly after a change, without waiting for a later correction. A pure billing-term switch during a Classic-paid period no longer creates a credit simply because the longer term has a lower daily price.
• Resume paused services with consistent charges. Quotes and charges account correctly for partially reversed pause credits, concurrent resumes cannot defer an amount that should be charged, and paid resume invoices are checked against the correct subscription account.
• Coupon eligibility is more consistent. Codes are normalised when recorded, limited-use partner coupons reserve checkout slots without letting one customer occupy many, and disabled tool offers no longer accept their coupons. Affiliate discounts follow the recurring-payment rules rather than applying to Lifetime purchases.
• Checkout and refunds respect the intended purchase. Where the early-start requirement applies, paid orders require explicit consent, including API orders; a combined purchase cannot retry its domain payment before the server purchase is provisioned. ZapX Pass package-removal proration and refund checks are also tighter.
• Credits work in your billing currency. Eligible review cashback is booked in the customer’s charge currency and requires a paid purchase. VAT evidence is rechecked when stale, and temporary exchange-rate lookup failures no longer leave fallback rates cached for an hour.

A cleaner experience across screens and languages

• Floating help controls cover less content. The support launcher stays compact on short landscape phones, and the shop recommendation bubble becomes icon-only on tablets and smaller desktops. Service-page controls, loading states and reading widths are more consistent, with tighter public-page headings and better-fitting payment logos.
• More text matches your selected language. FiveM installer messages are translatable, public tools use context-appropriate labels, and Dutch lock wording and slot terminology are more consistent. This release also refreshes translations and adds a Portuguese Spigot plugins page.
• Public pages load and fail more predictably. Cached public content and a prerendered panel shell reduce repeated loading work, missing pages return a proper not-found response, and preview access no longer gets stuck on a cached blank page. Withdrawing acquisition consent also clears leftover tracking cookies correctly.
• See more useful domain and protection details. Domain pages show when the domain joined ZAP. For IPs included in the attack-triggered protection pilot, the DDoS tab explains an active mandatory protection window and prevents switching protection off during it.
• Public and community tools handle sensitive details more carefully. Minecraft log pastes redact recognised secrets before analysis and storage and provide a deletion link; monitor notifications validate Discord and Slack webhook destinations. Public identifiers receive more consistent checks, signed-in partner applications are no longer blocked by unverified guest inquiries, and hidden server listings explain when support is needed instead of allowing deletion and relisting.