Plesk has rolled out one of its most ambitious updates in recent years. Obsidian 18.0.72, released on August 19, 2025, introduces the Sitejet AI Website Generator, key security enhancements, extended OS support, and a long list of bug fixes. A few days later, on August 26, 2025, Update 1 was published to address post-release issues, including an HTTP 500 error when accessing Apache & Nginx Settings.
The August cycle also includes updates to extensions and ecosystem tools: WP Toolkit 6.8.0, Firewall 2.2.10, Sitejet Builder 1.3.1, improvements to Plesk Migrator 2.30.0, and third-party component updates for both Linux and Windows. Altogether, these changes focus on three areas: simplifying site creation, strengthening daily operations, and keeping the software stack up to date.
Sitejet AI Website Generator: AI-assisted site creation lands in Plesk
The highlight of Plesk Obsidian 18.0.72 is the Sitejet AI Website Generator, integrated into the Sitejet Builder extension. The feature allows users to create fully responsive websites in seconds, simply by entering a few details about their business or organization. The generator outputs a clean, editable base directly in Sitejet Builder, complete with content and structure tailored to the business type.
The tool doesn’t aim to replace professional design or copywriting but rather accelerates the initial setup: producing a valid skeleton with layouts, fonts, and color palettes ready for customization. For SMBs, internal projects, or quick landing pages, this is a major time saver.
Platform support: AlmaLinux 10, ELS for Ubuntu 20.04, and mail password hashing
On the systems side, Plesk for Linux introduces two major updates:
- Support for AlmaLinux 10. New deployments on AlmaLinux are now recommended to start with this version. Several extensions have already updated compatibility (Firewall 2.2.10, DNSSEC, etc.).
- Extended Lifecycle Support (ELS) for Ubuntu 20.04 until December 31, 2027. Even though the vendor EOL was April 2025, Plesk will continue updates and support until the specified date. Running EOL systems incurs extra costs, and migration or upgrades are strongly recommended.
Additionally, Plesk now offers hashing for mail account passwords (instead of symmetric encryption). Only new passwords created after enabling this feature are hashed. To enforce the policy in the interface, add the following to panel.ini:
[passwordManagement]
features.allowEmailPasswordHashing = false
Code language: JavaScript (javascript)Plesk also provides instructions to rehash existing passwords for full consistency.
Jodit replaces SPAW in File Manager (BETA)
The File Manager now includes the Jodit WYSIWYG editor, replacing SPAW. Jodit enables full-page editing with a broader set of formatting and styling tools. The integrated version is considered BETA due to some known limitations, which Plesk promises to resolve in upcoming releases.
Feature improvements: HTTP/3 switch, accessibility, and PHP 8.4 by default
Some notable usability enhancements include:
- HTTP/3: Plesk for Linux now allows enabling/disabling HTTP/3 server-wide via Tools & Settings > Apache & Nginx Settings.
- Accessibility: Several pages now support screen readers with semantic HTML and ARIA attributes.
- PHP 8.4: Added to the Recommended preset and set as the default version for Service Plans. PHP 8.1 is no longer recommended (but remains available).
- Laravel Toolkit: Customer users now see a progress window when deploying apps.
- Alibaba Cloud images: Now run on Ubuntu 24 (previously Ubuntu 22).
- Admin aliases: Can now be backed up, restored, and migrated.
On Windows, Plesk now supports in-place upgrades from Windows Server 2019 to 2025, with the usual advice: take a snapshot before proceeding.
Goodbye UserVoice, hello Productboard
Plesk confirmed the deprecation of UserVoice by October 2025. Feature requests and feedback will move to Plesk Productboard (features.plesk.com), offering a more transparent roadmap with public voting and prioritization.
Bug fixes: HTTP/3, PostgreSQL monitoring, Docker, and more
Obsidian 18.0.72 ships with an extensive set of fixes. Examples include:
- Skins and Color Schemes now work again after deprecated methods were removed.
- Fixed session expiration errors while editing files.
- Node.js™: 404 issues caused by custom environment variables were resolved.
- Watchdog now correctly monitors PostgreSQL® again.
- Fixed “Forbidden – origin invalid” errors in Docker Standalone with Portainer.
On Linux:
- Fixed 421 “Misdirected Request” errors after CVE-2025-23048 hotfix.
- Dropbox scheduled backups can now be enabled by customers.
- Fixed
filemngerrors when moving domains. - Fixed broken HTTP/3 connections in nginx with multiple workers and no default IPv4 domain.
- Removed false
sw-tarwarnings during repair operations.
On Windows:
- Installation issues with Plesk 18.0.67 are resolved.
- Large backups now restore much faster.
Update 1 (August 26, 2025): four urgent Linux fixes
Update 1 was quickly released with critical fixes:
- Fixed HTTP 500 when accessing Apache & Nginx Settings after upgrading (PPPM-15083).
- Fixed swap not enabled on Ubuntu/Debian installations (PPP-69252).
- Fixed DNSSEC signing on AlmaLinux 10 servers (PPP-69253).
- Fixed infinite redirect loops when certain WordPress plugins were installed on sites set as default for an IP (PPPM-15085).
For production environments, this update is strongly recommended.
WP Toolkit 6.8.0: native plugin and instant vulnerability mitigation
WP Toolkit 6.8.0 (August 21, 2025) introduces its own WordPress plugin, bringing part of WP Toolkit functionality into the wp-admin dashboard. Currently, it provides vulnerability information and —most importantly— detects themes/plugins installed directly in WordPress, applying mitigation strategies immediately, without waiting for the next scheduled check.
To enable auto-installation of the plugin on all new sites, add the following line to panel.ini (Plesk) or config.ini (cPanel):
installIntegrationPluginToNewSites = true
Code language: JavaScript (javascript)To fully enable the GUI and events:
integrationPluginApi = true
integrationPluginUiModuleEnabled = true
integrationPluginEventModuleEnabled = true
Code language: JavaScript (javascript)Requirements: WP Toolkit 6.8 requires Plesk ≥ 18.0.61. WP Toolkit 6.7.4 is the last version to support older Plesk versions.
Other improvements:
- WP Toolkit now shows how many exploit attempts were blocked by Vulnerability Protection.
- Reorganized site card controls for a clearer interface.
- Added AlmaLinux 10 support.
- Added support for upcoming temporary domains in cPanel.
Migrator, Firewall, Sitejet Builder, and SSL It! updates
- Plesk Migrator 2.30.0 adds migration of extra admin profiles, avoids regenerating DKIM keys, and fixes issues with cPanel + MariaDB 11.4, special characters in passwords, CNAME mail records, IPv6 zones, MariaDB errors, and more.
- Firewall 2.2.9 / 2.2.10 adds reboot warnings for kernel updates, improves CLI error reporting, and fixes installation on AlmaLinux 10.
- Sitejet Builder 1.3.0 / 1.3.1 adds the AI-powered site generator and fixes domain card AI button issues.
- SSL It! 1.18.4 resolves PHP 8.4 compatibility issues and fixes DANE secure failures on IDN domains.
Updated components: PostgreSQL 17.5, Node.js 22.17.1, Ruby 3.4, and more
- Linux: ModSecurity 2.9.12, mariadb-connector-odbc 3.2.6, PEAR Archive_Tar 1.6.0, libwebp 1.6.0, PostgreSQL 17.5, Sophos 3.95.0, Go 1.24.5, Xdebug 3.4.5.
- Windows: ModSecurity 2.9.12, PHP 8.4.11 for plesk-engine, SQLite 3.50.3, Git 2.50.1, MailEnable 10.53, Node.js 22.17.1 (default version, Node.js 18 removed), Dr.Web 12.0.1.
- Ruby 1.6.0: supports Ruby 3.4.5, 3.3.9, and 3.2.9, while removing outdated Ruby 3.2.2.
Practical recommendations for admins
- Apply Update 1 if already on 18.0.72 — it fixes critical Apache/nginx, swap, DNSSEC, and WordPress issues.
- Plan for PHP 8.4 adoption and test applications accordingly.
- Consider enabling mail password hashing for stronger security.
- Configure auto-install of WP Toolkit plugin to close vulnerability windows.
- Standardize new deployments on AlmaLinux 10. If running Ubuntu 20.04 ELS, plan a migration roadmap.
- Use the HTTP/3 global toggle to test and roll back if needed.
Conclusion
Plesk Obsidian 18.0.72 blends new features —like AI-powered site creation— with essential operational and security improvements. With Update 1 addressing critical issues, and WP Toolkit 6.8.0 bringing proactive protection directly into WordPress, the platform is now more robust for 2025.
For providers and sysadmins, the focus is clear: adopt selectively, patch immediately, and plan migrations carefully. With this balance, Plesk remains a strong, modern control panel option heading into 2026.
FAQs
1. How can I auto-install the new WP Toolkit plugin on every WordPress site?
Add installIntegrationPluginToNewSites = true in panel.ini (Plesk) or config.ini (cPanel). To enable the UI, also set:
integrationPluginApi = true
integrationPluginUiModuleEnabled = true
integrationPluginEventModuleEnabled = true
Code language: JavaScript (javascript)2. Where do I enable or disable HTTP/3 server-wide in Plesk for Linux?
In Tools & Settings > Apache & Nginx Settings, there’s now a global checkbox for HTTP/3 support.
3. What changes when enabling mail password hashing?
New mail account passwords will be hashed instead of symmetrically encrypted. Old passwords remain encrypted until rehashed. To lock the policy in place, add:
[passwordManagement]
features.allowEmailPasswordHashing = false
Code language: JavaScript (javascript)4. Should I rely on Ubuntu 20.04 ELS or upgrade?
ELS offers support until December 31, 2027, but incurs extra cost. It’s a stopgap, not a long-term solution. Migrating to Ubuntu 24 or AlmaLinux 10 is recommended.
