Arahoster Ultimate Suite for WHMCS — Changelog (Release Notes)

18 min read 352 views

What changed in each version of Arahoster Ultimate Suite for WHMCS (formerly Arahoster AI Ultimate Tools). To upgrade, use Updates → Update now inside the module (one click, with an automatic backup), or download the latest version from your client area and upload it over the old files: your licence key and settings stay. The full guide is in Installation, Setup & How It Works, and every tool is explained in the Feature Guide.

Version 1.5.14 — 26 October 2026

Added

  • Arabic, Spanish and Norwegian everywhere: the whole module is now translated into Arabic, Spanish and Norwegian (Bokmål, new), about 7,500 texts per language, including every page added since 1.4.1, confirmation pop-ups, buttons and messages built in JavaScript, client pages and client e-mails. Every translation was reviewed so each language uses one term per concept.
  • Language menu at the top of every page: English, العربية, Español, Norsk and the other languages, plus "Automatic (WHMCS language)". Each admin's choice is saved for them; Arabic pages are shown right-to-left.
  • Payment Gateway Fees: while fees are on, the page warns about every active payment method that has no fee rule, because invoices paid with it get no fee. A 0% rule marks a method as intentionally free.

Fixed

  • "Licence server unreachable" although the server was up: the module now identifies itself on every request to the Arahoster licence and update server, so firewalls in front of it no longer refuse those requests.

Version 1.5.13 — 21 October 2026

Added

  • Working hours per department: in Department Config, every department now has its own working hours for the Human Support Agent. Choose the agent's general hours (the default, so nothing changes), open around the clock (24/7), or only on chosen days between two times in a chosen time zone. A shift whose end is earlier than its start runs overnight. Each department card shows its hours.
  • The agent follows them: a reply is scheduled inside the department's next opening time, and a reply that becomes due while the department is closed is not posted but moved to the next opening. A ticket moved to another department follows the new department's hours. "Post now" by an admin still posts at once.

Changed

  • General business hours: the agent's general business hours now also apply when a reply is posted, not only when it is scheduled.

Version 1.5.12 — 21 October 2026

Added

  • No gateway fees where the law forbids them: Payment Gateway Fees has a new Excluded countries list. Clients whose country is on the list never get a gateway fee on their invoices and do not see the fee notice. The list starts with the EU and EEA countries and the United Kingdom, where surcharges on consumer card and bank payments are not allowed. You can edit it (two-letter country codes), and the Use the EU / EEA / UK list link fills it in again.

Changed

  • Active right after the update: installs that have not saved a country list yet use the EU / EEA / UK list straight away. Clients without a country on their profile are not excluded.

Version 1.5.11 — 20 October 2026

Added

  • WHMCS 9.1 ready: the suite now detects WHMCS Invoice Immutability (the protection of issued invoices in WHMCS 9, and the Invoice Immutability setting under General Settings → Invoices in WHMCS 9.1) and adapts its billing tools automatically.
  • Late Fee Manager: while issued invoices cannot be changed, no fee is added and the cron run stops at the first refusal instead of retrying every invoice. The page and the Activity Log explain that you can use the WHMCS late fees or change the setting. To undo an applied fee, use a credit note.
  • Payment gateway fees: the fee is added when the invoice is created or while it is a Draft. An issued invoice keeps its fee when the client switches payment method, without logging an error on every change. "Recalculate" reports how many invoices were left unchanged.
  • Consolidated billing: "merge same-day invoices" is unavailable while issued invoices are protected, so WHMCS's protection is always respected. Aligning billing days still works.
  • Health Check: shows the detected Invoice Immutability mode and which enabled tools it affects. A refusal is written to the Activity Log once per tool per day.

Changed

  • Requirements: WHMCS 9.0 and 9.1 and PHP 8.4 are supported. Note that WHMCS 9.1 itself needs PHP 8.2 or newer and ionCube Loader 15.

Fixed

  • PHP 8.4: CSV exports and the bank statement import no longer cause PHP 8.4 deprecation notices. The files themselves are unchanged.

Version 1.5.10 — 19 October 2026

Changed

  • Login Guard: new installs now e-mail clients only when they sign in from a new device or browser (instead of on every login). Installs that already saved a mode keep it.

Fixed

  • Updates page: the "Current / Latest / Last checked" line on the green banner is now white and easy to read.
  • Requirements: the documentation now states the correct minimum, PHP 8.1 or newer (8.3 recommended).

Version 1.5.9 — 19 October 2026

Fixed

  • Newer AI models: newer Claude, GPT and Gemini models could return an empty answer on short replies, which showed as "The model used all its output tokens before answering", "analysis did not return valid JSON" or a ticket handed to staff for no reason. Answers are now requested so they arrive reliably, and an answer cut off before any text is retried once with a larger budget.
  • Human Support Agent: the quality review has more room for its answer.

Version 1.5.8 — 19 October 2026

Added

  • Human Support Agent finds documentation in any language: before analysing a ticket, the agent writes short English search words for it and searches your Knowledgebase and Training Data with them first. A question in Arabic, or one using another name for a product, now finds the right English article. This adds one small AI call per reply.
  • Training Data knows your products: when a question names one of your Training Data categories, answers from that category rank first, and a row in that category tagged pinned (for example a short "product facts" card) is always included.

Changed

  • More context for the Human Support Agent: it now reads up to eight knowledge results and as many Training Data answers, so product documentation fits next to your Knowledgebase.

Fixed

  • Better knowledge search without embeddings: with Anthropic or DeepSeek as the active provider, the AI Brain now ranks every matching article and Training Data answer by how well it matches the question, understands Arabic and ignores common words. Live chat, the pre-ticket assistant, reply suggestions, approvals and the Human Support Agent all benefit.
  • Human Support Agent: long technical tickets no longer end with "analysis did not return valid JSON".

Version 1.5.7 — 17 October 2026

Added

  • Every model your AI account can use: Settings → AI Provider now asks each provider with an API key (Anthropic, OpenAI, Google Gemini, DeepSeek) which models your key can use, once a day and when you press Save & refresh model lists. New models appear the day they are released, without a module update.
  • Type any model ID: an optional field next to each model list accepts any model ID.
  • Latest models with prices: the newest Claude, GPT, Gemini and DeepSeek models are listed with their price per 1M tokens, and cost tracking uses these prices. Models found on your account are added to the Model Advisor catalog.

Changed

  • Retired models keep working: when a saved model has been shut down by its provider, calls go to its successor automatically and Settings shows a notice. New installs default to current models.
  • Newer OpenAI models are called through OpenAI's Responses API; older GPT-4 and GPT-3.5 models work as before.
  • Model Advisor: recommendations and the catalog follow the current models. Catalog rows you edited are never changed.

Fixed

  • AI answers: answers from newer Claude and Gemini models that start with a "thinking" part are read correctly, and an answer cut off by the token limit now tells you to raise "Max tokens".
  • Gemini embeddings: AI Brain search uses Google's current embedding model, as the old one was shut down.

Version 1.5.6 — 17 October 2026

Added

  • Clients choose how long a device is remembered: under Account Security in the client area, clients pick how many days a device stays trusted after a correct e-mailed sign-in code, and can forget all remembered devices with one click. You set the longest allowed period under Account Security → Login & PIN (default 90 days).

Changed

  • Fewer false "new device" alerts: a browser confirmed with a sign-in code before is no longer reported as new only because the client's IP address changed.

Version 1.5.5 — 17 October 2026

Added

  • Feedback & Ideas: send Arahoster a feature request, a bug report or general feedback from inside the suite (Operations & Admin, every plan), and follow each message's status and our reply. Technical info is attached only when you tick the box, and no data about your clients is ever sent. Messages written while our server cannot be reached are sent automatically later.

Version 1.5.4 — 15 October 2026

Security

  • Licence and server clock: a server clock that is behind is now reported clearly on the License page ("Your server clock is behind by N minutes"). Correct the clock (NTP) and check again.
  • First licence check after the update: if the licence server cannot be reached right after updating and your licence was active before, paid features stay on for up to 72 hours while the check is retried every hour.
  • Signed licence and updates: the saved licence can no longer be edited, and one-click updates only install packages carrying Arahoster's release signature, downloaded over HTTPS. After the update the module checks the licence once; until it reaches the server, only the Free tools are available.
  • More actions need a Full Administrator: bulk messaging, chatbot and auto-reply content, bulk ticket actions, billing and gateway changes, unbanning IPs, dismissing security alerts and Server Health settings.
  • Ticket tools follow WHMCS support departments: other roles can only work on tickets in the departments assigned to them.
  • Account security hardening: confirmation codes and approval links are no longer kept in the client's e-mail history; changing the account e-mail, turning off sign-in codes or changing the IP allow-list needs a confirmation code; sign-in codes fail safe; "Sign out everywhere" also ends older sessions and saved logins. Client IP allow-lists accept IPv6 ranges.
  • Domain protection: now also covers bulk domain changes, child nameservers, DNS records and e-mail forwarding.
  • Refund limit: the admin refund limit also applies to full refunds with a blank amount.
  • Stricter IP protection: admin IPs are no longer broadly exempt from bans, IPv6 addresses are handled per network, and a new short sign-in pause protects an account after many wrong passwords (Brute Force page).
  • HTTPS-only lookups: country and VPN lookups and Fixer exchange rates use HTTPS only. Free Fixer plans show a clear message; choose ECB or ExchangeRate-API instead. A new strict mode can block sign-ins and orders when the country cannot be found.
  • File Integrity Monitor: also checks the template compile folder for unexpected scripts.
  • Ticket attachments: scripts, server configuration files and web pages are always refused, and a file the virus scanner cannot finish checking is refused.
  • Safer automatic AI replies: replies that reach customers without review are checked by fixed rules first (outside links, requests for passwords or card numbers, promises of refunds or cancellations) and go to staff when they match. Automatic replies need at least 70% confidence and are never posted on refund, cancellation, legal or security topics.
  • AI budget and privacy: Voice-to-Text respects the AI budget and per-client daily limits; new installs start with a monthly token limit and an hourly limit for visitor AI answers; staff-only fields, card, IBAN and social security numbers are kept out of AI requests; past ticket answers in the AI index are anonymised and rebuilt.
  • Published content: AI-written blog posts, landing pages and cart-recovery e-mails are cleaned before publishing; review auto-moderation only publishes clearly approved reviews without links.
  • Database backups: backups can only be read by the PHP user and can be encrypted by adding ARAHOSTER_BACKUP_KEY (base64 of 32 random bytes) to WHMCS's configuration.php. The page warns when the backup folder is inside the WHMCS folder.
  • Verified backups and log clean-up: the Backup Verifier only counts real backup files; log clean-up and Auto-Pruning need a verified backup from the last 24 hours and keep activity, audit and security logs for at least 30 days. Old AI conversations can now be cleaned up too.
  • New option: "Remove all data on deactivation" in Setup → Addon Modules → Configure (off by default).
  • CAPTCHA: tokens solved on another website are refused, and a new option refuses forms while the CAPTCHA service is down (off by default).
  • Protection continues if the licence lapses: account security features you switched on keep running; their settings stay locked until you renew, and admins get one e-mail.
  • WhatsApp and Messenger: incoming messages are only accepted with a valid signature, so the Meta App Secret must be saved on the Multi-Channel page.
  • Other hardening: API keys are no longer sent in web addresses, Chart.js loads from your own server, webhook secrets are stored encrypted, and module pages refuse to run outside WHMCS.

Version 1.5.3 — 14 October 2026

Security

  • AI chat no longer uses other customers' tickets: live chat, the pre-ticket assistant and customer replies answer only from your knowledgebase, products, blog and announcements. If you choose to index past tickets, sensitive data is removed first and they are only used for answers shown to staff.
  • Sensitive actions need a Full Administrator: main Settings, the licence, backups, role permissions, API keys, security controls, refunds settings, affiliate payouts, price changes, billing tools and publishing content. Only the built-in Full Administrator role counts; a custom role with the same name does not. Refunds also need WHMCS's "Refund Invoice Payments" permission.
  • Database Manager data viewer: Full Administrators only, and it hides more sensitive settings.
  • Secrets are encrypted in the database: API keys, tokens and secrets are stored encrypted and no longer shown back in forms (leave a field blank to keep it). Existing values are converted automatically.
  • E-mail protection: customer-provided text is neutralised before it reaches WHMCS e-mail templates.
  • Stronger sign-in codes: at least 6 digits, wrong attempts are limited, and trusted devices are remembered with a secure cookie.
  • WHMCS 8 users: account security settings can only be changed by the account owner, and invited users never receive the owner's sign-in code.
  • Outbound requests (webhooks, SEO audit, site checks) only go to public internet addresses.
  • Referral and affiliate rewards: deposits, mass-payment invoices and credit payments no longer count; referral credit is added after a holding period (default 30 days); refunded invoices void commissions; suspicious referrals are held for review.
  • Account takeover detection can no longer be used to lock another customer out.
  • Smaller hardening: safer previews, spreadsheet formula protection in CSV exports, and stricter checks on update links and form submissions.

Version 1.5.2 — 13 October 2026

Changed

  • ionCube-encoded package: same features and settings as 1.5.1. Your server needs the free ionCube Loader (PHP 8.1 – 8.5). Language files and templates stay readable.

Version 1.5.1 — 12 October 2026

Changed

  • All settings in one place: the AI provider, API keys, models, prompt, token limits and the three master switches now live on the module's own Settings page (master switches under Main features). The WHMCS Configure dialog only holds role access.
  • Automatic move: existing values are moved to the Settings page on the first admin page load after the update. Nothing to do by hand.

Version 1.5.0 — 12 October 2026

Added

  • One-click updates: Updates → Update now installs a new release directly, with no FTP or unzipping. Available for every valid licence and installed only by a Full Administrator.
  • Safe by design: the download is verified before anything is touched, the current version is backed up first (last 3 kept) and restored automatically if anything fails. Backups can be restored from the same page. Settings, data and your own translation files are never touched.
  • Server check first: the page checks that your server can update (zip, curl and sodium extensions, write access, disk space) and otherwise offers the manual download. Every install and restore is logged.

Version 1.4.1 — 12 October 2026

Added

  • Languages: English, Arabic, Turkish, Spanish, German, French, Portuguese and Russian are built in. Admin pages follow each admin's WHMCS language (or one language chosen under Settings → Interface language) and Arabic is shown right-to-left. Client-area pages, sign-in and confirmation screens, notices and client e-mails follow the language each client chose. Translations are editable files in the lang folder; anything missing falls back to English.

Version 1.4.0 — 11 October 2026

New name

  • Arahoster AI Ultimate Tools is now Arahoster Ultimate Suite for WHMCS. Upgrade by uploading over the old files: the module folder, your licence key and all settings stay the same.

Added

  • Database Manager: table sizes and growth, a database health score, a data viewer that masks passwords and card data, log cleanup with retention rules (tbllog_register, activity, module, gateway, e-mail and other log tables), optimize, InnoDB and utf8mb4 conversion,, verified backups, and leftover tables of removed or inactive addons (archived with one-click restore, deletable after 7 days). Every change needs a recent verified backup, a dry run and a typed confirmation.
  • Bulk client deletion: shows the exact list first; clients with active services or domains, credit, payments or open tickets are always left out.
  • WhatsApp Notifications: invoice created, payment received, renewal reminder, suspension, ticket reply and quota alerts as approved WhatsApp templates, with client opt-in, quiet hours, retries and read receipts.
  • Monthly Statements: a PDF statement of account per client and month, e-mailed on your chosen day and downloadable in the client area.
  • Consolidated Monthly Invoice: one invoice a month per client, moving services to one billing date with pro-rata; preview and undo.
  • Payment Gateway Fees: a fee or discount per payment method and currency (percentage, fixed or both, min/max, gross-up), shown before the client pays. Imports existing rules from Arahoster Gateway Fee Manager.
  • Expense Manager: recurring costs in any currency, real profit per product, server and client, and domain margins per TLD.
  • AI Command Center: Copilot for questions about your business from live data, weekly management briefings (daily on Enterprise), staff coaching (Enterprise) and an AI writer for product descriptions and FAQs.
  • Account Security: login PIN for every client, passkeys, breached-password check and password rules, client sessions, e-mail change confirmation, domain theft protection, card-testing protection, safe ticket attachments, admin IP allow-list and password confirmation, lockdown and a client security score.
  • Security Monitor: a security score with 45+ hardening checks, WHMCS file integrity monitoring with backdoor detection, change watch for admins, gateways, API credentials and settings, alerts and a weekly security report.
  • Staff Clock In / Out: hours, breaks and response times per staff member.
  • Hide Old Services, Service Renewal Notices, Hosting Quota Alerts (80/90/100 %), Verify E-mail Before Activation and Payment Gateways by Country.
  • Payment Reminders: exclude chosen clients or client groups.
  • The dashboard shows your installed version with Up to date or Update to vX.

Changed

  • Every new tool is installed switched off: nothing e-mails clients, charges money or changes data until you turn it on.

Security

  • While the sign-in code is pending, only the code page and sign-out can be opened.
  • The client security settings form is protected against cross-site requests.
  • The module detects changed program files and then runs on the Free tools only, with the changed files listed on the License page.

Version 1.3.0 — 10 October 2026

Added

  • Human Support Agent: replies to tickets as your chosen staff user 15–45 minutes after the customer writes, after reading the thread, the client's services and invoices, and running read-only checks on the client's cPanel account (status, disk, DNS, SSL, site reachability, error logs). Replies in the customer's language, with a second review pass for accuracy and tone.
  • Hands refunds, cancellations, disputes, legal/abuse, security incidents, discount requests, angry customers and "talk to a human" requests to your team with a private note and suggested draft. Off, Review and Auto modes, plus a dry-run tester.

Fixed

  • "Security token mismatch" when saving admin forms on some WHMCS installs.
  • Upgrades now create new database tables automatically.

Version 1.2.0 — 10 October 2026

Full audit and rebuild of all 130 tools on WHMCS 9.

Fixed

  • Promo Codes, Newsletter Builder and Pricing Optimizer pages no longer fail to load.
  • Corrected ticket, knowledgebase, invoice and order fields across support, billing and optimization tools, so trackers, SLA, assignment, KB publishing and reports now show real data.
  • Settings forms that did not save (security, billing, optimization) now save correctly, and toggles can be switched off.
  • Tools that only showed "sent" or "queued" now really send: payment reminders, dunning, CSAT surveys, cart recovery, win-back, upsell offers and suspended-service recovery.
  • Client 2FA, login history and new-device alerts now run on WHMCS 8/9 login hooks.

Added

  • Live chat hand-off to staff with an agent console and Co-Pilot drafts.
  • AI assistant panel inside the WHMCS ticket view.
  • Security enforcement engine: IP rules, brute-force bans, CAPTCHA, VPN/geo checks, fraud scoring on checkout and session kill.
  • Real engines for refunds, bank reconciliation, late fees, partial payments, FX sync with change guard and VAT (VIES).
  • Consent-checked marketing with one-click unsubscribe, affiliates, referrals, reviews, A/B tracking, landing pages, SMS and social posting.
  • Safe destructive tools: minimum retention, dry run, typed confirmation and a 30-day restore archive.

Security

  • Real per-session CSRF tokens and enforced role-based access.
  • API keys are no longer printed in admin pages; webhook URLs are validated.
  • New automations ship disabled and never act on old data.

Version 1.1.0 — 23 July 2026

  • Maintenance release: automated tests for the AI providers, the security engine and the plan recommender.

Version 1.0.0 — 15 May 2026

  • Initial release: AI support and tickets, AI Brain and livechat, security and fraud, growth and marketing, optimization, billing and finance, and operations tools.
Was this answer helpful?