New The dashboard is customizable: drag and resize tiles, add or remove widgets, and reset to the default layout. Layouts are saved per user (existing ones migrate automatically and are included in backups); editing needs a viewport of 992 px or more.
New Peers not seen for a configurable number of months (Settings → WireGuard, default 6) show an orange Stale badge that clears once the peer reappears.
Fix The dashboard and other pages no longer end in a doubled bottom gap or scroll past their last card on desktop (the footer and the page bottom spacing were reserved twice), and edited stylesheets/scripts are now revalidated instead of being served stale from the browser cache.
Fix Node traffic metrics are delivered reliably, with no gaps or double-counting after partial writes; country, ASN and DNS trend totals no longer skew after transient storage errors.
Fix Long-range traffic, DNS trend and country/ASN charts now cover the full requested window instead of being cut short at the time-series query limit.
Fix DNS log-retention changes (including 0 days) apply to the running resolver within seconds, global allow rules consistently override client-specific blocks, and a crashed ingestion writer no longer hangs.
Fix GeoIP lookups no longer hang after a cancellation or a stalled system resolver.
Fix Node enrollment against an IPv6 master address, importing an existing WireGuard keypair for a new peer, and peer config/QR downloads using the interface DNS (ad-blocker off) work again.
Fix Backup restore rejects archives with foreign-key violations, and a failed node deletion is now flagged so it can be retried.
Fix Dates, times and certificate expiry on the Users and Settings pages are shown in your browser's locale and time zone.
Security New opt-in WIREBUDDY_REQUIRE_HTTPS_AUTH rejects password logins and node authentication over plaintext HTTP (loopback exempt).
Security The client IP behind a reverse proxy is resolved via X-Forwarded-For against WIREBUDDY_TRUSTED_PROXIES, so a spoofed header can no longer influence login lockout, MFA binding or auditing.
Security The first-boot admin password is no longer logged; it is printed once to the console (stdout) and never stored in a file.
Security Peer enable/disable/migrate and client isolation now fail closed: if a change cannot be applied to the live interface or firewall, the request fails and the stored state is rolled back.
Security Regenerating a node's token now fully re-enrolls it: the old tunnel peer is removed from the live interface and config, stale control commands are purged, and the node's event stream is closed.
Security Rate limiting is counted before authentication and IPv6 clients share one counter per /64; Unbound now runs from fixed absolute paths with locked-down config permissions.
Fix Deleting a WireGuard interface works again when nodes were provisioned for it, and a failed database delete no longer removes its config file.
Fix Interface changes and peer config/QR-code downloads no longer block other requests.
Fix Settings stored as true/yes/on are now recognised everywhere, so features can no longer appear enabled without running.
Fix Passphrases longer than 72 bytes are accepted again.
Fix Expired passkey sign-in challenges are now cleaned up hourly.
Fix Switching tabs no longer cancels a running speed test, and after a restore the page keeps waiting for the restart even if the server briefly answers with an error.
Fix OTP setup no longer hangs on "Verifying…" when the network stalls and now explains why a code was rejected; the password-change notice is styled correctly again under the strict CSP.
Fix UI: the DNS query log is visible on mobile again, the traffic page shows "no data" instead of hanging, error messages on sign-in and setup pages are visible again, the two-factor step offers "Back to sign in", and signed-in users opening / or the login page land on the dashboard.
Fix Accessibility and polish: charts have text alternatives for screen readers, auth pages honour "reduce motion", info cards no longer lift on hover, dashboard cards no longer show a hard-edged shadow in light mode, and non-admins are no longer pointed to admin-only buttons.
FixServe GUI over HTTPS now works in Docker: the container starts the built-in TLS listener after a restart instead of staying on plain HTTP and rejecting every login. If no certificate can be prepared, WireBuddy refuses to start rather than falling back to HTTP. An invalid ACME listener port, or one equal to the GUI port, now only disables that listener.
Fix Let's Encrypt certificates can be requested again: since 1.6.1 every certificate, account-key and challenge file write failed.
Fix The container health check probes /ready on the transport the container actually started with (HTTP or HTTPS, any port), so a broken database, scheduler or DNS ingestion marks it unhealthy.
Security The Compose file no longer ships a built-in WIREBUDDY_SECRET_KEY and refuses to start until one is set in .env. If you used the old Compose file unchanged, put its previous key value into .env (otherwise existing encrypted data cannot be read), or start fresh with a new key.
Security Sessions now end when MFA is switched on (except the current browser), when passkeys are reset or disabled, and when an account is deactivated.
Security TOTP codes are single-use, and OTP setup can no longer be re-run or confirmed twice on an account that already has MFA.
Security A pending mandatory password change is now enforced server-side (428 for the API, redirect for UI pages).
Security Interface deletion reports and later removes a leftover private key; PostUp/PostDown hooks are limited to 2048 bytes of printable ASCII.
New A single WIREBUDDY_PUBLIC_ORIGIN setting now configures CSRF origins, passkeys, the Host-header allowlist and secure cookies/HSTS. WIREBUDDY_TRUSTED_PROXIES replaces TRUSTED_PROXY_CIDRS, WIREBUDDY_STATUS_TRUSTED_PROXY_CIDRS, FORWARDED_ALLOW_IPS and WIREBUDDY_TRUST_PROXY_HEADERS; update your configuration when upgrading, as the old variables are now silently ignored.
NewWIREBUDDY_SKIP_APPLICATION_LOCK allows running on filesystems without flock support.
New WireBuddy is now released under the MIT License (previously AGPL-3.0).
Fix Improved reliability of multi-node WireGuard operation: config changes across interfaces roll back together on failure, nodes always re-sync fully after a restart, and enrollment credentials survive a failed shutdown.
Fix Improved DNS robustness: query logging no longer drops entries under load, client-specific block rules are now counted correctly, and the resolver's own DNS setup is applied and restored more reliably.
Fix Per-interface "show on dashboard" visibility is honored again; it previously crashed the network statistics API.
Fix Shutdown no longer lets a slow WireGuard stop phase stall the DNS service stop and metrics save that follow it.
Fix Let's Encrypt HTTP-01 challenge files are reliably cleaned up, and deleting a certificate can no longer collide with a running issuance or renewal.
Fix A malformed Origin/Referer header now results in a 403 instead of a server error, and opening the login page in several tabs no longer invalidates the others' CSRF token.
Fix Peers can no longer end up assigned to both a single node and to all nodes at once, including when created.
Fix Speed tests against a slow-resolving host no longer strand background DNS-lookup threads.
Security Startup now fails if required system binaries (ip, wg, wg-quick, sysctl, iptables, ip6tables) are only found via PATH instead of a trusted, fixed location, closing a path where a compromised PATH could substitute a malicious binary run as root.
Security The public status page and node mTLS fingerprint header only trust forwarded headers from configured proxies, and CSRF origin validation is stricter (http/https only, no bearer+cookie bypass).
New Built-in HTTPS for the GUI with automatic self-signed certificates and Let's Encrypt support, including HTTP-01 validation and HTTP-to-HTTPS redirects.
Fix Backups now use a consistent database snapshot, and backup/restore operations no longer release their lock while work is still running.
Fix WireGuard, DNS, and speed-test operations recover more reliably from failures and timeouts, avoiding orphaned processes, partial network state, and stalled updates.
Fix Fixed concurrent password/passkey updates and improved the reliability of login, MFA, and passkey setup flows, including mobile OTP autofill.
Fix Corrected network-history range handling and multi-worker statistics/rate-limit behavior.
Security HTTPS can now be enforced for logins and node enrollment, with secure session cookies when enabled.
Security WireGuard hook validation blocks shell injection and other privileged command pivots.
Security Node deletion revokes live WireGuard access before removing the node; interface isolation is retained until shutdown succeeds.
New Bootstrap password is now auto-generated on first start and printed to the container log — the WIREBUDDY_BOOTSTRAP_ADMIN_PASSWORD environment variable has been removed
New First login, and any admin-initiated password reset, now forces a mandatory password change before continuing
Fix Redesigned password change screen that reliably validates strength and submits
Fix Peer list "Last Seen" no longer flickers, and DNS service controls (Start/Restart/Stop) are no longer stuck greyed out
Fix Readiness probes (/ready) are no longer rate limited, and startup/access logs are much quieter
Security Hardened user accounts and OTP recovery codes: brute-force rate limits on user management, recovery codes only via a one-time secure download, and no password hashes or recovery codes in API responses
Security Optional stale-interface cleanup now only removes WireGuard interfaces managed by WireBuddy
New Backups now include your full configuration (interfaces, peers, users, settings); restoring a backup brings back a working setup instead of an empty first-run database
New Backups can optionally export metrics history with a configurable time range from the last 7 days up to 1 year
Fix Speed test scheduling and result recording fixed: nodes run at most one scheduled test per day and failed measurements are no longer stored as valid results
Fix Live progress (SSE) and per-IP rate limiting corrected for edge cases
Security CSRF referer validation hardened; login protection now also throttles repeated failed attempts per username across changing IP addresses