Open sourceIn the free reqad package (GPL-3.0).

Command line (CLI)

Every Reqad install ships a reqad command that creates, changes and removes hosting accounts, databases and mailboxes from a shell or a script. It runs the same code as the panel, so an account created on the command line is indistinguishable from one created in the browser - same vhost, same PHP-FPM pool, same mail and DNS setup.

Commands

Every command has its own help:

reqad --help
reqad account --help
reqad db --help
reqad email --help
reqad auth --help
reqad health --help
reqad api --help
reqad mcp --help
reqad deploy --help
reqad app --help
reqad backup --help
reqad stats --help
reqad logs --help
reqad resources --help

Not seeing account, db or email in reqad --help? Update the panel with dnf update reqad.

Hosting accounts

reqad account list
reqad account show   <user>
reqad account create <user> <domain>
                     [--www] [--email] [--dns] [--letsencrypt] [--quota=MB]
reqad account edit   <user>
                     [--password] [--php=VERSION[:fpm|mod_php]] [--email=on|off]
reqad account delete <user> [--yes]

Create an account for a domain, with mail, the www. alias, a DNS zone at your configured provider and a Let's Encrypt certificate:

reqad account create bob example.com --www --email --dns --letsencrypt

The account is created with the server's default PHP version. Switch it later - and on Apache also choose the handler:

reqad account edit bob --php=8.3
reqad account edit bob --php=8.2:mod_php
reqad account edit bob --email=off

reqad account list prints one row per account:

┌──────┬──────┬──────────────────┬───────┬────────┬─────────────────────┐
│  UID │ USER │ DOMAIN           │ EMAIL │ STATUS │ CREATED             │
├──────┼──────┼──────────────────┼───────┼────────┼─────────────────────┤
│ 1041 │ bob  │ example.com      │ yes   │ active │ 2026-09-14 11:20:07 │
│ 1042 │ shop │ shop.example.net │ no    │ active │ 2026-09-18 09:02:55 │
└──────┴──────┴──────────────────┴───────┴────────┴─────────────────────┘

reqad account show adds the account's PHP version and handler, disk usage and quota, shell access, its mailboxes and databases, and its limits: CPU, memory and processes for SSH, cron and the web terminal, and database connections per database user. reqad account limits <user> shows what is in use right now and recent limit hits.

reqad account perms bob checks the owners and permissions of everything in the account's home: files owned by another user or by root (often copied in as root), groups other than the account's or the web server's, files anyone can write to, setuid files, wp-config.php and .env files anyone can read, and the modes of ~/.ssh. It exits 0 when everything is fine and 3 when it found problems. --fix repairs them and sets the account's top folders and PHP pool by the panel's permissions model; it first writes an undo script to /var/lib/reqad/perms-restore-bob-<time>.sh. --keep-root leaves files owned by root as they are, for files you put there as root on purpose, for example published downloads the site must not change.

reqad account perms bob                 # check only
reqad account perms bob --fix           # repair
reqad account perms bob --fix --keep-root

Databases

reqad db list   [--account=ACCOUNT]
reqad db create <account> <name> [--dbuser=NAME]
reqad db delete <database> [--yes]
reqad db passwd <dbuser>
reqad db export <database> [--output=FILE|-] [--no-gzip]

<account> is the hosting account the database belongs to, and it is the prefix of every name, exactly as in the panel. create takes the short name and adds the prefix to both the database and its user; --dbuser picks a different user name, also prefixed. delete and passwd take the full name:

reqad db create bob wp --generate-password    # database bob_wp, user bob_wp
reqad db create bob shop --dbuser=shopuser    # database bob_shop, user bob_shopuser
reqad db passwd bob_wp
reqad db delete bob_shop --yes

┌──────────┬─────────────┬─────────┬─────────────────────────────────────┐
│ DATABASE │ SYSTEM USER │ SIZE_MB │ USERS                               │
├──────────┼─────────────┼─────────┼─────────────────────────────────────┤
│ bob_wp   │ bob         │   12.41 │ bob_wp@localhost, bob_wp2@localhost │
│ bob_shop │ bob         │    0.72 │ bob_shop@localhost                  │
└──────────┴─────────────┴─────────┴─────────────────────────────────────┘

The account must exist - the prefix is what ties a database to a hosting account, and is why deleting the account also deletes its databases. Deleting a database also drops the users that were granted on it, unless a user still has access to another database. A dash in the SYSTEM USER column means there is no hosting user behind the prefix - which is how a database left behind by a removed account shows up.

export saves a database as SQL: a consistent snapshot with its stored routines and triggers, without a CREATE DATABASE, so it can be imported into a database of any name. It writes <database>-<date>.sql.gz in the current folder, or the file --output names, readable only by you, and never overwrites a file that exists. --output=- sends it to standard output for a pipe, and --no-gzip gives plain SQL:

reqad db export bob_wp                                   # ./bob_wp-20261025-130557.sql.gz
reqad db export bob_wp --output=/root/bob_wp.sql.gz
reqad db export bob_wp --output=- --no-gzip | mysql bob_wp_test

Mailboxes

reqad email list   [--domain=DOMAIN]
reqad email create <address> [--size=SIZE]
reqad email edit   <address> [--password] [--enable|--disable] [--size=SIZE]
reqad email delete <address> [--yes]

The domain must already belong to an account with mail enabled (reqad account create … --email, or reqad account edit <user> --email=on). --size (500M, 2G, or default) sets the mailbox size; it needs Reqad Hosting Pro.

reqad email create sales@example.com --generate-password
reqad email edit   sales@example.com --disable
reqad email list   --domain=example.com

┌───────────────────┬─────────────┬──────────┐
│ EMAIL             │ SYSTEM USER │ STATUS   │
├───────────────────┼─────────────┼──────────┤
│ bob@example.com   │ bob         │ active   │
│ sales@example.com │ bob         │ disabled │
└───────────────────┴─────────────┴──────────┘

--disable blocks IMAP, POP3 and SMTP login for that mailbox but keeps delivering mail to it, so nothing is lost while an account is suspended; --enable allows login again. delete removes the mailbox with its messages, filters and autoresponder.

Acting as one account

Add --user=ACCOUNT to any account, db or email command to run it with that hosting account's permissions instead of the server admin's. Lists show only the account's own databases and mailboxes, and anything that belongs to another account is refused:

reqad db list --user=bob                    # only bob's databases
reqad db delete alice_wp --user=bob --yes   # refused: does not belong to account bob
reqad email create info@example.com --user=bob

Creating or deleting accounts, assigning databases and the auth commands stay with the server admin and are refused with --user. It is the same check that account-level access to Reqad uses, so it is also a quick way to see what an account is allowed to do.

Panel login

reqad auth status
reqad auth mode       [status|web|basic]
reqad auth passwd     [<user>]
reqad auth 2fa-reset  [<user>]
reqad auth sessions
reqad auth logout     [<user>]
reqad auth unban      <ip>
reqad auth firewall   [status|off]
reqad auth email-code [status|off|on]
reqad auth passkeys   [<user>] [--remove-all]
reqad auth log        [--lines=N]

reqad auth passwd --generate-password   # new random password, printed once
reqad auth unban 203.0.113.7
reqad auth log --lines=50

These commands need SSH access as root, which is why they are the way back in - see Locked out? for which one fits which problem.

Needs attention

reqad health list    [--account=ACCOUNT] [--all]
reqad health run     [--check=ID]
reqad health checks
reqad health dismiss <id> [--days=N|--forever]
reqad health restore <id>

With --user=ACCOUNT, list shows only that account's problems and dismiss works only on them; run stays with the server admin. What each check looks for is on the Needs attention page.

REST API

reqad api status
reqad api on|off
reqad api tokens  [--all]
reqad api new     <name> [--account=ACCOUNT] [--write] [--delete] [--days=N] [--ip=LIST]
reqad api revoke  <id|name|prefix>
reqad api log     [--lines=N] [--token=ID]

The endpoints and examples are on the REST API page. With --user=ACCOUNT these commands are refused: tokens are the server admin's.

AI assistants (MCP)

reqad mcp status
reqad mcp on|off
reqad mcp tokens  [--all]
reqad mcp new     <name> [--account=ACCOUNT] [--write] [--delete] [--days=N] [--ip=LIST]
reqad mcp revoke  <id|name|prefix>
reqad mcp log     [--lines=N] [--token=ID]
reqad mcp tools   [--token-file=PATH]
reqad mcp serve   --token-file=PATH

How to connect an assistant: AI assistants (MCP). With --user=ACCOUNT these commands are refused.

Git deployments

reqad deploy list     [--account=ACCOUNT]
reqad deploy show     <id|domain> [--secret]
reqad deploy create   <domain> --repo=URL [settings]
reqad deploy edit     <id|domain> [settings] [--new-secret]
reqad deploy run      <id|domain> [--wait]
reqad deploy rollback <id|domain> [--release=NAME] [--wait]
reqad deploy log      <id|domain> [--run=ID]
reqad deploy delete   <id|domain> [--yes]

create prints the deploy key and the webhook address and secret. run --wait and log on a running deploy follow its output and exit with 1 when it fails, which suits scripts. With --user=ACCOUNT only that account's sites can be deployed. More on the Git deployments page.

Node.js and Python apps

reqad app list      [--account=ACCOUNT]
reqad app show      <id|domain>
reqad app create    <domain> --runtime=node:24|python:3.12 [--start=CMD] [settings] [--no-start]
reqad app edit      <id|domain> [settings]
reqad app start|stop|restart <id|domain>
reqad app logs      <id|domain> [--lines=N]
reqad app env       <id|domain> [--file=PATH]
reqad app install   <id|domain> [--wait]
reqad app detect    <domain> [--dir=PATH] [--runtime=node|python]
reqad app delete    <id|domain> [--yes]
reqad app runtimes  [--available]
reqad app runtime   install|update|remove node <major> | python <3.x>

env prints the app's environment file, or replaces it with --file and restarts the app. --no-start on create waits for the code, for example for the first Git deploy. install installs the app's packages in the background and restarts it (--wait follows the output). detect reads the code (as the account; nothing runs) and prints the start command it needs, the other ones it found and the runtime that fits; --dir looks at another folder of the account. With --user=ACCOUNT, only that account's apps can be managed; installing runtimes is the server admin's. More on the apps page.

An account's backups

reqad backup list     <account> [--refresh]
reqad backup show     <account> <backup>
reqad backup restore  <account> <backup> --files=PATH|--database=NAME|--email=MAILBOX [--mode=MODE]
                      [--name=NEW_DB] [--grant=DBUSER]
reqad backup restores <account>

list shows the account's nightly backups on the backup server (remote-YYYYMMDD) and the archives in /usr/local/reqad/backup (local-YYYYMMDD-HHMM), newest first. show lists what one holds: its databases, mailboxes and top folders. restore works in the background, exactly like the account panel's Backups pages:

What a restore replaces or deletes is kept in the account's ~/backup-restores/, and a database is copied there before it changes. restores shows how the latest ones ended. With --user=ACCOUNT only that account's backups can be used. More on the backups page.

Visitor stats and bandwidth

reqad stats show    <domain|all> [--period=30d|12m|YYYY-MM] [--account=USER]
reqad stats usage   [--month=YYYY-MM]
reqad stats collect [--domain=DOMAIN] [--quiet]
reqad stats geoip   [--update] [--auto] [--monthly=on|off]
reqad stats on|off

show prints a site's visitors, page views, requests, bandwidth and server errors per day (per month with --period=12m), then its top pages, referring sites, missing pages, bots and countries; all is every site of --account. usage is the Bandwidth Usage page: every account and its sites in a month, busiest first. collect counts what the logs got since the last count (cron runs it every hour). geoip shows the country database; --update downloads this month's DB-IP Lite file now, --monthly turns the monthly update on or off. on and off turn visitor stats on or off for the whole server (off, the logs are still counted while hosting packages have a bandwidth limit). With --user=ACCOUNT, only show and usage work, for that account's own sites. More on the visitor stats page.

Site logs

reqad logs site <domain> [--day=YYYY-MM-DD] [--filter=all|err|5xx] [--bots=no] [--q=TEXT] [--ip=ADDRESS] [--offset=N]
reqad logs site <domain> --errors [--day=YYYY-MM-DD] [--all-lines]
reqad logs days <domain>

site lists a day's requests of a site (main or addon domain), newest first, 50 at a time: time, answer code, method and address, IP address and country, size, and the browser or bot. --filter=err keeps the 4xx and 5xx answers, 5xx only the server errors; --bots=no leaves bots and scanners out; --q keeps the requests with that text in the address, IP, browser or referring page; --ip one address; --offset goes further back. --errors shows the web server's errors for the site that day, grouped by kind (permissions, PHP not running, timeouts, blocked by a security rule...), or the newest lines with --all-lines. days lists the days the server still keeps. The default day is today. With --user=ACCOUNT it works for that account's own sites, as in the account panel's Metrics > Logs.

Resource usage

reqad resources usage     [--range=day|week|month]
reqad resources show      <account> [--range=day|week|month]
reqad resources processes <account>
reqad resources stop      <account> <pid> --start=TICKS
reqad resources collect   [--quiet]

usage is the Resource Usage page: every account's CPU and memory (average and highest check), processes, PHP workers at the most and the limits it reached, and the whole server; the default range is the last 24 hours. show splits one account into its SSH / cron / terminal sessions, each site's PHP, email and background jobs, with database connections per user, its limits and the limits it reached. processes lists what it runs now; stop stops one of them (TERM, then KILL after 5 seconds), and --start, the start time processes --json shows, makes sure a process number used again is never hit. collect is the check cron runs every minute. With --user=ACCOUNT everything but collect works, for that account only. More on the resource usage page.

Passwords

No command takes a password as an argument - an argument would land in your shell history and in the process list, where any user on the server can read it. There are three ways to supply one:

# interactive: asks twice, echoes nothing
reqad account create bob example.com

# from a secret store, a file or a pipe
pass show hosting/bob | reqad account create bob example.com --password-stdin

# let Reqad pick one and print it
reqad email create sales@example.com --generate-password

Scripting

Add --json to any command to get a machine-readable result instead of a table or a message. Colors and box drawing are dropped automatically when the output is not a terminal, so piping is safe either way.

reqad account show bob --json

{
    "ok": true,
    "message": "",
    "warnings": [],
    "error": "",
    "data": {
        "uid": 1041,
        "user": "bob",
        "domain": "example.com",
        "status": "active",
        "created_at": "2026-09-14 11:20:07",
        "email": true,
        "disk_usage": 512,
        "disk_quota": 0,
        "php": "8.3",
        "php_handler": "fpm",
        "mailboxes": [
            "sales@example.com"
        ],
        "databases": [
            "bob_wp"
        ]
    }
}

warnings is where a change that went through but not cleanly reports itself - a DNS zone that could not be created, a certificate request that did not start, a DKIM key the provider refused. The operation succeeded; something around it did not.

Anything that deletes asks for confirmation when it has a terminal, and refuses to run without one. -y or --yes skips the question - which is what you want in a script and what you do not want in a shell.

Tab completion

Reqad installs bash completion for the command, so there is nothing to add to your profile. Press Tab after reqad and it completes commands, options and real values from the server - account names, databases, database users, mailboxes, mail domains and the PHP versions actually installed:

reqad account edit <TAB>              bob   shop
reqad account edit bob --php=8.<TAB>  8.2   8.3   8.4   8.5
reqad db delete bob_<TAB>            bob_wp   bob_shop
reqad email edit sa<TAB>             sales@example.com

It works behind sudo reqad too. Completion never prompts for a password: the values that need root are only offered to a shell that already is root.

Need a hand? Create a free account or contact us.