VPS control panels compared: CloudPanel, CyberPanel, aaPanel, HestiaCP, cPanel, Plesk

Short answer: for a free panel on a fresh VPS, HestiaCP is the closest match to classic web hosting with mail and DNS, CloudPanel is the most focused choice for PHP, Node.js and Python sites without mail, and Webmin with Virtualmin suits admins who want every setting. cPanel and Plesk cost a licence but bring the most tooling.

CyberPanel and aaPanel are the other two names that come up in every search. Both are widely used and both are covered below, with the security record you should know before you expose a panel login to the internet. Whatever you pick, install it on a freshly installed server: every vendor on this page says so.

Requirements, install commands and ports come from each project’s own documentation, read on 21 October 2026. We did not install the panels for this comparison. Supported systems change with almost every release, so open the vendor’s page again on the day you install.

VPS control panels at a glance

The RAM figures are the vendors’ minimums for the panel and its stack, not for your sites. Older OS releases that a vendor still lists with an end date, and a few less common systems, are left out here. aaPanel’s GitHub repository does not name a standard open-source licence, so the table does not call it open source.

The free panels, one by one

CloudPanel

CloudPanel describes itself as a free server control panel with a focus on simplicity. It builds sites of five kinds (PHP, Node.js, Python, static and reverse proxy) on NGINX with PHP-FPM, and offers MySQL 8.4 or 8.0 and several MariaDB releases at install time. It deliberately ships no mail server; its documentation sends you to an external mail service instead. It is free to use but not open source, and it runs on x86 and ARM64.

apt update && apt -y upgrade && apt -y install curl wget sudo
curl -sS https://installer.cloudpanel.io/ce/v2/install.sh -o install.sh
echo "<SHA256 FROM THE CLOUDPANEL DOCS> install.sh" | sha256sum -c && sudo DB_ENGINE=MYSQL_8.4 bash install.sh

Copy the current hash from CloudPanel’s install page; it changes with the installer. The check is worth keeping: with GNU coreutils 9.1 on Debian 12, a wrong hash prints install.sh: FAILED and exits with 1, so the && never starts the installer. The admin area then answers on https://SERVER_IP:8443. Open it straight away: the docs warn that until you create the admin user, there is a short window in which a bot could create one.

CyberPanel

CyberPanel is a GPL-3.0 panel built around OpenLiteSpeed, the open-source edition of the LiteSpeed web server, which is why it is often picked for WordPress with the LiteSpeed Cache plugin. Its README lists the install command and the supported systems:

sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)

The installer asks for OpenLiteSpeed or LiteSpeed Enterprise (a paid licence), whether to add the full service set of PowerDNS, Postfix and Pure-FTPd, remote MySQL, the version, an admin password and optional Memcached, Redis and a watchdog. Type your own password: the documented default is 1234567. The panel listens on port 8090 with the user admin. Its install page names at least 1 GB of RAM and 10 GB of disk.

aaPanel

aaPanel’s selling point is a small footprint: its quick start names 512 MB of RAM and one core as the minimum. You choose an LNMP or LAMP stack from the dashboard after the panel itself is installed, and mail comes as an optional plugin. The base edition is free; a Pro edition adds paid features. The documented one-liner:

URL=https://www.aapanel.com/script/install_panel_en.sh && if [ -f /usr/bin/curl ];then curl -ksSO "$URL" ;else wget --no-check-certificate -O install_panel_en.sh "$URL";fi;bash install_panel_en.sh forum

Note what it does: it downloads the script with certificate checks switched off (-k for curl, --no-check-certificate for wget) and runs it at once. To keep TLS verification, fetch it with curl -fsSLO and the same URL, read it, then run bash install_panel_en.sh forum. At the end the installer prints the panel URL, including its port and a random “security entrance” path, and the first login. Save both.

HestiaCP

HestiaCP is the most complete free hosting panel here: web, mail, DNS, FTP and databases, GPLv3, Debian and Ubuntu only, on AMD64 or ARM64. The default install adds Apache behind NGINX with PHP-FPM, MariaDB, vsftpd, BIND, Exim, Dovecot, ClamAV, SpamAssassin, an iptables firewall and Fail2Ban. Its docs name 1 GB of RAM without ClamAV and SpamAssassin as the minimum and 4 cores, 4 GB and 40 GB of SSD as the recommendation.

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
sudo bash hst-install.sh

# smaller VPS: NGINX + PHP-FPM only, no virus or spam scanning
sudo bash hst-install.sh --apache no --clamav no --spamassassin no

The panel answers on port 8083. Because HestiaCP brings its own iptables rules and Fail2Ban, manage the firewall from the panel rather than adding ufw on top.

Webmin and Virtualmin

Webmin (BSD-3-Clause) is a web interface for administering the system itself: users, services, packages, config files. Virtualmin sits on top and adds hosting: domains, mail, DNS and databases per site. Virtualmin GPL is free; Virtualmin Pro is paid and adds, among other things, the installers for dozens of web applications. Webmin on its own, from the project’s repository:

curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
sudo sh webmin-setup-repo.sh
sudo apt-get install webmin --install-recommends

On RHEL-family systems the last line is sudo dnf install webmin. The full Virtualmin stack comes from one script; --bundle LEMP picks NGINX, leaving it out gives Apache:

sudo sh -c "$(curl -fsSL https://download.virtualmin.com/virtualmin-install)" -- --bundle LEMP

Both answer on https://SERVER_IP:10000. Virtualmin’s download page is blunt about the precondition: do not pre-install or tweak extra packages, because the installer expects a clean supported OS.

The paid panels: cPanel and Plesk

cPanel & WHM is Linux only. Its docs require a freshly installed OS, a static IP address and a hostname that is a registered fully qualified domain name, not one of the domains you will host, at most 60 characters long and resolving to the server. On Ubuntu, only 24.04 LTS is supported. The minimum is 2 GB of RAM and 20 GB of disk, with 4 GB and 40 GB recommended, and at least 3 GB if you want ClamAV.

cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest

Plesk Obsidian runs on Linux and on Windows Server. The one-click installer downloads the latest stable release with the default component set and applies the available updates; Plesk’s docs put the average at about 15 minutes. The Linux minimum is 1 GB of RAM plus 1 GB of swap and 20 GB of disk.

sh <(curl https://autoinstall.plesk.com/one-click-installer || wget -O - https://autoinstall.plesk.com/one-click-installer)

WHM answers on port 2087 and cPanel on 2083; Plesk on 8443. Both licences are priced per server by the number of accounts or domains, and on a small VPS the licence is often the biggest line on the bill. How the two differ in daily use is the subject of cPanel vs Plesk.

Security: a panel is root with a login page

Every panel here administers the server with root privileges, and its login page is reachable from the internet unless you restrict it. Two public incidents show what that means:

• CyberPanel, October 2024. CVE-2024-51567 and CVE-2024-51378 let remote attackers bypass authentication and run commands through shell metacharacters. Both CVE records rate them 10.0 under CVSS 3.1, name versions through 2.3.6 and an unpatched 2.3.7, and say they were exploited in the wild that month. CISA added both to its Known Exploited Vulnerabilities catalogue. The CVE records name the code commits that fixed them.
• Webmin, 2019. Webmin’s own security page says version 1.890 was released with a backdoor that allowed command execution as root, and that 1.900 to 1.920 contained similar code that was not exploitable in a default install. The code had been planted on the project’s build server; 1.930 removed it. It is tracked as CVE-2019-15107.

Neither case says a panel is unsafe to use; both say a panel is a high-value target that must be patched quickly and kept away from strangers. In practice:

• Allow the admin port only from your own address where you can, for example sudo ufw allow from 203.0.113.10 to any port 8443 proto tcp, or the equivalent in the panel’s own firewall. The ufw guide covers source-restricted rules.
• Turn on two-factor login where the panel offers it, and never keep a default password.
• Use SSH keys for the shell and keep password logins off, as in securing SSH access: the panel is already one way in.
• Follow the project’s release notes or security page, so a critical fix does not wait for your next routine update.

Update discipline

A panel updates more than itself: it owns the web server, PHP builds, the database and often mail. HestiaCP and Webmin come from package repositories, so they update with the system. CloudPanel is updated by hand on purpose: its docs say to read the changelog, then run clp-update as root, and to take a snapshot of the server first. cPanel and Plesk have update settings of their own in WHM and in Tools & Settings. Three habits apply to all of them:

• Take a backup or snapshot before a panel update and before any OS release upgrade. On a VMHeaven VPS, the customer panel takes backups by hand or on a daily, weekly or monthly schedule; keep a copy of what you cannot lose somewhere else too.
• Do not upgrade the OS to a new major release until the panel lists it as supported. A panel that does not know the new release yet can break in ways a plain server would not.
• Update PHP versions through the panel, not with your own APT sources next to it.

Install a panel on a fresh server only

HestiaCP says it must be installed on top of a fresh OS installation, cPanel says to install only on a freshly installed operating system, and Virtualmin says its installer expects a clean system. The reason is the same everywhere: the panel writes its own configuration for the web server, PHP, the database, mail and the firewall, and an existing setup either breaks the installer or gets silently overwritten.

Before running the installer, do only the basics: log in with an SSH key, apply the OS updates, and set the hostname to a fully qualified name such as server1.example.com with an A record pointing at the server (changing the hostname). If the panel will send mail, set a matching reverse DNS (PTR) record too. Skip the web server, database and firewall steps of the initial server setup guide here: those are exactly what the panel installs.

How big a VPS does a panel need?

The vendor minimums range from 512 MB (aaPanel) to 2 GB (CloudPanel, cPanel). The heavy part is usually mail scanning, not the panel: cPanel recommends at least 3 GB once ClamAV is installed, and HestiaCP’s 1 GB minimum applies only without ClamAV and SpamAssassin. Add what your sites need on top: MariaDB’s buffer pool and the PHP-FPM workers are where the RAM goes on a busy WordPress server. A Linux VPS with headroom over the panel’s minimum is the comfortable start, and a plan upgrade later adds RAM without a migration.

When managed Plesk hosting is simpler

A panel on your own VPS means you run the server underneath it: OS updates, panel updates, the firewall, backups and whatever breaks at night. If what you actually want is websites, WordPress and certificates in a panel, a hosting account gives you the panel without the server. VMHeaven’s Plesk hosting comes with the WordPress Toolkit (staging and cloning, mass updates, one-click hardening), free auto-renewing SSL and daily backups with up to ten restore points, and the account is set up automatically about a minute after payment. The cPanel hosting line has the same plans and prices; while it is sold out, as it is at the time of writing, new accounts are set up on Plesk. The trade-off is root: on a hosting account you cannot install your own services, which is exactly when a VPS with a panel, or with none, is the better tool.

Which panel for which job

• Websites with mail and DNS on one server, free: HestiaCP.
• PHP, Node.js or Python apps, mail elsewhere: CloudPanel.
• WordPress on OpenLiteSpeed with LSCache: CyberPanel, kept strictly up to date and with the port restricted.
• The smallest VPS: aaPanel, with the installer downloaded and read first.
• Full control over every config file, with a UI: Webmin, plus Virtualmin if you host domains.
• Client hosting, resellers, or a migration from a cPanel host: cPanel. Windows, or several WordPress sites you maintain for others: Plesk.
• One or two sites and comfortable in a terminal: no panel at all. A plain web server and database cost nothing and leave nothing extra exposed.

Frequently asked