Free cPanel alternatives: aaPanel, CyberPanel, CloudPanel and HestiaCP compared

A free hosting control panel turns the black terminal window into a handful of simple web pages: hosting for a domain, switching PHP versions, databases, SSL certificates, backups and file management, all with a few clicks. Here we compare four serious free cPanel alternatives, aaPanel, CyberPanel, CloudPanel and HestiaCP, with their real install commands, default ports, minimum resources, recorded vulnerabilities and the traps that rarely get written down. Every number comes from each project's own official documentation.

What exactly does a control panel do for you?

A control panel is a web interface installed on your server that, behind the scenes, runs the same commands a system administrator would type in a terminal: creating a virtual host for a domain, switching the PHP version, creating a MySQL or MariaDB database, getting a free certificate from Let’s Encrypt, scheduling backups and managing files through a graphical File Manager. It plays the same role cPanel plays on shared hosting, with one difference: cPanel and DirectAdmin require paid licenses, while these four options are free on your own server. That is why they are often called free cPanel alternatives.

Let's set two expectations right away. First, a panel does not remove the need to understand the basics; it only removes the typing. If you don't know what an A record is, no panel will bring your site online, and our guide to DNS records is a short prerequisite. Second, and the security section of this article rests on this point, a panel is an always-online web application running with root privileges. Any weakness in it is a weakness of the whole server.

Before you install: the server the panel will sit on

Linux distribution. All four panels are best supported on Ubuntu LTS, and standard security support for 22.04, 24.04 and 26.04 runs until May 2027, May 2029 and May 2031 respectively, so a newer LTS buys you a few more years. But "newest" is not always best: at the time of writing, CloudPanel and HestiaCP officially support Ubuntu 26.04, while CyberPanel's list still stops at 24.04. An install on an unsupported distribution may go through, but the first update will break it.

Resources. The official minimums are optimistic: on paper aaPanel starts with 512 MB of RAM and 1 GB of disk, CyberPanel asks for at least 1 GB of RAM and 10 GB of disk, and CloudPanel explicitly requires 2 GB of RAM. But the minimum to install is not the minimum to run: a panel, a web server, a database and one WordPress site on 1 GB of RAM end up living in swap. Treat 2 GB as the floor.

Root access. All four installers must run as root, so you need one SSH connection, the only point in the whole process where you need a terminal. Our guide to connecting to a server over SSH covers exactly that step.

aaPanel: the easiest start for beginners

aaPanel has the gentlest learning curve of the four: a clean dashboard, a one-click software store (WordPress, multiple PHP versions, Redis and more) and a File Manager that is genuinely good. The official documentation says the panel is developed on Ubuntu 22.04 and recommends that release, although Debian, AlmaLinux and Rocky Linux are supported too. Installation is a single command:

URL=https://www.aapanel.com/script/install_panel_en.sh && \
if [ -f /usr/bin/curl ]; then curl -ksSO "$URL"; \
else wget --no-check-certificate -O install_panel_en.sh "$URL"; fi; \
bash install_panel_en.sh

The installer asks whether to install the panel in /www, and at the end it prints:

==================================================================
Congratulations! Installed successfully!
==================================================================
aaPanel Internet Address: https://your_ip_address:31750/abcdefg
username: abcdefgh
password: abcdefgh

Two things in this output matter. First, the default port is 31750, not the old port that many tutorials still quote. Second, the random string after the port (the "security entrance") is part of the login address; without it, the same address returns a 404.

These details are printed only once, but losing them is not a disaster: the bt menu is aaPanel's rescue console. bt 14 shows the login details again, bt 5 changes the password, bt 8 the port, bt 28 the security path, bt 24 turns off Google Authenticator two-factor login (which tells you the feature exists and that you should turn it on), and bt 16 updates the panel to the latest version.

The honest weakness: there is also a commercial Pro edition, and some attractive features, including the full WAF, sit on that side of the line.

CyberPanel: speed with OpenLiteSpeed

CyberPanel's trump card is its default web server: OpenLiteSpeed, which is released under GPLv3 and, according to its official site, is compatible with Apache's mod_rewrite rules. CyberPanel's own documentation spells out the difference between the free and Enterprise editions: the panel code is the same in both, and the only difference is the web server behind it. The free edition runs on OpenLiteSpeed with no limit on the number of domains. Unlike many of its rivals, it also includes DNS, email and FTP.

sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)

Of the installer's questions, two really matter. The first is the choice of LiteSpeed edition; if you don't have a license, pick OpenLiteSpeed. The second, and the most important sentence in this section, is the password prompt: its default value, according to the official documentation, is 1234567, and the documentation itself labels using it "not recommended". Right there you get the option s to set your own password and r for a random one; choose one of the two and don't skip past this question.

The remaining questions are about add-on services: PowerDNS, Postfix and Pure-FTPd (default yes), plus Memcached, Redis and Watchdog. If you don't want email and DNS, turn them off right there; every service you don't install is one less thing to keep updated. Installation takes 5 to 10 minutes, and you log in on port 8090.

/usr/local/lsws/bin/lswsctrl restart

The honest weakness: CyberPanel has the heaviest security track record of the four panels, so be sure to read the security section below.

CloudPanel: minimal, modern and built for developers

CloudPanel runs on Nginx and PHP-FPM, has the most modern interface of the four and deliberately leaves out a mail server and DNS; its philosophy is that a web server should be just a web server. It is excellent for PHP, Node.js, Python and static sites. Its official requirements are clear: at least 1 core, 2 GB of RAM and 10 GB of disk, on Ubuntu 22.04 / 24.04 / 26.04 or Debian 11 / 12 / 13, on both x86 and ARM64. Its installation has something the other three lack: the script's checksum is verified before it runs.

apt update && apt -y upgrade && apt -y install curl wget sudo

curl -sS https://installer.cloudpanel.io/ce/v2/install.sh -o install.sh
echo "<SHA256-FROM-DOCS>  install.sh" | sha256sum -c
sudo DB_ENGINE=MYSQL_8.4 bash install.sh

Copy the SHA256 value from the documentation page itself, not from articles; it changes with every version of the script, and a stale value means sha256sum -c fails. The DB_ENGINE variable is mandatory too, and changing it after installation is not simple.

You log in at https://SERVER_IP:8443, and the browser warns you because the certificate is self-signed. Here is a trap that the documentation itself emphasizes: the admin user is created after installation, not during it. Until you log in and create the admin account, that window is open to anyone who finds the port.

A clarification about "open source": CloudPanel is free, but it is not open source in the strict sense of the term; its official license terms forbid resale without the vendor's written permission and explicitly reserve the right to stop offering it for free in the future.

HestiaCP: genuinely open source, with a complete mail server

HestiaCP is the community-driven continuation of VestaCP, and it is the only panel here that can be called open source without an asterisk: all of its code is published on GitHub under the GPL-3.0 license, and there is no commercial edition. If you want the web, real email with anti-spam, DNS and a firewall together on one server, Hestia offers the best balance of features and simplicity.

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh

Official requirements: at least 1 core, 1 GB of RAM (without SpamAssassin and ClamAV) and 10 GB of disk; the project's own recommendation is 4 cores, 4 GB of RAM and a 40 GB SSD. Only Debian 12 and 13 and Ubuntu LTS releases are supported, and the panel login is on port 8083. If the server slows down after you turn on anti-spam, that's no surprise: ClamAV and SpamAssassin are the two heaviest services in this panel, which is exactly why they are excluded from the stated minimum.

The release history says something good about this project, too: the 1.10 branch, released in August 2026, brought PHP 8.5 and Debian 13 support and was also a broad security overhaul, removing eval from the code, parameterizing database queries and no longer trusting unauthenticated proxy headers.

Comparison table: which free cPanel alternative is right for you?

In short: a beginner who wants WordPress? aaPanel. WordPress speed is your top priority and you are committed to regular updates? CyberPanel. A developer who doesn't need email? CloudPanel. A real mail server or a fully open-source license matters to you? HestiaCP.

Panel ports, firewalls and the trap you set with an edge proxy

All four panels listen on a non-standard port, and that has two consequences, both usually discovered late. First, the firewall: if ufw is active, the panel port has to be opened, not for everyone, only for your own IP address:

ufw allow 80,443/tcp
ufw allow from 203.0.113.25 to any port 8443 proto tcp
ufw enable
ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 80,443/tcp                 ALLOW IN    Anywhere
[ 2] 8443/tcp                   ALLOW IN    203.0.113.25
[ 3] 80,443/tcp (v6)            ALLOW IN    Anywhere (v6)

Second, and this is the real trap: if your domain sits behind Cloudflare in proxied mode (the orange cloud), only certain ports pass through it. According to Cloudflare's network ports documentation, the supported HTTPS ports are 443, 2053, 2083, 2087, 2096 and 8443. So of these four panels, only CloudPanel on port 8443 gets through the proxy; 31750, 8090 and 8083 never reach the server, and you see an error page with no trace at all in the server's logs. The fix: never proxy the hostname the panel opens on.

Panel security: none of them is "the secure panel"

Contrary to popular belief, this is not a problem with "one of the panels": all four have critical vulnerabilities recorded in the US National Vulnerability Database (NVD):

The right conclusion from this table is not "don't install CyberPanel"; it is that running an outdated version is itself the attack. The best-known entry on the list, that 2024 CyberPanel flaw, set off a ransomware wave after its patch had already been released and the victims simply hadn't installed it. Four steps have the biggest impact:

1. Change the default port. Bots scan these four numbers around the clock. Move the port to an unusual number (in aaPanel with bt 8), and if you have a static IP, restrict access to it.
2. Change the default password the moment installation finishes. This is the one item with no second chance: the gap between "install finished" and "password changed" is exactly the window bots are waiting for.
3. Add a second login factor. aaPanel supports Google Authenticator, and since version 2.0.3 CyberPanel has a 2FA option under "Modify User"; CloudPanel instead offers Basic Authentication in front of the panel itself, which its documentation recommends precisely for the case where you can't restrict the port to your own IP. None of these is on by default.
4. Update once a month. Not for new features, but because the table above gains a row every few months.

Free SSL in the panel, and the limits that catch people out

All four panels have a button for getting a free Let’s Encrypt certificate, and usually that one click is enough. When it doesn't work, the cause is almost always one of these three.

One: the A record doesn't point to this server yet. HTTP-01 validation means the issuing server has to read a file from your domain; if the domain still points to the old server or port 80 is closed, issuance fails.

Two: issuance limits. These numbers come from the official Let’s Encrypt documentation: at most 50 certificates per registered domain every 7 days, at most 5 certificates for the exact same set of names every 7 days, and at most 5 failed validations per name per hour. The second limit is the one that trips people up: when issuance fails and you hit the button ten times in a row, you burn through that domain's weekly allowance. Click once, read the error, fix the cause, and only then try again.

Three: an edge proxy. If traffic goes through a proxy, validation still has to reach the origin server. For the full issuance and renewal mechanism, and for DNS-01 validation, which helps when port 80 isn't reachable, see our guide to installing a free SSL certificate with Certbot.

When should you skip a panel?

• Your server has a single purpose: for one Telegram bot or one Docker app, a panel only eats RAM and adds attack surface.
• Your server is underpowered: on 512 MB of RAM, a panel, a database and a web server don't fit, even if the official figure says they do.
• You want to learn Linux: a panel is like an automatic car; it's comfortable, but it doesn't teach you to drive. Setting up one site by hand with Nginx on Ubuntu will teach you more than ten Linux articles.
• You need a custom configuration: the panel generates its own vhost files, and your manual changes get overwritten by the next update.

Should the panel go on a server in Iran or abroad?

The short answer: put the panel where your audience is. If your visitors are in Iran, a server inside Iran removes several network round trips, and the difference in page load time is noticeable. Mehran Host's cloud service runs on KVM with NVMe disks in an Iranian datacenter and is billed by the hour; its international servers are in Hetzner datacenters and are paid for in Iranian currency (Toman). And if you would rather not deal with installing a panel at all, our Iran web hosting (shared hosting) plans run on cPanel and DirectAdmin, and the everyday tasks (email, databases, files, domains and SSL requests) are handled from Mehran Host's own panel.

And here is a low-cost way to choose: try them yourself. Create a fresh Ubuntu server billed by the hour, install the first panel, click around for an hour, delete the server and move on to the next one. How hourly billing works is explained in what an hourly cloud server is.

In the end, a panel whose port has been changed, whose default password has been replaced, whose second login factor is on and which is updated once a month will run trouble-free for years. One that has had none of these four steps applied will sooner or later earn its own row in the table above.

Frequently asked questions

Which free hosting control panel is the best?

No single panel is best for everyone; the right choice depends on what you are running. For a beginner launching WordPress, aaPanel offers the smoothest start. For WordPress speed, CyberPanel leads with its OpenLiteSpeed web server and built-in cache. A developer hosting PHP, Node.js and Python who doesn't need email will find CloudPanel simpler. And if a real mail server or a fully open-source license is a must, HestiaCP is the only option on this list released under the GPL with no commercial edition.

How is a free control panel different from cPanel?

The main differences are the license model and where the panel runs, not the day-to-day work. cPanel and DirectAdmin are commercial products that a hosting provider usually installs and manages on its own servers, while you install a free panel on your own server yourself, and keeping it updated and secure is your responsibility too. For the basics, such as creating sites, databases, email, SSL certificates and backups, there is no meaningful gap between them.

How long does it take to install a control panel, and what do I need?

Installing any of these four panels usually takes 5 to 15 minutes and needs a fresh, empty server with root access. The recommended distribution is an LTS release of Ubuntu or Debian. On resources, the official figures range from 512 MB to 2 GB of RAM, but for a site with real traffic, treat 2 GB as the floor. The only step that needs a terminal is running that one install command over SSH.

Why can't I log in to the panel after installing it?

Three causes come up far more often than any others. First, the panel's port is closed: each panel listens on its own non-standard port, which must be open both in the server's firewall and in any cloud firewall or security group. Second, the address is incomplete: some panels add a random security path to the login URL, and without it you get a 404. Third, the domain sits behind an edge proxy that doesn't pass non-standard ports.

Are free control panels secure?

A panel's security depends more on how you maintain it than on its name. All four panels reviewed in this article have critical vulnerabilities recorded in the NVD, and almost every exploited case involved installations that hadn't applied a patch that was already available. Four steps cut the risk sharply: changing the default port, replacing the default password the moment installation finishes, turning on two-factor login and updating the panel every month.