A web hosting control panel is software that lets you create and manage websites, domains, databases, email, DNS, SSL certificates and backups on a server through a web interface, instead of editing configuration files by hand. This guide explains what a web hosting control panel does, which types exist, and how to choose one by licence, account limits, server access, automation, security and updates.
We checked licence type, price and supported operating systems for twelve panels on the vendors' own pages. We are CloudAcropolis and we sell a managed server with its own panel, called PFHW, so we also say where it does not fit.
What a web hosting control panel does
Most hosting panels cover the same jobs:
- Create hosting accounts and set limits for each account.
- Add domains and subdomains, and manage DNS zones.
- Manage files, FTP or SFTP users, databases and cron jobs.
- Create email boxes, or connect to a mail server.
- Issue or install SSL certificates.
- Run backups and restore them.
- Show resource use, logs and statistics.
Many panels have several levels. The cPanel licence includes WHM, the administrator interface that manages cPanel accounts, and the cPanel interface that each account owner uses. ISPConfig lists four login levels, from admin to mailbox user. Virtualmin describes domain owner and reseller accounts for delegating work.
Web hosting control panel, web server control panel and server panel
People use these terms loosely. A panel built for hosting adds separate accounts, resellers and limits per account. A web server control panel is often aimed at one administrator who runs sites or applications on a server. The Webmin repository describes a web-based system administration tool, and Virtualmin adds the hosting layer on top of it. CloudPanel describes itself as a server control panel and lists site isolation among its security features.
If you host sites for other people, you need account separation, delegation and limits. If you only run your own applications, a simpler web server control panel can be enough.
Types of web hosting control panel by licence
| Type | Examples we checked | What you pay | What to watch |
|---|---|---|---|
| Open source licence | HestiaCP, ISPConfig, Virtualmin GPL, CyberPanel | No licence fee; some extensions or editions are paid | You patch and support the server yourself; support is mostly community based |
| Free of charge, own licence terms | CloudPanel, FASTPANEL, aaPanel | No fee for the basic edition | Read the terms on hosting for third parties and on changing the code |
| Commercial, limit by account or domain | cPanel, Plesk, DirectAdmin, sPanel licence | Monthly fee by tier | Tier limits, price changes and licence rules |
| Commercial, price per hosted website | Enhance | Per website per month | Cost grows with the number of sites |
| Bundled with a managed server | sPanel on ScalaHosting VPS plans, PFHW on our Managed Web Server | Panel cost is part of the server price | The panel is tied to that provider's service |
Open source web hosting control panel
An open source web hosting control panel publishes its source code under a standard licence. We confirmed this for HestiaCP (GPL v3), CyberPanel (GPL v3 in its repository), ISPConfig (BSD) and the Virtualmin GPL edition (GPL v3, on top of BSD-licensed Webmin). Not every panel that calls itself open source qualifies. aaPanel's site uses the term, but its licence file is a custom agreement and GitHub lists the licence as 'Other'.
Free web hosting control panel
A free web hosting control panel costs nothing, but that does not make it open source or managed. CloudPanel is free of charge under its own licence terms. FASTPANEL has a free Standard licence and a paid Extended licence. sPanel is free on ScalaHosting cloud VPS plans, and a separate licence for other servers starts at $9.95 per month.
How to choose a web hosting control panel
1. Licence terms: what you are allowed to do
Licences differ on hosting for other people. CloudPanel's terms say you must not host the software for third parties, or resell it or let third parties use it for a fee, without written consent. DirectAdmin's terms do not allow licence reselling unless the licence is leased with a server. A cPanel licence belongs to one server and its IP address, and cPanel's documentation warns that using one licence on several servers may lead to the licence being locked. sPanel defines a licensed computer system by the IP address given at purchase. Standard open source licences do not restrict commercial hosting. Read the licence before you plan a business on it.
2. Accounts and limits
Vendors count different things. cPanel counts accounts (1, 5, 30 or 100, then a price per extra account). DirectAdmin counts accounts and domains, Plesk and Virtualmin Pro count domains, and Enhance counts hosted websites. FASTPANEL and CyberPanel state unlimited domains or websites on their sites.
The counting unit changes the cost as you grow. Using the cPanel prices valid from 16 December 2026, a server with 150 accounts on Premier costs $76.99 for the first 100 accounts plus 50 accounts at $0.55 each, which is $104.49 per month; the per-account price above 100 is $0.49 until then. A WHM reseller account counts as one account.
3. Server access and operating system
Most panels need a clean server, root access and a supported operating system. Some also reject certain virtualisation types or processor architectures. Check this before you buy a server, not after.
| Panel | Minimum memory stated | Architecture and restrictions stated |
|---|---|---|
| cPanel & WHM | 2 GB (4 GB recommended) | 64-bit x86; ARM not supported; static IPv4 address needed; root access needed |
| Plesk (Linux) | 1 GB plus 1 GB swap | ARM listed for Ubuntu 22.04 with limitations |
| DirectAdmin | 4 GB plus 4 GB swap | amd64 and arm64; root access needed |
| CloudPanel | 2 GB | x86 and ARM64 |
| Enhance | 2 GB, 2 cores | x86_64 only; full VM or bare metal; LXD and Virtuozzo not supported |
| FASTPANEL | 1 GB | Not stated on the pages we read |
| CyberPanel | 1 GB (knowledge base page) | x86_64 (repository README) |
| aaPanel | 512 MB | Not stated on the pages we read |
| HestiaCP, ISPConfig, Virtualmin, sPanel | Not stated on the pages we read | HestiaCP: no 32-bit systems; others not stated |
Sources: vendor documentation and repository pages listed under Sources, read on 7 November 2026.
Operating system lifecycle matters too. Debian 11 reached its vendor end of life in August 2026, and Plesk no longer publishes new releases for it. DirectAdmin says it ends support a few months after each operating system's end-of-life date.
4. Automation and APIs
If you provision accounts from a billing system or scripts, check the API and command line. ISPConfig lists a SOAP and REST remote API and the ispc command line tool. Virtualmin lists a command line and an authenticated remote HTTP API. HestiaCP says you can interact with it through its API. sPanel lists API tokens and API and CLI access. Check the API documentation of any panel against the exact tasks you need before you commit.
5. Security features
The panel is itself an exposed service, so check its login protection as well as the features it gives your customers. Examples from vendor pages: CloudPanel lists two-factor login, IP restriction for panel access and site isolation. Enhance lists a ModSecurity firewall with OWASP rules, brute force protection, optional two-factor login for end users and a container for every site. sPanel lists a ModSecurity-based firewall and its SShield monitor. Virtualmin lists two-factor authentication and brute force protection. Whatever you choose, restrict who can reach the admin login and keep two-factor login on.
6. Updates and who patches
Three layers need updates: the operating system, the panel and the applications on the sites. A panel updates itself or gives you an update command, but it does not decide who runs it. ISPConfig updates with one command, and Virtualmin tells you to use your package manager for updates. On an unmanaged VPS, you do all three layers. On a managed server, the provider does the operating system and panel layers, and you keep the application layer. Ask any provider in writing which layers are covered.
Comparison of the verified web hosting control panels
| Panel | Licence | Supported operating systems (vendor pages) | Free SSL or Let's Encrypt stated on vendor pages |
|---|---|---|---|
| cPanel & WHM | Commercial, per server | AlmaLinux 8 to 10, CloudLinux 8 to 10, Ubuntu 24.04 LTS | SSL certificates listed as included |
| Plesk | Commercial | Ubuntu, Debian, AlmaLinux, CloudLinux, Red Hat Enterprise Linux | Not stated on the pages we read |
| DirectAdmin | Commercial | Red Hat family 8 to 10, Debian 12 and 13, Ubuntu 22.04 to 26.04 | Not stated on the pages we read |
| sPanel | Proprietary (vendor's description) | Not stated for the standalone licence | Yes: automatic free SSL |
| CloudPanel | Own licence terms, free of charge | Ubuntu 22.04 to 26.04, Debian 12 and 13 | Yes: Let's Encrypt with automatic renewal |
| Virtualmin | GPL v3 (GPL edition); Pro commercial | Debian, Ubuntu, AlmaLinux, Rocky Linux, Red Hat Enterprise Linux | Yes: automatic Let's Encrypt |
| HestiaCP | GPL v3 | Debian 11 to 13, Ubuntu 22.04 to 26.04 | Yes: Let's Encrypt, including wildcard |
| ISPConfig | BSD 3-Clause | Debian 11 to 13, Ubuntu 22.04 to 26.04, AlmaLinux and Rocky Linux 8 to 10 | Yes: Let's Encrypt |
| Enhance | Commercial, per website | Ubuntu 24.04 LTS only | Not stated on the pages we read |
| FASTPANEL | Licence agreement; Standard licence free | Debian 9 to 12, Ubuntu 18.04 to 24.04, CentOS 7, AlmaLinux 8, Rocky 8 (site FAQ) | Yes: Let's Encrypt |
| CyberPanel | GPL v3 (repository) | Ubuntu, AlmaLinux, Rocky Linux, RHEL, CloudLinux (project pages differ) | Yes: Auto SSL (repository README) |
| aaPanel | Custom agreement; GitHub lists 'Other' | Ubuntu, Debian, AlmaLinux, Rocky Linux, CloudLinux (site and GitHub differ) | Yes: Let's Encrypt (download page) |
Sources: the vendor pages listed under Sources, read on 7 November 2026. Prices for these panels are in our separate comparison of cPanel alternatives.
Managed or self-managed: who runs the server
A control panel does not patch a server. Four setups are common:
- Unmanaged VPS with a free panel: you license nothing, and you patch the operating system and the panel.
- Unmanaged VPS with a paid panel: you pay the licence and you patch.
- Managed VPS with a panel licence: the provider installs and updates the operating system and the panel, and the licence is part of the price or an add-on. See our comparison of a managed cPanel VPS and a managed PFHW server.
- Managed server with the panel included: one provider, one price, no separate licence.
Where PFHW fits, and where it does not
PFHW is the web hosting control panel on our Managed Web Server: a dedicated virtual server in a Tier III data centre in Vilnius, Lithuania, managed by our engineers. The panel has 365 functions in 15 categories and no limit on sites or accounts. It has ModSecurity with OWASP rules, a host firewall, two-factor and passkey login, API tokens with optional expiry and IP restriction, and reseller features such as branded client login domains. Plans run from 29 euros per month (2 vCPU, 4 GB RAM, 50 GB) to 99 euros (16 vCPU, 32 GB, 250 GB), excluding VAT, monthly with no contract. Management covers network edge configuration, monitoring, firewall maintenance, operating system security patches and backup administration.
It fits agencies, freelancers and resellers who host many client sites and want the patching done for them. It does not fit everyone. Check these gaps first:
- No automatic certificate issuing. Several panels above state free SSL or Let's Encrypt support, but PFHW does not issue certificates automatically: you upload a certificate or buy one from us.
- Email is a separate paid add-on on its own Mailcow server. There are no mailing lists, and autoresponders, filters and spam settings are not in the PFHW portal.
- No hotlink or leech protection, no per-account dedicated IP management, no server-to-server transfer tool, no 'forgot password' flow by email, and the interface is English only at present.
- You can download PFHW free and install it on your own server, but that comes with no support.
Frequently asked questions
What is a web hosting control panel?
It is software with a web interface that manages the websites, domains, databases, email, DNS, certificates and backups on a server. Many panels have an administrator level and a level for each account owner.
Is there a free web hosting control panel?
Yes. HestiaCP, ISPConfig, Virtualmin GPL and CyberPanel have no licence fee, and CloudPanel and FASTPANEL are free of charge under their own terms. Free does not mean managed: someone still has to patch the server.
Which open source web hosting control panel should I use?
We confirmed standard licences for HestiaCP, ISPConfig, Virtualmin GPL and CyberPanel. The right one depends on your operating system, the services you need and the support you can get. Test on a spare server first.
Do I need a control panel at all?
No. You can run a server from the command line or with configuration tools. A panel saves time when you manage many sites or when non-specialists need to create sites, mail boxes and backups safely.
How many accounts can one server hold?
The panel licence sets a limit on some panels, and the hardware sets the real limit on all of them. Memory, CPU and disk use depend on what the sites do, so measure your sites rather than relying on a general number.
Related resources
- cPanel alternatives in 2026: free, open source and paid
- Managed cPanel VPS vs managed PFHW server
- Control panel hardening checklist
- cPanel pricing and licence increases
- Managed web hosting vs shared hosting vs unmanaged VPS
Sources
- cPanel pricing page, cpanel.net
- cPanel Store Licensing Guide, valid from 16 December 2026, cpanel.net
- cPanel system requirements for Ubuntu, cPanel documentation
- cPanel system requirements for AlmaLinux, cPanel documentation
- Operating systems supported by cPanel, cPanel support
- Plesk pricing page
- Plesk Obsidian system requirements, Plesk documentation
- Does Plesk support Debian 11, Plesk support
- DirectAdmin pricing page
- DirectAdmin system requirements, DirectAdmin documentation
- DirectAdmin operating system support policy
- sPanel self-managed licences, spanel.io
- sPanel home page, spanel.io
- sPanel terms of service, spanel.io
- Getting started with sPanel, ScalaHosting
- CloudPanel licence terms, MGT-COMMERCE
- CloudPanel requirements, CloudPanel documentation
- CloudPanel home page
- Virtualmin home page
- virtualmin-gpl repository, GitHub
- Webmin repository, GitHub
- HestiaCP home page
- hestiacp repository, GitHub
- ISPConfig home page
- About ISPConfig 3, ISPConfig documentation
- Enhance home page
- Enhance installation guide
- FASTPANEL licence page
- FASTPANEL home page and FAQ
- CyberPanel home page
- cyberpanel repository, GitHub
- Installing CyberPanel, CyberPanel knowledge base
- aaPanel download page
- aaPanel home page
- aaPanel licence file, GitHub
- Managed Web Server product page, CloudAcropolis