cPanel Alternatives for a Linux VPS

Which cPanel alternatives can you install on a VPS today

The free cPanel alternatives you can install on a Linux VPS today are Virtualmin, ISPConfig, CyberPanel, HestiaCP, CloudPanel and Froxlor. Each installs from a script onto a fresh server, and each one leaves out something cPanel does. The choice is really about which missing piece you can live without, and how many hours you will spend moving.

cPanel is two programs. WHM is the server side. cPanel is the per account side. Together they own Apache virtual hosts (vhosts), PHP versions, MySQL users and grants, DNS zones, Exim and Dovecot mail, FTP accounts, cron jobs, certificates and per account backups. A panel writes and owns the configuration files on your server, rather than sitting on top of them as a web interface. That is why every project below tells you to start from a fresh operating system.

What cPanel costs, and where the real cost hides

[
  {
    "plan": "Solo",
    "usd_per_month": 29.99,
    "accounts_max": 1
  },
  {
    "plan": "Admin",
    "usd_per_month": 35.99,
    "accounts_max": 5
  },
  {
    "plan": "Pro",
    "usd_per_month": 53.99,
    "accounts_max": 30
  },
  {
    "plan": "Premier",
    "usd_per_month": 69.99,
    "accounts_max": 100
  }
]

Those are the published monthly prices per server, read from cPanel's pricing page in August 2026. A Solo licence covers one account at 29.99 USD a month. Premier covers 100 accounts at 69.99 a month, with extra accounts billed on top. Paying annually takes a little off.

The licence is the number everyone quotes. The hours are the number that decides, and those hours are priced further down this page.

How much RAM does a control panel need?

Two different numbers matter here, and mixing them up is why people put a full panel on a 1 GB VPS and then wonder why the box swaps.

[
  {
    "label": "Virtualmin, mini install",
    "min_ram_gb": 1
  },
  {
    "label": "HestiaCP, no mail filtering",
    "min_ram_gb": 1
  },
  {
    "label": "CloudPanel",
    "min_ram_gb": 2
  },
  {
    "label": "Coolify",
    "min_ram_gb": 2
  },
  {
    "label": "Virtualmin, full stack",
    "min_ram_gb": 4
  }
]

Those are published minimums taken from each project's own documentation, not measurements from an idle box. ISPConfig, CyberPanel and Froxlor publish no figure, so they are missing from the chart rather than guessed at. Read the first row and the last row together: the same software asks for 1 GB without mail and 4 GB with it.

The second number is what the services under the panel consume, and it dwarfs the panel itself. Virtualmin's low memory page prices the parts.

[
  {
    "label": "ClamAV virus scanning",
    "typical_ram_mb": 2048
  },
  {
    "label": "SpamAssassin",
    "typical_ram_mb": 1024
  },
  {
    "label": "MySQL or MariaDB",
    "typical_ram_mb": 400
  },
  {
    "label": "Apache",
    "typical_ram_mb": 250
  },
  {
    "label": "PHP",
    "typical_ram_mb": 100
  },
  {
    "label": "The panel itself",
    "typical_ram_mb": 30
  }
]

ClamAV is listed at 2048 MB and SpamAssassin at 1024 MB, while the panel process sits near 30 MB. The panel is the cheapest thing on the server. Mail filtering is the expensive thing, so a panel with no mail server runs fine on 2 GB, and a stack with mailboxes, spam filtering and virus scanning wants 4 GB. Give it less and it competes with your PHP workers for memory all day.

Virtualmin: the closest match to cPanel and WHM

Virtualmin runs on top of Webmin and has the same shape cPanel has: a server view for the admin, a per domain view for the site owner, and resellers above that. It is the only option here with a documented importer for cPanel account archives.

sudo sh -c "$(curl -fsSL https://download.virtualmin.com/virtualmin-install)" -- --bundle LAMP

Swap in --bundle LEMP for Nginx. Add --type mini for the light install, which skips local mail, spam and virus filtering, local DNS, FTP and Jailkit while keeping the full web stack. The installer supports Red Hat Enterprise Linux, AlmaLinux and Rocky Linux 8, 9 and 10, Debian 12 and 13, and Ubuntu 22.04 and 24.04 LTS (long term support). Anything else is outside what the automated script covers.

Import a cPanel account archive from the command line.

virtualmin migrate-domain --source /root/backup/example.com.tgz --type cpanel --domain example.com --user exampleuser

The command should report the new virtual server, which then appears in the domain list. When it fails it usually fails on the archive: a partial cPanel backup, or one written by a much newer cPanel than the importer knows, does not restore cleanly. The same tool takes Plesk and DirectAdmin archives with --type plesk or --type directadmin.

What it does badly: the interface is Webmin's, so one page can hold forty form fields with no obvious default. If you have already worked with Webmin on Ubuntu 24.04 you know the feel of it. Virtualmin also ships as a free GPL edition and a paid Pro edition, and the free interface advertises Pro features in place, which some people find irritating.

ISPConfig: one panel, several servers

ISPConfig is the answer when web, mail and DNS live on different machines. One control panel drives them all, which no other project on this page does for free. Its README gives a piped installer. Download it first so you can read it and list its flags.

curl -fsSL https://get.ispconfig.org -o ispconfig-install.sh
less ispconfig-install.sh
sudo sh ispconfig-install.sh --help
sudo sh ispconfig-install.sh

The autoinstaller supports Debian 11 and 12 and Ubuntu 22.04 and 24.04, on x86_64 only. ARM is not supported, so an arm64 VPS rules ISPConfig out before you start. The installer reconfigures the whole server, so it belongs on a fresh operating system and nothing else.

What it does badly: there is no cPanel importer, so every site and every mailbox moves by hand. The interface is plain and dense, and it assumes you already know what a vhost, a jailed shell user and a DNS zone are.

CyberPanel: OpenLiteSpeed, and a security record worth reading

CyberPanel is built around OpenLiteSpeed, and it is the quickest of these panels to get a cached WordPress site running. Install it as root.

sudo su -
sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)

Run that line from bash. The <(...) form is process substitution, which is a bash feature, so a plain sh or dash shell rejects the line with a syntax error before anything downloads. Supported systems are Ubuntu 24.04, 22.04 and 20.04, AlmaLinux 8, 9 and 10, Rocky Linux 8 and 9, RHEL 8 and 9, CloudLinux 8 and CentOS 9, on x86_64.

It has a cPanel importer. Put the account archives in one directory and point the importer at it.

/usr/local/CyberCP/bin/python /usr/local/CyberCP/plogical/cPanelImporter.py --path /home/backup

The importer prints the path of its log file first. When a site does not appear in the panel afterwards, that log names the account and the step that failed.

What it does badly is more serious than interface taste. In October 2024 an unauthenticated remote code execution flaw in CyberPanel 2.3.6 and 2.3.7, tracked as CVE-2024-51378, was mass exploited. Attackers ran commands as root over the network and encrypted the servers with PSAUX ransomware. Reports at the time counted more than 22,000 exposed instances, and the flaw went into the CISA catalogue of known exploited vulnerabilities. The lesson generalises to every panel here: a control panel is a root shell with a login form in front of it. Do not leave its port open to the whole internet. Restrict it to your own address with a ufw rule on the VPS, or reach it over a WireGuard tunnel you host yourself, and patch it the week a release lands. OpenLiteSpeed also treats .htaccess differently to Apache, applying rewrite changes when the server restarts rather than on each request, so an application that rewrites that file at runtime behaves differently than it did on cPanel.

HestiaCP: the simplest full stack

HestiaCP is a maintained fork of VestaCP, and it is the shortest path to a working web, mail and DNS box with a clean interface. Run the installer as root on a fresh system.

sudo -i
wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh

The script asks its questions interactively, then prints the panel URL and the admin login at the end and offers a reboot. HestiaCP supports Debian 11 and 12 and Ubuntu 22.04 and 24.04, on x86_64 and arm64, and its stated minimum is 1 core, 1 GB of RAM and 10 GB of disk with SpamAssassin and ClamAV left off. That arm64 support matters if your VPS is an ARM instance, because it rules ISPConfig and CyberPanel out and leaves Hestia in.

What it does badly: there is no documented cPanel importer, so sites and mailboxes move by hand. It manages one server, not a fleet. The default layout puts Nginx in front of Apache, which is fine until you debug a redirect loop and have to work out which of the two produced it.

CloudPanel: fast, and it does not do mail

CloudPanel is Nginx only, with a short interface and sensible PHP defaults. Check the licence before you commit. It is free of charge and its code is published, but it is source available rather than open source under an OSI approved licence, and it is developed by one company. That is a real difference from the others on this page.

curl -sS https://installer.cloudpanel.io/ce/v2/install.sh -o install.sh
echo "8146dbe0a488e7088b04071b0c34d59aa0ab1fe9dcec382d395fd155c9e6c476 install.sh" | sha256sum -c
sudo DB_ENGINE=MYSQL_8.4 bash install.sh

The checksum line must print install.sh: OK before you run anything. That hash changes with every installer release, so copy the current one from CloudPanel's own installation page on the day you install, not from any article, including this one. Use DB_ENGINE=MARIADB_11.4 if you prefer MariaDB. Supported systems are Ubuntu 22.04, 24.04 and 26.04 and Debian 11, 12 and 13, on x86 and ARM64, with a stated minimum of 1 core, 2 GB of RAM and 10 GB of disk.

What it does badly: no mail server and no DNS server. If you are leaving cPanel and your users have mailboxes on it, CloudPanel does not replace what you had. Mail then becomes a separate machine, such as a self hosted Mailcow mail server, and DNS moves to your registrar or a DNS provider.

Froxlor: light, and it expects you to know your stack

Froxlor is the smallest of these. It manages customers, domains, PHP-FPM pools and quotas, and it writes configuration for services you installed and tuned yourself. Install it from the project's apt repository.

sudo apt -y install apt-transport-https lsb-release ca-certificates curl gnupg
sudo curl -sSLo /usr/share/keyrings/deb.froxlor.org-froxlor.gpg https://deb.froxlor.org/froxlor.gpg
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.froxlor.org-froxlor.gpg] https://deb.froxlor.org/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/froxlor.list'
sudo apt update && sudo apt install froxlor

On Ubuntu, change deb.froxlor.org/debian to deb.froxlor.org/ubuntu in that source line. Froxlor documents Debian 11, 12 and 13 and Ubuntu 22.04 and 24.04, with PHP 7.4 up to 8.5 and MySQL 8.4 or MariaDB 11.7 in its current documentation. After the package installs you finish setup in the browser, then point Froxlor at Apache or Nginx.

What it does badly: it hands you the least. There is no importer and no bundled mail stack you did not install. If you are comfortable building a LAMP stack on Ubuntu 24.04 by hand, Froxlor is a customer facing layer on top of that work. If you are not, it will feel unfinished.

The two honest answers that are not a panel

The first is a reverse proxy plus compose files. Each application runs as a container, one file per app, and a proxy in front terminates TLS (transport layer security) and routes by hostname. That is Traefik in front of several Docker Compose apps, built on the Compose basics on a VPS. It suits one operator running their own applications. It does not suit customers who need to log in and change their own PHP version.

The second is a platform as a service (PaaS) style panel. Coolify deploys from a git repository, builds the image and manages the proxy for you.

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash

Coolify asks for 2 cores, 2 GB of RAM and 30 GB of free disk, and its own interface listens on port 8000 once the script finishes. It is a deployment tool, so there are no mailboxes and no per customer hosting accounts in the cPanel sense. The comparison of Cloudron, CasaOS and Coolify covers where each of those sits.

If the reason you had cPanel is that other people log in and manage their own site and mailbox, neither answer fits, and your list is Virtualmin, ISPConfig or HestiaCP.

The migration questions that decide a real switch

Does it import cPanel backups? Virtualmin and CyberPanel document importers. ISPConfig, HestiaCP, CloudPanel and Froxlor do not, so files, databases and mailboxes move by hand. Even a clean import carries content rather than configuration: document roots, databases and mail accounts come across, while PHP handler settings, custom Apache directives and anything you tuned in WHM do not.

Does it do mail? Virtualmin in its full install, ISPConfig, HestiaCP, CyberPanel and Froxlor all manage mailboxes. CloudPanel and Coolify do not. Mail is the expensive half of any move. Mailbox passwords are stored hashed, so they do not transfer as plain text and every user resets. Messages have to be copied with an IMAP (internet message access protocol) sync tool such as imapsync. The mail authentication records, SPF, DKIM and DMARC, have to be correct for the new server before you cut over, or your mail lands in spam folders on day one.

Does it do DNS? Virtualmin, ISPConfig, HestiaCP and CyberPanel run an authoritative nameserver for you. CloudPanel and Coolify do not. Many people running a handful of sites keep DNS at their registrar or a DNS provider, which removes the question and one more listening service from the box.

What happens to your existing vhosts? They are at risk, which is why every installer here says fresh operating system. These scripts write into the web server, database and mail configuration directories and restart those services, so running one on a server that already hosts sites can overwrite the configuration those sites depend on. Build on a second VPS, move the sites, test with a hosts file entry, then move DNS. Lower the time to live (TTL) on your records to 300 seconds a day before the cutover, and keep the old server running for a week after it.

What about certificates? Every panel here automates Let's Encrypt issuance and renewal. Drop the panel and that job becomes yours, which is Certbot with Nginx on Ubuntu 24.04 and a renewal timer you check once a quarter.

The cost nobody writes down

The licence is the small number. The move is the large one. For a single WordPress site the work is one evening: copy files, dump and import the database, reissue the certificate, change DNS. For twenty customer accounts with mailboxes it is a week of evenings, and the tail after it runs longer than the move. You take the support questions that cPanel's interface used to absorb. You answer "where is my email password" for everyone whose mail client stopped connecting. You own the panel's own security updates from then on, and CVE-2024-51378 is what owning that looks like on a bad week.

Two habits make the tail shorter. Give each site its own system user instead of running everything under one account, which is the practice in least privilege users on a VPS and which every panel here does by default. And restore one site from your new backups before you switch DNS, not after.

None of this says cPanel is bad software. It says the licence buys a support contract and twenty years of hosting industry defaults. If you run your own sites on your own server, that is a support desk you are already acting as.

FAQ

Which free cPanel alternative can import a cPanel backup?

Virtualmin and CyberPanel are the two with documented importers. In Virtualmin you run virtualmin migrate-domain --source /root/backup/example.com.tgz --type cpanel --domain example.com, and the same tool accepts Plesk and DirectAdmin archives. In CyberPanel you place the archives in one directory and run the bundled importer at /usr/local/CyberCP/plogical/cPanelImporter.py with the --path flag. Both restore content rather than configuration, so PHP handler settings, custom Apache directives and WHM tuning still have to be redone by hand.

How much RAM does a control panel need on a VPS?

The panel process is small, near 30 MB by Virtualmin's own estimate. What costs memory is the stack underneath it, and mail filtering dominates: ClamAV is published at around 2 GB and SpamAssassin at around 1 GB. A panel with no mail server, such as CloudPanel, fits a 2 GB VPS. A full hosting stack with mailboxes, spam filtering and virus scanning wants 4 GB. On 1 GB you either run a mini install with mail turned off, or you add swap and accept that the machine will use it.

Do I need a control panel on a VPS at all?

No. If you are the only person who logs in, a panel mostly adds attack surface, because it is a privileged web application listening on a port. A reverse proxy with one Compose file per application does the same job with less software exposed. A panel earns its place when other people need to manage their own sites, mailboxes and databases without shell access, since building that interface yourself is far more work than running one.

Can I install a panel on a server that already hosts sites?

Treat it as unsupported. Virtualmin, ISPConfig, CyberPanel and HestiaCP all instruct you to start from a fresh operating system, because their installers write the web server, database and mail configuration and restart those services. Installing on a live box can overwrite the configuration your sites depend on, and there is no undo. Build the panel on a new VPS, migrate site by site, then move DNS once the new server serves the same pages.

Which cPanel alternatives handle email?

Virtualmin in its full install, ISPConfig, HestiaCP, CyberPanel and Froxlor all manage mailboxes and the DNS records that go with them. CloudPanel and Coolify do not touch mail. Decide this question first if mailboxes are why you are on cPanel, because it removes two of the seven options here, and mail is the part of the migration that takes the longest.