CyberPanel, aaPanel and HestiaCP Installation: Free Control Panel Alternatives

You got a VPS and want to run a few websites, email accounts and databases on it, but you don't want to manage everything from the command line. cPanel and Plesk are the first names that come to mind, but both charge a monthly license based on accounts or sites, and on small projects that fee can cost more than the server itself. The good news is there are free control panel alternatives that get the job done. In this post we compare the three most popular ones, CyberPanel, aaPanel and HestiaCP, and walk through installing each on a server step by step.

CyberPanel vs aaPanel vs HestiaCP

Before Installing: Common Preparation

A few rules apply to all three panels, and ignoring them causes most installation problems:

• Use a clean server. Panels install their own web server, PHP and database. On a server with Apache, Nginx or MySQL already installed, the install can fail halfway.
• Don't install more than one panel on the same server. They all try to manage the same ports and services, and the result is usually a broken system.
• Set a hostname and create an A record in DNS pointing that name to the server IP.

apt update && apt upgrade -y

# give the server a hostname in domain form (FQDN)
hostnamectl set-hostname panel.example.com

# output should be empty: no web server / database installed beforehand
dpkg -l | grep -E "apache2|nginx|mysql-server|mariadb-server"

If you don't have a server yet and wonder about the difference between VPS and VDS, have a look at our what is VDS, what is VPS post.

Installing CyberPanel

CyberPanel is a free panel built on the OpenLiteSpeed web server. Thanks to LiteSpeed's cache plugin (LSCache) it performs really well, especially for WordPress sites. The install is one command as root:

sh <(curl https://cyberpanel.net/install.sh || wget -O - https://cyberpanel.net/install.sh)

The install script asks a few questions; in most cases these choices make sense:

1. Choose Install CyberPanel and pick the free OpenLiteSpeed as the web server.
2. If you'll use mail and DNS, choose full installation (PowerDNS, Postfix, Pure-FTPd).
3. Answer no to remote MySQL unless you have a seperate database server.
4. Set the admin password yourself; don't use the default password option.
5. Memcached and Redis extensions are optional.

The install takes 10–30 minutes depending on the server. When it's done you can reach the panel in your browser (username admin):

https://SERVER_IP:8090

First, add your site with Websites → Create Website and get a free Let's Encrypt certificate under SSL → Manage SSL. WordPress can be installed with one click from the Applications section.

Installing aaPanel

aaPanel is a free panel known for its clean, handy interface. It lets you choose Nginx, Apache or OpenLiteSpeed as the web server, and you install PHP versions, databases and services like Redis by clicking in the app store. It also has the lowest resource needs of the three. Install:

wget -O install.sh https://www.aapanel.com/script/install_7.0_en.sh && bash install.sh aapanel

# to see the login URL and credentials again later
bt default

The install takes a few minutes and at the end it prints the panel URL (with the port and a random security path), username and password. Write these down; the panel won't open without the security path. On first login aaPanel suggests a software bundle: Nginx-based LNMP or Apache-based LAMP. For PHP sites like WordPress, LNMP is a good start.

Then add your domain with Website → Add site and get a Let's Encrypt certificate from the site's SSL tab. We recommend changing the default username, password and port in the panel settings.

Installing HestiaCP

HestiaCP is a fully open-source panel developed as the successor of the old VestaCP. It's lightweight, stable and a great fit for anyone who wants to manage web, mail and DNS together. At the time of writing the current series is 1.10.x. First download the install script:

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh

# list all install options
bash hst-install.sh -h

# example: a lighter install without Apache and antivirus
bash hst-install.sh --hostname panel.example.com --email admin@example.com \
  --apache no --clamav no --spamassassin no

The script lets you pick which components to install with flags. For example the antivirus (ClamAV) and SpamAssassin use alot of RAM; on a small server without much mail traffic it makes sense to turn them off. Rather than passing the password as a flag, it's safer to let the script generate one and change it later; the password is shown at the end of the install and sent to your email.

The install takes 10–20 minutes and at the end it asks you to reboot the server. Panel address:

https://SERVER_IP:8083

In the panel, first create a seperate user for yourself (running sites under normal users instead of the admin account is safer), then add your domain with Web → Add Web Domain and tick the SSL box to enable Let's Encrypt. If you like the command line, everything in HestiaCP has a v- command equivalent:

# optionally from the command line instead of the panel: add a site + get SSL
v-add-web-domain admin example.com
v-add-letsencrypt-domain admin example.com

Ports and Firewall

The panels have their own firewall management too; if you use UFW, here are example rules:

ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp

# open the panel port only to your own IP (the line for your panel is enough)
ufw allow from YOUR_IP to any port 8090 proto tcp   # CyberPanel
ufw allow from YOUR_IP to any port 7800 proto tcp   # aaPanel
ufw allow from YOUR_IP to any port 8083 proto tcp   # HestiaCP
ufw enable

Common Problems

Which One Should You Pick?

Whichever you choose, a panel is a management convenience; keeping up with updates and backups is still on you. Don't skip backing up sites and databases off the server (S3, FTP, another server) with the panel's backup feature.

Which VECDC Plan for a Control Panel?

For a few websites, VPS-1 (2 Core, 8 GB RAM, 40 GB NVMe) easily covers the requirements of all three panels. If you'll run many sites, a mail server and antivirus/spam filtering, VPS-2 (4 Core, 12 GB) or VPS-3 (4 Core, 16 GB) is a more comfortable choice. VECDC virtual servers come with dedicated CPU, NVMe disks and a 1 Gbps connection from $6/month, are ready in about 5 minutes with automated setup, and you can choose the location when ordering.

Since panels want a clean server, we recommend installing on a standard VPS with Ubuntu 24.04 or Debian 12 rather than the Developer VDS that comes with Docker preinstalled. If the cloud server concept is new to you, our what is a cloud server post may help too.

Frequently Asked Questions

In Short

If you don't want to pay for cPanel or Plesk licenses, CyberPanel, aaPanel and HestiaCP are good alternatives. CyberPanel stands out for WordPress performance, aaPanel for ease and low resource use, and HestiaCP for being open source and managing web + mail + DNS together. All three install on a clean VPS with one command, and as long as you restrict the panel port and keep it updated, they run without trouble for a long time. If you get stuck during setup, drop us a message, theres always someone to help.