Six panels, one site

You have one website. One. Your blog, the firm's site, a client's little app. It sits on a five-euro VPS and it works. Sooner or later the question comes: do I put a control panel on it, or keep doing everything from the terminal?

The honest answer is that for a single site a panel is not compulsory. nginx, PHP-FPM, MariaDB and certbot take twenty minutes to install, and certbot renews the certificates on its own. If you can do those four things, a panel only buys you convenience — and it adds a door onto the internet that was not there before. Keep that in mind, because it comes back at the end.

If you do want a panel — because someone else touches the site, because you want to see your backups without opening a shell, because in six months you will not remember how any of it works — the real choice comes down to six names.

The candidates

CloudPanel is free and asks for nothing in return. It runs on Debian 11 and 12 and on Ubuntu 22.04 and 24.04, installs nginx, PHP-FPM, Redis and Node.js, and is built with a declared obsession for simplicity. It does not do mail, and not by oversight: asked to add Postfix and Dovecot, the maintainers answered "No email planned, there are many good reasons to not do that". Point your MX at an external service and move on.

HestiaCP is the opposite: free, GPLv3, and it installs everything. Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04; nginx in front of Apache, Exim and Dovecot for mail, BIND for DNS, MariaDB, vsftpd, fail2ban, ClamAV and SpamAssassin. It needs 1 GB of RAM and 10 GB of disk (without antivirus and antispam). It is VestaCP's heir, it has a living community, and it belongs to no company.

Koapanel has a free tier of up to three sites with every feature — mail included — on Ubuntu 24.04. The panel holds a measured 14 MB of RAM, updates itself with signed binaries and rolls itself back if an update stops answering. But the free tier is for personal use: if the site is for work or for a client, it is €7.90 a month. And it is a product that has only just shipped, with no years of production behind it. We wrote about it here.

Plesk Web Admin costs €14.29 a month for ten domains. For one site that is expensive, but it is the only one here that also runs on Windows, on seven Linux distributions, with Apache and the .htaccess rules your old shared hosting left you. It needs 1 GB of RAM plus 1 GB of swap.

cPanel Solo costs $29.99 a month — about €26 — for one single account. It is the panel everyone knows, the one your sysadmin can drive blindfolded. It asks for 2 GB of RAM (4 recommended) and 20 GB of disk. Over three years that is nearly €940. For one site.

CyberPanel and aaPanel are free, widespread and sit at the top of half the listicles online. More on them below.

In one table

	Cost for 1 site	Mail on the server	Operating system	Web server
CloudPanel	€0	no, by choice	Debian 11-12, Ubuntu 22.04-24.04	nginx
HestiaCP	€0	yes (Exim + Dovecot)	Debian 12-13, Ubuntu 22.04-26.04	nginx + Apache
Koapanel	€0 personal / €7.90 work	yes, optional	Ubuntu 24.04	nginx
Plesk Web Admin	€14.29	yes	7 distributions + Windows	Apache + nginx
cPanel Solo	$29.99 (~€26)	yes	AlmaLinux, Ubuntu 24.04, others	Apache
No panel at all	€0	whatever you install	whatever you like	whatever you like

The sum nobody does: attack surface

A control panel is a program that runs as root, creates system users and listens on a public port. It is the juiciest target you can put on a server.

This is not theory. In late October 2024 CyberPanel had a maximum-severity flaw — CVSS 10.0, CVE-2024-51378 — that let anyone bypass authentication and run commands remotely. Censys counted around 61,000 exposed portals; within days at least three ransomware families (PSAUX, C3RB3R and a Babuk variant) were encrypting the servers of everyone who had not updated, tens of thousands of machines. The people with one site and nobody watching for updates found it encrypted the next morning.

The lesson is not "CyberPanel is bad" — the hole was closed, and any software can have one. The lesson is that for someone with a single site, one thing matters more than any feature list: that the panel updates itself, and that you notice when it cannot. It is the only row in the table that can cost you the website.

On that score: CloudPanel and HestiaCP update through the system's packages (and Ubuntu can install security updates by itself); Plesk and cPanel have their own updaters, proven over years; Koapanel downloads signed updates, verifies them and rolls them back by itself if the panel does not answer within a minute — on paper the most careful mechanism of the group, and also the one with the fewest miles on it.

So which one

If the site is yours, personal, and you do not need mail on the server: CloudPanel. Free, light, does one job well, and will still be asking nothing three years from now.

If you need mail too: HestiaCP. Free, complete, owned by nobody, and a 1 GB VPS and ten minutes are enough. It is the boring choice, and that is a compliment.

If the site is for work and you want mail and the conveniences in a free plan, Koapanel is the richest offer on paper — every feature, antimalware, WordPress staging, 14 MB of RAM — but the free tier is personal-use only and the product is very young. On a site that pays the bills, today, it is a bet; on a project of your own, it is the most interesting thing around. Let's talk again in six months, once it has some production behind it.

If you are coming from shared hosting with Apache, .htaccess and a sysadmin who knows cPanel, pay up: Plesk Web Admin at €14.29 saves you a week of conversions. cPanel Solo at $29.99 for a single site makes sense in exactly one case: your work depends on somebody who only knows that one.

And if you got this far thinking "but I can do all of this from the command line": then install nothing. Twenty minutes of nginx and certbot, Ubuntu's automatic security updates, and you have one open door fewer.