CyberPanel is a free, open-source hosting control panel built around OpenLiteSpeed, the open-source edition of the LiteSpeed web server. It can also run LiteSpeed Enterprise if you have a licence. Its big selling point is speed, especially for WordPress, thanks to LiteSpeed's built-in page cache (LSCache).
Main features
Websites: add domains and child domains, choose PHP (LSPHP) versions, one-click WordPress with LSCache.
Free SSL: Let's Encrypt for sites, mail and the panel itself.
Email: Postfix and Dovecot, webmail, and DKIM.
DNS: built-in PowerDNS, so the server can host its own zones.
Databases, FTP, file manager, backups, plus a Docker manager and a firewall.
Multi-user: packages and reseller accounts if you host for clients.
New CyberPanel install, email works, but almost everything I send lands in the recipient's spam folder (Gmail and Outlook both). What do I need to set up?
Short answer for anyone finding this later: deliverability depends mostly on DNS and your server's reputation, not the panel. Check these in order:
SPF: a TXT record on your domain listing who may send mail for it, e.g. v=spf1 a mx ip4:YOUR.SERVER.IP ~all
DKIM: generate a key in CyberPanel (Email, DKIM Manager) and add the TXT record it shows to your DNS.
DMARC: start with a monitoring policy, e.g. a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected]
Reverse DNS (PTR): set it at your VPS provider so your server IP resolves back to your mail hostname (e.g. mail.example.com). Many providers block port 25 or PTR changes until you ask support.
Hostname: the server hostname should match the PTR and have an A record.
Blacklists: check your IP on a blacklist lookup site. A recycled VPS IP may already be listed.
Then send a test to a mail-testing service to see a score and exactly what's missing. Post your results here if you're still stuck (hide your real domain if you prefer).
FASTPANEL is a free hosting control panel developed by the team behind the FASTVPS hosting company. It's aimed at people who host several websites on their own server and want a clean, modern interface without paying for a licence.
Main features
Web stack: Nginx in front, with Apache or PHP-FPM behind it, and several PHP versions you can pick per site.
Site isolation: each site can run under its own system user, which limits the damage if one site is hacked.
Free SSL with Let's Encrypt.
Databases, FTP/SFTP users, file manager, cron and backups.
Mail and DNS management.
Multi-user: give clients or developers access to only their own sites.
Good to know
Install it on a clean, supported Linux distribution (Debian and Ubuntu are the usual choices). Check the official site for the current list.
The free licence needs a quick registration during setup.
After installation the panel is reached in the browser on its own port; the installer prints the address and login.
FASTPANEL is a good fit if you want something simpler than cPanel-style panels, with per-site users and multiple PHP versions built in.
What is aaPanel?
aaPanel is a browser-based control panel for Linux servers. It helps you manage websites, PHP, databases, certificates, files and backups from one dashboard. Its core is free, while Pro features and some plugins or services may cost extra. You still need to pay for your server and domain.
Review status: Official documentation reviewed 9 October 2026. This introduction is not a hands-on benchmark or a claim that a specific release has been tested. Original VPS walkthroughs and screenshots are pending.
What can it manage?
Website domains, document roots, PHP selection, rewrites and redirects.
Web-server and database software through the supported panel workflow.
Website certificates, file management and scheduled jobs.
Website/database backups and supported remote-storage integrations.
Available features depend on the edition, plugins and installed versions. Check compatibility and licensing before relying on a feature. Installing a panel does not replace Linux administration, updates or a recovery plan.
Before installing
Use a clean supported Linux server and check the current OS/architecture requirements in aaPanel Quick Start. Do not install it over another hosting panel or an existing production stack without a supported migration plan. Size RAM, CPU and disk for your application, database, backups and traffic; an installation minimum is not a production capacity guarantee.
The installer prints a management URL, entrance path and credentials. Store these privately. The trusted server console can display the current panel details with:
Code:
bt default
That output is sensitive: do not post it in the forum or include it in a public screenshot. Running bt opens the panel maintenance menu; read each option before using it.
Common questions Does aaPanel provide the VPS itself?
No. The panel is software installed on a server you obtain separately.
Are all features free?
No. Check the current edition and individual plugin/service terms. A free core does not mean every add-on is included.
Does every SSL certificate renew automatically?
No. Renewal depends on the validation method, credentials and scheduled jobs. aaPanel documents that manual DNS TXT validation does not provide automatic renewal. Monitor expiry and verify your chosen renewal process.
Can it serve unrelated hosting customers?
Evaluate the intended permissions, isolation, limits and recovery workflow before choosing it for customer hosting. A sub-account alone is not proof of isolation.
Official references:Quick Start; Website and SSL management. For help, share your OS, aaPanel release, web server and a redacted error, not credentials.
How do you secure aaPanel after installation?
Restrict management access, use trusted HTTPS and strong authentication, keep the panel and software updated, and prove an off-site backup restore. Test a new login after each access change while keeping SSH and the provider console available.
Scope and review: Documentation reviewed 9 October 2026. Menu names depend on the aaPanel release. Fresh-VPS testing and screenshots are pending; no exact release is claimed as tested. Record your OS and panel version before following this checklist.
1. Confirm recovery before changing access
Check that the provider console and a fresh SSH login work. Save current settings and the actual panel port privately. Keep the installation-generated entrance path confidential. It reduces casual discovery but is not a replacement for authentication or a firewall.
Changing the panel port is optional. If you do change it, permit the new port in both firewall layers first, test it, then remove the old rule when appropriate.
2. Use strong authentication
Replace initial credentials with a unique password and enable the supported authenticator/2FA feature. Store recovery information privately and test a fresh session before closing the original. Disable unused API access; protect and limit any credentials you need.
3. Verify trusted panel HTTPS
Panel SSL is separate from website SSL. Use a certificate matching your management hostname and verify its chain and renewal process. A self-signed certificate needs an independently verified trust procedure; an unexplained browser warning is not proof of the correct server. Avoid plain HTTP for panel credentials.
If binding a management domain, prove DNS and HTTPS first. Domain binding can change which URL allows access, so keep a recovery path.
4. Restrict management traffic
Allow the actual management port only from your fixed IP or VPN where practical, using both provider and guest firewall rules. Check how IPv6 is handled. If your IP changes, update the allowlist through the trusted recovery path. Do not disable the whole firewall to fix one rule.
A basic public website needs its web ports; the panel, databases and caches should not be broadly exposed. Open mail or FTP ports only when deliberately deploying those services.
5. Verify SSH-key access before disabling passwords
Create and test a named administrator with keys and sudo first. Validate SSH configuration, inspect effective settings and test a new connection before removing the old access method. Follow the VPS access and firewall checklist for Ubuntu/Debian examples; adapt it to your OS and MFA requirements.
6. Maintain updates and recoverable backups
Use supported panel/plugin/runtime updates and check OS-update compatibility. Schedule website and application-consistent database backups, store a copy outside the VPS, and test restoration into an isolated destination. Monitor backup age, disk space, failed jobs and certificate expiry.
Verify before calling it finished
A fresh trusted panel login and your intended 2FA flow work.
Management access is limited as intended over IPv4 and IPv6.
SSH and the provider recovery console remain available.
Renewal, update and backup jobs are monitored.
An off-site restore has been checked.
Locked out? Check the actual port, current source IP, bound hostname and entrance path through the trusted console. Use the documented bt maintenance menu only after identifying the cause; do not remove protections indiscriminately.
Where are aaPanel website files and logs?
On a standard installation, site files commonly live under /www/wwwroot/ and site logs under /www/wwwlogs/. Panel-managed software and configuration are commonly under /www/server/. Always confirm the selected site's document root and active service configuration; these examples are not universal paths.
Scope and review: Documentation reviewed 9 October 2026. These are common Linux aaPanel layouts. Custom roots, versions and web servers can differ. Exact paths and screenshots will be checked on the tutorial VPS; PHP 8.3 below is an example, not a version recommendation.
Replace example.com with the actual site. Open its aaPanel document-root and log controls to confirm the location. For frameworks, the public/running directory may be a subdirectory of the project. A blank or absent log is not evidence that the application is healthy.
These are location examples, not commands to execute. Nginx, Apache and OpenLiteSpeed use different configurations. Prefer the panel's supported editor, save a backup and validate the correct service configuration before applying a change. Panel-generated files may be regenerated later.
Replace 83 with the installed version selected for the site. Confirm the actual listen value and upstream path: the command-line PHP version can differ from the website's PHP version. The socket is a service endpoint, not a file you should create manually.
4. Common data, panel and backup directories
Code:
/www/server/data/
/www/server/panel/
/www/backup/
Do not copy live database files as a substitute for a consistent database backup. Confirm the active data/backup paths in your configuration. A backup on the same disk does not protect against losing the server. Keep exports, archives and private configuration outside the site's public directory.
5. Read the relevant error, then verify
A read-only example for a confirmed site error-log path:
Reproduce the failing request once and correlate its time with the new log entry. Check both the web-server error and the relevant PHP/application log. Logs can contain credentials or personal data: redact them before sharing.
If a path is missing: Check whether the service is installed, which stack/version is active, and whether the site uses a custom directory or disabled logging. Do not create a guessed socket, recursively change permissions or delete files to make the example match.
How do you fix a 502 after changing PHP version in aaPanel?
Check the site's Nginx error log, confirm its selected PHP version, and verify that the matching PHP-FPM service is healthy and listening where Nginx expects it. Restore the last working selection if necessary and application-compatible. A 502 alone does not identify the cause.
Scope and review: Documentation reviewed 9 October 2026. This covers Nginx with panel-managed PHP-FPM after a PHP-version change, not every 502 or an OpenLiteSpeed/Apache deployment. Fresh-VPS reproduction and screenshots are pending. Record aaPanel, OS, Nginx and PHP versions. PHP 8.3 and example.com below are placeholders.
1. Correlate the failure with the site's error log
Confirm the actual log path in aaPanel and reproduce one failing request:
connect() to unix:/tmp/php-cgi-83.sock failed (2: No such file or directory)
Nginx cannot find that configured Unix endpoint. The selected service may be stopped, may have failed to start, or may listen somewhere else. Confirm both sides before changing configuration.
Different messages need different checks:
Permission denied: inspect socket ownership/mode and security-policy denials; do not use chmod 777 or disable security globally.
Connection refused: check whether the configured listener is active.
Upstream timed out: investigate slow application/database work and resource pressure; do not blindly increase timeouts.
2. Check the selected PHP service
Prefer the panel's PHP service controls. If this installation uses the documented init script, an example status check is:
Code:
sudo /etc/init.d/php-fpm-83 status
ls -l /tmp/php-cgi-83.sock
A socket file alone is not proof of a healthy service. Compare the site's upstream with PHP-FPM's configured listen endpoint. Do not create the socket yourself or change the application's PHP version without compatibility checks.
3. Inspect startup/configuration errors
A configuration check for this example installation:
Code:
sudo /www/server/php/83/sbin/php-fpm -t
If validation fails, read the reported file and setting. Possible causes include invalid configuration or an incompatible/missing extension. Install only extensions required by the application for the selected PHP version; do not disable arbitrary extensions or security controls as a shortcut. After correcting the cause, start the affected service through the panel. If using the matching init script:
Code:
sudo /etc/init.d/php-fpm-83 start
Changes to a shared PHP service can affect other sites using it.
4. Validate Nginx only if its configuration changed
Use the panel-managed binary on this example installation:
Code:
sudo /www/server/nginx/sbin/nginx -t
Do not reload if validation fails. If validation passes and the configuration was deliberately changed, use the supported panel reload control. Restoring PHP-FPM alone may resolve the failure without changing Nginx.
5. Verify recovery and keep a rollback path
The selected PHP service stays running and the expected listener is active.
A real PHP/application route loads, not just a static HTML page.
A new request produces no matching upstream error.
Other sites using that PHP version still work.
Required extensions and application/database operations are checked.
If a live site remains down after a version switch, consider restoring its previous working PHP selection through the panel while diagnosing, provided the application still supports it. Back up settings before further changes.
For help: Share the version details, selected PHP version, time of failure and a few redacted error lines. Do not share credentials, tokens or a full configuration dump.
AdminsForum is a community for people who run servers and hosting: sysadmins, developers, freelancers, small hosting companies and anyone managing their own VPS.
What we focus on
Free & open-source control panels: aaPanel, CyberPanel, FASTPANEL, HestiaCP and CloudPanel, plus Webmin, Virtualmin, ISPConfig and others. These panels are popular, but their help is scattered across GitHub issues, old threads and translated docs. We want one place where the fixes live.
Servers and infrastructure: Linux administration, Nginx, Apache and OpenLiteSpeed, email servers, networking and DNS.
Security and performance: hardening, malware cleanup, PHP-FPM and database tuning, caching and backups.
How to get a fast answer
Search first. The search box at the top of every page covers all threads, so try your exact error message.
Post in the section for your panel or service.
Include your panel, OS, web server and PHP versions, and paste logs in [code] tags with passwords and IPs removed.
Hi everyone, I'm Jay Dev, the founder of AdminsForum.
A bit about me
I've been building and running websites and the servers behind them since 2013, as a developer and as the person who gets the call when something breaks.
Over the years I've worked with many hosting control panels, both free and commercial, and I don't push any one of them. Each panel has its strengths, and the right choice depends on your server and your sites. Like most admins, I've chased my share of 502 Bad Gateway errors, PHP-FPM problems, broken SSL renewals and mail that suddenly stopped delivering.
Why I started AdminsForum
Help for free hosting control panels is scattered across GitHub issues, old forum threads and machine-translated docs. Too often the answer you need is half-finished, out of date or written for a different version.
I wanted one place where server admins can ask, answer and keep the fixes searchable, covering every major hosting control panel, free and commercial: aaPanel, CloudPanel, CyberPanel, FASTPANEL, HestiaCP, cPanel, Plesk and more. Our comparisons stay neutral, so you can pick the panel that fits your needs.
How we create our guides
Tested on real servers. We run dedicated lab servers just for testing. Every step is done on a fresh install of the panel, and the screenshots come from those servers.
Sources checked. Versions, requirements and commands are checked against each panel's official documentation, with links at the end of each guide.
Kept up to date. Panels change often, so each guide states the version it was tested on and gets updated when things change.
Getting help here
Post your question in the Support & Troubleshooting forum for your panel. Include your panel version, OS and web server, the exact error message, and what you've already tried; it makes a quick answer much more likely.
Say hello
If you run a VPS, manage client sites or work at a hosting company, you're in the right place. Reply here and tell us:
What you run (panel, OS, web server)
What you're working on or struggling with right now
aaPanel
CloudPanel
CyberPanel
FASTPANEL
HestiaCP
Other panels